同一主机外部无法Ping通Docker容器内Open5GS网络的问题

按照官方文档部署Open5GS容器，已暴露SCTP端口38412，但主机外部无法Ping通容器内网IP（10.53.1.2），也无法建立连接。执行docker network prune并重新构建容器后问题依旧。

容器配置（docker-compose.yml片段） #

services:
  5gc:
    container_name: open5gs_5gc
    build:
      context: open5gs
      target: open5gs
      args:
        OS_VERSION: "22.04"
        OPEN5GS_VERSION: "v2.6.1"
    env_file:
      - ${OPEN_5GS_ENV_FILE:-open5gs/open5gs.env}
    privileged: true
    ports:
      - "3000:3000/tcp"
      # Uncomment port to use the 5gc from outside the docker network
      - "38412:38412/sctp"
    command: 5gc -c open5gs-5gc.yml
    healthcheck:
      test: ["CMD-SHELL", "nc -z 127.0.0.20 7777"]
      interval: 3s
      timeout: 1s
      retries: 60
    networks:
      ran:
        ipv4_address: ${OPEN5GS_IP:-10.53.1.2}

连通性测试结果 #

容器内部到主机IP正常 #

❯ docker exec -it open5gs_5gc bash
root@15e61fd8c4b3:/open5gs# ping 10.53.1.1
PING 10.53.1.1 (10.53.1.1) 56(84) bytes of data.
64 bytes from 10.53.1.1: icmp_seq=1 ttl=64 time=0.112 ms
64 bytes from 10.53.1.1: icmp_seq=2 ttl=64 time=0.040 ms
64 bytes from 10.53.1.1: icmp_seq=3 ttl=64 time=0.041 ms
^C
--- 10.53.1.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2051ms
rtt min/avg/max/mdev = 0.040/0.064/0.112/0.033 ms

主机外部Ping容器IP失败 #

❯ ping -c 4 10.53.1.2
PING 10.53.1.2 (10.53.1.2) 56(84) bytes of data.
From 10.53.1.1 icmp_seq=1 Destination Host Unreachable
From 10.53.1.1 icmp_seq=2 Destination Host Unreachable
From 10.53.1.1 icmp_seq=3 Destination Host Unreachable
From 10.53.1.1 icmp_seq=4 Destination Host Unreachable

--- 10.53.1.2 ping statistics ---
4 packets transmitted, 0 received, +4 errors, 100% packet loss, time 3049ms
pipe 4

更新：核心需求 #

需将Open5GS容器与主机上编译的gNB通过sudo ./gnb -c gnb_zmq.yaml命令连接，gNB配置文件片段如下：

# This configuration file example shows how to configure the srsRAN Project gNB to allow srsUE to connect to it. 
# This specific example uses ZMQ in place of a USRP for the RF-frontend, and creates an FDD cell with 10 MHz bandwidth. 
# To run the srsRAN Project gNB with this config, use the following command: 
#   sudo ./gnb -c gnb_zmq.yaml

amf:
  addr: 10.53.1.2                  # The address or hostname of the AMF.
  bind_addr: 10.53.1.1             # A local IP that the gNB binds to for traffic from the AMF.
...

1. 修正外部访问逻辑
   Docker默认网桥网络（这里的ran网络）是内部私有网络，主机外部无法直接访问容器的内网IP（10.53.1.2）。外部设备需访问主机IP + 映射的38412端口，而非容器内网IP。

2. 针对gNB连接的快速修复
   因为gNB运行在主机上，无需外部网络介入，直接调整配置即可：

   • 确认主机的Docker网桥接口（通常名称类似docker-ran）IP为10.53.1.1，与gNB配置的bind_addr一致。
   • 若主机无法访问容器内网IP，执行ip route检查是否存在到10.53.1.0/24网段的路由，若缺失可手动添加：sudo ip route add 10.53.1.0/24 dev <docker网桥接口名>。
   • 备选方案：将容器切换为host网络模式，修改docker-compose配置，移除networks段，添加network_mode: host，此时容器直接使用主机网络，gNB可直接通过127.0.0.1或主机IP连接AMF。

3. 防火墙排查

   • 检查主机防火墙（如ufw、iptables）是否放行SCTP 38412端口，以及是否允许ICMP请求（解决Ping失败问题）。
   • 临时关闭防火墙测试：sudo ufw disable或sudo iptables -F，验证问题是否由防火墙导致。

4. SCTP连接验证
   在主机上启动SCTP监听：sctp_test -H 10.53.1.1 -P 38412 -s，然后在容器内执行sctp_test -H 10.53.1.2 -P 38412 -c 10.53.1.1，确认端口能否正常通信。

内容的提问来源于stack exchange，提问作者hud