Docker HyperV vEthernet (DockerNAT) is Un-identified Network (Public Network) in tray

[vowstar]

Expected behavior

Hide the tray icon of vEthernet (DockerNAT)

Actual behavior

The system tray always show vEthernet (DockerNAT) is Un-identified Network (Public Network)

Information

• System: Microsoft Windows 10 Professional 10.0.14393
• Docker: Docker 1.12.5
• A laptop with Wi-Fi

Steps to reproduce the behavior

Method 1

1. Install Docker 1.12.5 (Hyper V version of Windows) or other version.
2. Unplug all network interface, close Wi-Fi, etc.
3. The tray icon of vEthernet (DockerNAT) will show, and is Un-identified Network.

Method 2

1. Install Docker 1.12.5 (Hyper V version of Windows) or other version.
2. Unplug all network interface, connect Wi-Fi.
3. Uninstall Wi-Fi driver.
4. Reboot and install Wi-Fi driver, connect Wi-Fi.
5. The tray icon of vEthernet (DockerNAT) will always show, and is Un-identified Network. We can't see Wi-Fi status at all.

Thinking of how to fix

Add the key "*NdisDeviceType" with a DWORD value of 1 to vEthernet (DockerNAT)
adapter in registry.

1. Find Hyper-V Virtual Ethernet Adapter in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\*

2. Check NETSETUPPKEY_Interface_IfAliasBase in NetSetupProperties ,
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\????\NetSetupProperties, check if NETSETUPPKEY_Interface_IfAliasBase is vEthernet (DockerNAT).

3. Add the key "*NdisDeviceType" with a DWORD value of 1 to this Ethernet Adapter to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\????

I've tested it and success, please consider improve it.

[simonferquel]

Hi, @vowstar, Thanks for the suggestion. Out of curiosity, why do you want this to be an identified network ?

[dgageot]

Hi @vowstar, I'm going to close this issue as it's not something we consider changing. Please free top reopen with more information if you feel it's important for you.

[CMCDragonkai]

Identified networks can be assigned a NetworkCategory of Public, Private or Domain. Firewall rules are often separated in Public, Private or Domain. By making the network identified, one can assign it a network category, to say private, so that private firewall rules apply to it. If you leave it as unidentified, then giving it a network category gives it to all unindentified networks (and not all unindentified networks should be considered private).

Here's how can you make Docker's network connection identified:

Add a new IP address to the interface (advanced settings) of 10.0.75.254. (used this because it's the end of the subnet, but not the broadcast address).

Add a new default gateway of 10.0.75.254.

Click ok, and finish. Windows will now identify the network using the gateway IP and assigns it an automatically generated name like Network or Network 2... etc.

Now you can assign this network connection a profile by doing:

Set-NetConnectionProfile -Name 'Network 2' -NetworkCategory Private

This only applies to IPv4 and not IPv6, because IPv6 on Windows doesn't seem to have any docs, and I don't know where to proceed here. Because the IPv6 is still enabled on the interface, there will still be an Unindentified network for the IPv6 connection. moby/moby#13481 (comment)

[imarotte]

This is definitely a feature I would want added. I can't think of a reason why we wouldn't want the network identified

[StevenWillett]

+1 from me,

Allows Docker-Windows with Hyper-V to work with shared drives properly on the local network, I lost 3 days trying to identify the root cause for shared drives not working even after applying a number of firewall rules the only way i could get this to work was to change my local security policy for unidentified networks without fully disabling my firewall.

Happy to hear how to correctly apply a firewall rule for AVG to allow Docker with Hyper-V to see shared drives without adjusting my local security policy.

[biggyspender]

So it's possible to change MobyLinux.ps1 script at C:\Program Files\Docker\Docker\resources to fix the network connection profile of the virtual interface to "private" by calling Set-NetConnectionProfile

See https://gist.github.com/biggyspender/8b5b2ed9ff63de31045d41304e3915b3

[ricketyboo]

Another vote for this. We're operating under an incredibly frustrating lock down through Symantec cloud protection and unable to locally alter firewall rules.

Using the Set-NetConnectionProfile allows communication between host and guest and removes the firewall error for file mounts, but it seems to not persist between reboots. Making it a "private" network on creation would be vastly preferable to hacking around with UAC/PS to try to automate the network every time the docker service starts up.

Edit: As a short-term solution, @biggyspender's solution does work! Thanks!

[emarques]

+1 for this change.

I've also struggled setting the shared drives feature on Windows due to this issue.

@dgageot what's the reason for this not being considered to be changed?

[marrik96]

+1 Every time I reboot I have to manually set connection profile to Private as it is reverting to Public on reboots and Docker upgrades.

[cleemesser]

+1
Please

[techpavan]

This is what helped me, inspired by #367 (comment)

I could not run the original solution posted because it did not work for DockerNAT with below error -

Set-NetConnectionProfile : No MSFT_NetConnectionProfile objects found with property 'Name' equal to 'DockerNAT'.

When run just NetConnectionProfile, found that multiple network connections have name Unidentified network and that was not helping.

From the list, I figured out InterfaceIndex for that network and made it private with the below command.

Set-NetConnectionProfile -InterfaceIndex xx -NetworkCategory Private

Note: These commands work only with PowerShell and not just command prompt.

[jonscheiding]

Please consider reopening this.

@simonferquel @dgageot To your original question of why:

After installing Docker I get the message about "a firewall blocking file sharing". This is because the Docker vNAT network is set to be a Public network by default, and my firewall rules block SMB over public networks. Those rules are configured by our domain administrator - I can't change them. Many other people using Docker in a business environment will be in a similar situation.

I can make the error go away by running the Set-NetConnectionProfile command as pointed out by others in this thread. But because the network is unidentified, that fix doesn't stick through a reboot, or through installation of a new Docker version.

I can do the workaround suggested by @biggyspender or @CMCDragonkai. But the fact that most folks in a corporate Windows environment will have to do the same workaround suggests that this issue should be kept open, even if it's low priority.