Dockerネットワーク＆IPプール計算機 - VPN/LAN衝突を回避
← Back to Main Calculator

Docker Network & IP Pool Calculator

Find safe, conflict-free Docker bridge and IP pool subnets that avoid corporate VPN, home LAN, and Tailscale overlaps. Generate daemon.json config instantly.

Existing Network Environment (Avoid List)

Enter subnets your LAN, VPNs, or other networks already use. Docker will avoid these ranges.

Docker Pool Requirements

Including default bridge
All Subnets Conflict-Free
Default Bridge Subnet (bip)
172.30.0.1/16
docker0 bridge IP
Address Pool Range
172.31.0.0/16
size 24 — 256 networks supported
Max Docker Networks
256
With /24 per network

Docker Daemon Configuration

Add this to /etc/docker/daemon.json and restart Docker: sudo systemctl restart docker

Docker Compose Network Definition
Use this snippet to define a custom network in your docker-compose.yml:
Docker IP Pool Planning Guide
Why Docker's Default Bridge Conflicts with VPNs
Docker's default bridge network uses 172.17.0.0/16 for the docker0 interface and assigns subnets from the 172.16.0.0/12 range for user-defined networks. Corporate VPNs (Cisco AnyConnect, Palo Alto GlobalProtect, OpenVPN, WireGuard) frequently use the same RFC 1918 ranges. When a VPN assigns you an IP like 172.17.5.10 from the corporate network, and Docker simultaneously assigns 172.17.0.2 to a container, your operating system's routing table becomes ambiguous. Traffic destined for the container may be sent into the VPN tunnel, and VPN traffic may be intercepted by a container.
This causes symptoms like: containers can't reach the internet, VPN disconnects when Docker starts, curl from inside a container hangs indefinitely, and docker run succeeds but the container is unreachable. The fix is to reconfigure Docker's default address pools to use a range that doesn't conflict with your VPN or LAN — and this calculator does exactly that in seconds.
How Docker's default-address-pools Work
Docker's default-address-pools configuration (introduced in Docker 18.06+) allows you to define the IP range from which Docker automatically allocates subnets for user-defined bridge networks (created with docker network create or docker-compose). The configuration has two parts: base — the overall CIDR block to draw from, and size — the subnet mask for each individual network.
For example, base: 172.31.0.0/16, size: 24 means Docker will carve /24 subnets out of 172.31.0.0/16, creating networks like 172.31.0.0/24, 172.31.1.0/24, 172.31.2.0/24, etc. The bip setting defines the subnet for the default docker0 bridge. These two settings together replace the old fixed 172.17.0.0/16 default.
RFC 1918 Private IP Ranges Reference
CIDR BlockIP RangeTotal IPsCommon Use
10.0.0.0/810.0.0.0 – 10.255.255.25516,777,216Large corporate VPNs, AWS VPCs
172.16.0.0/12172.16.0.0 – 172.31.255.2551,048,576Docker default, VPNs, internal networks
192.168.0.0/16192.168.0.0 – 192.168.255.25565,536Home routers, small office LANs
100.64.0.0/10100.64.0.0 – 100.127.255.2554,194,304Tailscale, CGNAT, ISP carrier-grade NAT
関連ツール
CIDR CalculatorSubnet CalculatorVLSM CalculatorMTU & MSS CalculatorK8s CIDR PlannerTerraform GeneratorOverlap Checker
Frequently Asked Questions
What happens when Docker and VPN subnets overlap?
When Docker's default 172.17.0.0/16 or 172.18.0.0/16 overlaps with your VPN's subnet, your OS routing table gets conflicting entries for the same IP range. Traffic to containers may be redirected into the VPN tunnel and lost, and VPN traffic may be routed to containers instead of the corporate network. Common symptoms: containers can't reach the internet, docker run succeeds but containers are unreachable, VPN disconnects when Docker starts, and curl from inside a container hangs indefinitely. The fix is to reconfigure Docker's bip and default-address-pools to a non-conflicting range using the configuration generated by this calculator.
How do I check which subnets my Docker is currently using?
Run docker network inspect bridge to see the default bridge subnet (usually 172.17.0.0/16). Run docker network ls to list all networks, then docker network inspect <network-name> for each one. Run ip route show to see all routes on your host — Docker routes appear as 172.17.0.0/16, 172.18.0.0/16, etc. For a quick check of what your VPN is using, run ip addr show (or ipconfig on Windows) to see the VPN interface IP, then compare against Docker's ranges. Enter all conflicting subnets into this calculator to get an automatic safe replacement configuration.
Can I use 192.168.x.x for Docker to avoid all conflicts?
Using 192.168.0.0/16 for Docker works well if your home LAN is on a different subnet (e.g., 192.168.1.0/24). But many corporate VPNs also route to 192.168.x.x networks for office LANs, so it's not guaranteed to be conflict-free. The safest approach is to select a base CIDR that is least likely to be used by your specific environment. For corporate users, 172.30.0.0/16 for bip and 172.31.0.0/16 for the pool (at the far end of the 172.16.0.0/12 range) often works well. This calculator checks all your avoid list subnets against any selected base CIDR and highlights overlaps immediately.
Does changing Docker's bip affect existing containers?
Yes — changing bip or default-address-pools requires restarting Docker (systemctl restart docker), which stops all running containers. The containers will be recreated with new IPs when they restart. Data volumes and named volumes are preserved, but container IP addresses will change. For production environments, plan a maintenance window, drain traffic, and ensure all services use service discovery (DNS) rather than hardcoded IPs. After the change, run docker network prune to clean up old networks, and verify with docker info that the new bip is active.
What is the difference between bip and default-address-pools in Docker?
bip (bridge IP) sets the subnet for Docker's default docker0 bridge network — the network containers attach to when you run docker run without --network. It uses a /16 subnet. default-address-pools defines the range from which Docker allocates subnets for user-defined networks created with docker network create or docker-compose. The base specifies the overall CIDR, and size specifies the subnet mask for each individual network. Together, they give you full control over Docker's IP addressing. Before Docker 18.06, both were fixed to 172.17.0.0/16 (bip) and 172.17.0.0/16–172.31.0.0/16 (pools).