Using a custom address space with a Container NAT network

Using a custom address space with a Container NAT network

Q. How can I use my own address space for a NAT network with Windows containers?

A. A default NAT network is created when the Docker daemon starts and with the RTM of Windows Server 2016 only a single NAT network can exist because only one instance of WinNAT is supported on a host that enables the NAT network to function.

There are two options if you don't wish to use the default address space the NAT network uses (for example if you use that address space in your normal network).

The first option is to change the address space used by the default NAT network.

  1. Stop the docker daemon
    stop-service docker
  2. Remove the default network
    Get-ContainerNetwork | Remove-ContainerNetwork
  3. Ensure the default switch and WinNAT instance are gone by running Get-VMSwitch and Get-NetNat.
  4. Edit the daemon.json file in folder C:\ProgramData\docker\config or if it does not exist create the file. For more information on docker configuration see
  5. In the file add the following JSON but change to match the IP range you wish to use
    "fixed-cidr": ""
  6. Restart docker
    start-service docker

The other option is to tell the Docker daemon to not create the default NAT network at all by repeating the steps above but in step 5 the content to be added is:

   "bridge": "none"

Now create your own NAT network with the address space you want (note when starting a docker instance you will have to specify which network it will connect to manually):

docker network create -d nat --subnet= NatNetwork1

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.