How to design a docker-compose that isolates multiple internal networks and can all access the external network？ - networking

Question

I want to create a network to verify some technology such as NAT,P2P etc.
The topology diagram is as follows
host machine
|
internet
|
----------
| | |
s1r c1r c2r
| | |
s1 c1 c2
s1r,c1r,c2r are routers on internet,and the s1,c1,c2 are server,clients.
In order to simulate the real Internet, I hope to achieve the following effect
1.server and clients can't ping,because they belong to a different subnet
such as c1->s1,c2 ×
2.server and clients can ping routers.
such as c1->s1r,c1r,c2r √
3.all devices can ping host machine and external internet
such as c1->www.google.com √
But the network I am implementing now only satisfies the second rule, how should I modify it?
And when I ping c1(192.168.2.100) from s1(192.168.1.100), I can ping through. Use tcpdump to capture packets on c1r and see that the request is recorded as
03:19:46.771468 IP 192.168.1.100 > p2ptest_c1_1.p2ptest_c1-internal: ICMP echo request, id 181, seq 4, length 64
03:19:46.771487 IP p2ptest_c1_1.p2ptest_c1-internal > 192.168.1.100: ICMP echo reply, id 181, seq 4, length 64
I think this means that NAT does not take effect, because the source address of ping is not the address of s1r (10.0.0.101), but the address of s1 (192.168.1.100), which has not successfully simulated the NAT translation function.
My docker-compose.yaml is as follows, please tell me where I am wrong? Thanks
version: "3.3"
services:
s1r:
image: ubuntu
cap_add:
- NET_ADMIN
hostname: s1r
networks:
s-internal:
ipv4_address: 192.168.1.2
internet:
ipv4_address: 10.0.0.101
volumes:
- ./volumes/programs:/home/programs
command: >-
sh -c "apt update -y &&
apt install -y net-tools traceroute iputils-ping iptables iproute2 netcat tcpdump &&
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE &&
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE &&
ip route add 192.168.2.0/24 via 10.0.0.102 &&
ip route add 192.168.3.0/24 via 10.0.0.103 &&
tail -f /dev/null"
c1r:
image: ubuntu
cap_add:
- NET_ADMIN
hostname: c1r
networks:
c1-internal:
ipv4_address: 192.168.2.2
internet:
ipv4_address: 10.0.0.102
volumes:
- ./volumes/programs:/home/programs
command: >-
sh -c "apt update -y &&
apt install -y net-tools traceroute iputils-ping iptables iproute2 netcat tcpdump &&
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE &&
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE &&
ip route add 192.168.1.0/24 via 10.0.0.101 &&
ip route add 192.168.3.0/24 via 10.0.0.103 &&
tail -f /dev/null"
c2r:
image: ubuntu
cap_add:
- NET_ADMIN
hostname: c2r
networks:
c2-internal:
ipv4_address: 192.168.3.2
internet:
ipv4_address: 10.0.0.103
volumes:
- ./volumes/programs:/home/programs
command: >-
sh -c "apt update -y &&
apt install -y net-tools traceroute iputils-ping iptables iproute2 netcat tcpdump &&
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE &&
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE &&
ip route add 192.168.1.0/24 via 10.0.0.101 &&
ip route add 192.168.2.0/24 via 10.0.0.102 &&
tail -f /dev/null"
s1:
image: ubuntu
cap_add:
- NET_ADMIN
hostname: s1
networks:
s-internal:
ipv4_address: 192.168.1.100
volumes:
- ./volumes/programs:/home/programs
command: >-
sh -c "apt update -y &&
apt install -y net-tools traceroute iputils-ping iptables iproute2 netcat tcpdump &&
ip route del default &&
ip route add default via 192.168.1.2 &&
tail -f /dev/null"
c1:
image: ubuntu
cap_add:
- NET_ADMIN
hostname: c1
networks:
c1-internal:
ipv4_address: 192.168.2.100
volumes:
- ./volumes/programs:/home/programs
command: >-
sh -c "apt update -y &&
apt install -y net-tools traceroute iputils-ping iptables iproute2 netcat tcpdump &&
ip route del default &&
ip route add default via 192.168.2.2 &&
tail -f /dev/null"
c2:
image: ubuntu
cap_add:
- NET_ADMIN
hostname: c2
networks:
c2-internal:
ipv4_address: 192.168.3.100
volumes:
- ./volumes/programs:/home/programs
command: >-
sh -c "apt update -y &&
apt install -y net-tools traceroute iputils-ping iptables iproute2 netcat tcpdump &&
ip route del default &&
ip route add default via 192.168.3.2 &&
tail -f /dev/null"
networks:
internet:
driver: bridge
ipam:
config:
- subnet: 10.0.0.0/24
s-internal:
driver: bridge
ipam:
config:
- subnet: 192.168.1.0/24
c1-internal:
driver: bridge
ipam:
config:
- subnet: 192.168.2.0/24
c2-internal:
driver: bridge
ipam:
config:
- subnet: 192.168.3.0/24