Podman use KVM bridge, but can't access internet, other containers, or local

[marcusds]

I can access my container off the public port no problem, but I am unable to get the containers to access the internet, other containers, or something running on the local server like a DB.

Using --network=host works with the exception of port mapping, which is causing me issues since I am running into some port conflicts the images won't let me resolve.,

I am running Ubuntu Server 21.10, I have no firewall on the machine.

What could be preventing my containers from communicating on anything other than the ports they have defined?

Example of how I am running a container:

podman run -d \
-p 8087:8080 \
--network=bridge \
something/something:latest

My .conflist:

{
   "cniVersion": "0.4.0",
   "name": "podman",
   "plugins": [
      {
         "type": "bridge",
         "bridge": "br0",
         "isGateway": false,
         "ipMasq": false,
         "hairpinMode": true,
         "ipam": {
            "type": "host-local",
            "ranges": [
               [
                  {
                     "subnet": "192.168.86.0/24",
                     "gateway": "192.168.86.1",
                     "rangeStart": "192.168.86.170",
                     "rangeEnd": "192.168.86.185"
                  }
               ]
            ]
         }
      },
      {
         "type": "portmap",
         "capabilities": {
            "portMappings": true
         }
      },
      {
         "type": "firewall"
      },
      {
         "type": "tuning"
      }
   ]
}

[Luap99]

The CNI bridge plugin is designed to create its own bridge interface and not to reuse an existing bridge. I think it is possible that the KVM iptables rules conflict with the ones created by CNI.

[marcusds]

Unfortunately when having CNI make its own bridge it kept kicking out my other bridge and bringing down other stuff.

But I got it sorted with mheon's help.

[mheon]

Looking at your provided CNI config:
"isGateway": false,

Did you intend to do this? I don't think it will prevent containers on the same bridge from talking to each other, but it definitely will prevent them from getting to the internet or the host system.

[marcusds]

I had disabled that after extermination, because it was causing the error:

ERRO[0000] Error adding network: failed to set bridge addr: "br0" already has an IP address different from 192.168.86.1/24 
ERRO[0000] Error while adding pod to CNI network "podman": failed to set bridge addr: "br0" already has an IP address different from 192.168.86.1/2

But your comment made me look again at the error and made me realize I need to set the gateway (ipam.ranges.gateway) to host machine IP.

I've done that and it works now.

Thank you.