Docker: subnet clients can't ping other subnet Two containers are created with this Dockerfile:

FROM ubuntu:18.04

RUN apt update &amp;&amp; apt upgrade -y &amp;&amp; apt install -y vim iputils-ping net-tools tcpdump iproute* iptables traceroute


The were created with the following commands in a Ubuntu 18.04 machine:

sudo docker network create --internal --subnet=192.168.2.0/24 netR

sudo docker network create --internal --subnet=172.16.1.0/24 netB1

sudo docker run --name R1_ipsec --hostname R1 --privileged --cap-add=NET_ADMIN --net netR --ip="192.168.2.100" -dit image1
sudo docker run --name R2_ipsec --hostname R2 --privileged --cap-add=NET_ADMIN --net netR --ip="192.168.2.200" -dit image1

sudo docker network connect --ip="172.16.1.254" netR R1

sudo docker run --name PC1_ipsec --hostname PC1_ipsec --privileged --cap-add=NET_ADMIN --net netB1 --ip="172.16.1.2" -dit image1

sudo docker exec PC1 route delete default gw 172.16.1.1

sudo docker exec PC1 route add default gw 172.16.1.254 dev eth0


The problem: PC1 can't ping the R1's interface 192.168.1.100, even if R1 have net.ipv4.ip_forward = 1

Doker version: Docker version 18.06.1-ce, build e68fc7a
The problem was in this line:

sudo docker network create --internal --subnet=192.168.2.0/24 netR


The --internal option makes the network unreachable from other Docker networks.

The solution was to remove this option.