Thanks @Mikero . I now understand the networking with vctl a bit more. So basically the container host is mapped to all interfaces on the Mac, and does a port-forwarding to the container IP and por...
See more...
Thanks @Mikero . I now understand the networking with vctl a bit more. So basically the container host is mapped to all interfaces on the Mac, and does a port-forwarding to the container IP and port regardless of which interface you address. Also, the traffic is souce-NAT:ed with the external IP as the source. I managed to kind of work around this by looking at the properties configured of the vmnet adapter assigned to the container host. There I could see that DHCP was enabled, and that NAT and connecting the local host was enabled too. Disabling the NAT was not an option, as the container start was aborted once that's detected. But I could disable the DHCP, And then I enable DHCP server mode on one of my VMs (a firewall acting as a router), and put it on another IP, next to the local Mac's IP. After this, the containers are provided an IP from my firewall, which means I have more control of the IP assigned, as well as can set the default gateway to be that of the firewall. And now I can route traffic straight the container, without NAT. And by omitting the usual portmapping when starting the container, I can basically also prevent any traffic from coming in that way. The only really odd thing I've observed so far is that _if_ I try to use the portmapping on the Mac host, just before the first TCP segment is sent, there is an ARP request sent for the container IP address, but with the sender IP of my firewall, but the sender MAC and source MAC of the local Mac host's interface... (this is detected as an IP conflict by Wireshark, given that another MAC address claims to have the IP of the firewall/gateway. vctl ps is by the way still able to detect what IP was assigned to the container. What remains to be seen is how persistent the MAC address assignment to the container is, and whether IP address reservation in my DHCP server will work over time, so that my services end up on predictable IP addresses. Edit: One showstopper I relized in the end is that when I do a vctl system stop and vctl system start, a new vmnet adapter is created... Not sure if that's due to the original vmnet adapter already existed and was used.... Bummers! Any ideas on how to tweak or hack things to get around this?