How to use container edition of CheckMK with VRFs at the host?

Troubleshooting
1

CMK version: 2.5.0p17 Community Edition (Container)

OS version: VyOS Stream 2026.03 (Linux vyos 6.6.128-vyos #1 SMP Mon Mar 16 10:04:04 UTC 2026 x86_64 GNU/Linux, Podman version 4.9.5)

Error message:

Due to reasons I prefer to run my VM-guests with two VRFs, one for MGMT and one for PROD/TEST.

The VM-guest / container host I use is VyOS Stream 2026.03 who uses Podman as container engine.

During my first attempt CheckMK starts and I can access its GUI - however the container itself cannot reach the PROD/TEST network.

With other containers I can assign which VRF (or interface) they should be using for incoming/outgoing traffic like you can bind the IPv4 to be used like so:

192.0.2.1%PROD

But how do I do the same with CheckMK?

I want the CheckMK mgmt-interfaces (webgui) to be available through the VRF MGMT and the snmp fetching/monitoring to occur through the VRF PROD.

Is there a local config for this within CheckMK I need to tweak (and where is that hidden) or do there exist some other recommended way to resolve this?

This is the current config of the container in VyOS:

set container name checkmk allow-host-networks
set container name checkmk environment CMK_PASSWORD value 'CHANGEME'
set container name checkmk environment TZ value 'Europe/Stockholm'
set container name checkmk image 'docker.io/checkmk/check-mk-community:2.5.0p17'
set container name checkmk memory '4096'
set container name checkmk restart 'on-failure'
set container name checkmk tmpfs tmp destination '/opt/omd/sites/cmk/tmp'
set container name checkmk tmpfs tmp size '2048'
set container name checkmk volume monitoring destination '/omd/sites'
set container name checkmk volume monitoring source '/config/container/checkmk'
2

If i read the documentation correctly, you need to configure two different container networks (one for each VRF) and then you need to assign booth to the container.
With something like this.

set container name checkmk network VRFA address 10.100.1.10
set container name checkmk network VRFB address 10.200.1.10

What part of your container is then reachable over what IP is a complete other question :wink:
This depends on your routing configuration and web-server configuration. The internal Apache is listening on all IPs i think as an example.

3

Here is what I figured out so far…

You can only assign one podman network to a single container so the other option is to use “allow-host-networks” (or try to use macvlan).

So here is how I got it working (so far with just one vrf, will continue digging if its possible for CheckMK to use both vrfs as in MGMT for webgui and PROD for snmp gets).

VyOS config:

Container config:

Room for improvement, define userid and groupid the container will be runned as. Will also affect ownership of /config/container/checkmk at the host.

I place the container directory in /config/container/ so when VyOS gets updated this will be moved to next version (VyOS is immutable and uses persitent directories where /config is copied to next version during update of VyOS).

allow-host-networks will expose the host interfaces to the container.

net-raw is needed for ping to work from within the container (otherwise you will get errors in CheckMK webgui during service discovery).

set container name checkmk allow-host-networks
set container name checkmk capability 'net-raw'
set container name checkmk environment CMK_PASSWORD value 'CHANGEME'
set container name checkmk environment TZ value 'Europe/Stockholm'
set container name checkmk image 'docker.io/checkmk/check-mk-community:2.5.0p17'
set container name checkmk memory '4096'
set container name checkmk restart 'on-failure'
set container name checkmk tmpfs tmp destination '/opt/omd/sites/cmk/tmp'
set container name checkmk tmpfs tmp size '2048'
set container name checkmk volume monitoring destination '/omd/sites'
set container name checkmk volume monitoring source '/config/container/checkmk'

Firewall config:

For troubleshooting in LAB I just accept everything but here is where you for production most likely need to tweak the ruleset.

set firewall ipv4 forward filter default-action 'accept'
set firewall ipv4 input filter default-action 'accept'
set firewall ipv4 output filter default-action 'accept'
set firewall ipv4 prerouting raw default-action 'accept'
set firewall ipv6 forward filter default-action 'drop'
set firewall ipv6 input filter default-action 'drop'
set firewall ipv6 output filter default-action 'drop'
set firewall ipv6 prerouting raw default-action 'drop'

Interface config:

eth0 is MGMT and eth1 is PROD.

set interfaces ethernet eth0 address '10.99.0.100/24'
set interfaces ethernet eth0 vrf 'MGMT'
set interfaces ethernet eth1 address '192.168.1.20/24'
set interfaces ethernet eth1 vrf 'PROD'

Route config:

Setup route-leak so vrf default (where the container runs at) can use vrf PROD as default gateway.

set protocols static route 0.0.0.0/0 next-hop 192.168.1.254 vrf 'PROD'

Sysctl config:

Needed for containers to bind to IP they dont necessary see during startup.

set system sysctl parameter net.ipv4.ip_nonlocal_bind value '1'
set system sysctl parameter net.ipv6.ip_nonlocal_bind value '1'

VRF config:

bind-to-all is needed for things to work as expected.

set vrf bind-to-all
set vrf name MGMT ipv6 disable-forwarding
set vrf name MGMT table '100'
set vrf name MGMT vni '10000100'
set vrf name PROD ipv6 disable-forwarding
set vrf name PROD protocols static route 0.0.0.0/0 next-hop 192.168.1.254 interface 'eth1'
set vrf name PROD table '101'
set vrf name PROD vni '10000101'

Then once the container is running at the host find out containerid of CheckMK (note this will change on every start of container):

sudo podman ps -a

And enter this container:

sudo podman exec -it <id> /bin/bash

Run omd in interactive mode to get to the basic-settings and there change “TMPFS: off” to “TMPFS: on”, when done dont forget to restart the container.

omd config cmk

You can also do this to print out current settings:

omd config cmk show

While at it you probably also want to change max_concurrent_checks in /config/container/checkmk/cmk/etc/nagios/nagios.d/timing.cfg to something like 2x number of cores (VCPU) available.

Bonus:

When attempting to use network instead of allow-host-networks for your contaiener you might need to create a Source NAT rule for egress traffic (SNMP polling) to work.

set nat source rule 10 description 'Outbound NAT for Podman IP-range using VRF PROD'
set nat source rule 10 outbound-interface name 'eth1'
set nat source rule 10 source address '10.88.0.0/16'
set nat source rule 10 translation address 'masquerade'