安装Docker后VPC对等连接失效问题求助

问题背景 #

两个通过VPC对等连接的VPC，各有一台EC2实例，原本私有IP互ping正常。在其中一台EC2安装Docker后，无法ping通另一台，但VPC可达性分析器显示连接可达。

已尝试操作 #

• 发现Docker自动添加iptables规则（官方文档说明为正常行为）
• 添加iptables规则允许所有访问：

  $ sudo iptables -I INPUT -j ACCEPT
  $ sudo iptables -I OUTPUT -j ACCEPT
  

  执行sudo iptables-save保存后，ping仍失败
• 卸载Docker和iptables并重启实例，ping恢复正常
• 重装Docker前，在/etc/docker/daemon.json添加配置禁用Docker修改iptables：

  {
    "iptables": "false"
  }
  

  启动docker后问题依旧

系统信息 #

使用Amazon Linux 2023：

$ cat /etc/os-release
NAME="Amazon Linux"
VERSION="2023"
ID="amzn"
ID_LIKE="fedora"
VERSION_ID="2023"
PLATFORM_ID="platform:al2023"
PRETTY_NAME="Amazon Linux 2023"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2023"
HOME_URL="https://aws.amazon.com/linux/"
BUG_REPORT_URL="https://github.com/amazonlinux/amazon-linux-2023"
SUPPORT_END="2028-03-01"

更新信息 #

Docker网络列表 #

$ docker network ls
NETWORK ID     NAME                                             DRIVER    SCOPE
5823629b2038   bridge                                           bridge    local
83fd27326747   docker-registry-server_docker-registry-network   bridge    local
efa259e6d263   docker-registry_docker-registry-network          bridge    local
8582e4f3a279   host                                             host      local
2924559cf5fd   ldap_default                                     bridge    local
52352b7d663b   none                                             null      local

网络接口信息 #

$ ifconfig
br-2924559cf5fd: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.24.0.1  netmask 255.255.0.0  broadcast 172.24.255.255
        ether 02:42:db:c0:08:51  txqueuelen 0  (Ethernet)
        RX packets 1537  bytes 352781 (344.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1450  bytes 249327 (243.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

br-83fd27326747: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.20.0.1  netmask 255.255.0.0  broadcast 172.20.255.255
        ether 02:42:81:61:bc:25  txqueuelen 0  (Ethernet)
        RX packets 1537  bytes 352781 (344.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1450  bytes 249327 (243.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

br-efa259e6d263: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.23.0.1  netmask 255.255.0.0  broadcast 172.23.255.255
        inet6 fe80::42:58ff:fec1:7e37  prefixlen 64  scopeid 0x20<link>
        ether 02:42:58:c1:7e:37  txqueuelen 0  (Ethernet)
        RX packets 1537  bytes 352781 (344.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1450  bytes 249327 (243.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

docker0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        ether 02:42:ee:ef:e3:6d  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens5: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9001
        inet 192.168.36.110  netmask 255.255.128.0  broadcast 192.168.127.255
        inet6 fe80::2c:d5ff:fea2:64b8  prefixlen 64  scopeid 0x20<link>
        ether 02:2c:d5:a2:64:b8  txqueuelen 1000  (Ethernet)
        RX packets 1537  bytes 352781 (344.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1450  bytes 249327 (243.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 8893  bytes 4936039 (4.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8893  bytes 4936039 (4.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth572770b: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::649c:6cff:fe7a:e2d0  prefixlen 64  scopeid 0x20<link>
        ether 66:9c:6c:7a:e2:d0  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 13  bytes 1046 (1.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth85112bc: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::d05a:4eff:fe46:2da0  prefixlen 64  scopeid 0x20<link>
        ether d2:5a:4e:46:2d:a0  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 14  bytes 1156 (1.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

解决建议与排查方向 #

1. 检查路由表优先级问题 #

Docker创建的网桥会添加默认路由，可能导致发往对等VPC的流量被错误路由到Docker网桥。执行ip route show查看路由表，确认目标VPC的私有IP段是否有正确的路由指向EC2的主网卡（ens5）。如果存在冲突路由，手动添加更高优先级的静态路由：

sudo ip route add <目标VPC CIDR> via <本地子网网关> dev ens5

2. 验证Docker禁用iptables是否生效 #

即使配置了"iptables": "false"，仍需确认Docker是否真的没有修改iptables。执行iptables -L -n查看当前规则，同时检查/var/log/docker.log日志，确认启动时是否加载了daemon.json配置。如果配置未生效，需确保文件格式正确（无语法错误），并重启docker服务：

sudo systemctl daemon-reload
sudo systemctl restart docker

3. 检查防火墙规则（firewalld） #

Amazon Linux 2023默认使用firewalld而非iptables-service，直接操作iptables规则可能被firewalld覆盖。执行以下命令查看firewalld规则：

sudo firewall-cmd --list-all

添加允许对等VPC流量的规则：

sudo firewall-cmd --add-source=<目标VPC CIDR> --permanent
sudo firewall-cmd --reload

4. 检查Docker网络的IP段冲突 #

从ifconfig输出看，Docker网桥使用了172.17.0.0/16、172.20.0.0/16等网段。如果目标VPC的私有IP段与这些网段重叠，会导致路由冲突。确认目标VPC的CIDR是否与Docker网桥网段重叠，若重叠需修改Docker默认网桥的IP段：
在/etc/docker/daemon.json中添加：

{
  "iptables": false,
  "bip": "192.168.100.1/24"
}

选择一个不与现有VPC冲突的网段，重启docker服务。

5. 抓包分析流量路径 #

使用tcpdump在主网卡（ens5）和Docker网桥抓包，确认ping包是否发出或接收：

# 在ens5网卡抓ping包
sudo tcpdump -i ens5 icmp
# 在Docker网桥抓包（如br-efa259e6d263）
sudo tcpdump -i br-efa259e6d263 icmp

通过抓包结果判断流量是否被错误转发或丢弃。

内容的提问来源于stack exchange，提问作者Tapas Bose