title: Cannot ping ClusterIP from inside the pod and DNS is not working for external domains like google.com
body: <p>I have installed Kubernetes on Bare-metal/Ubuntu. I am on <code>6b649d7f9f2b09ca8b0dd8c0d3e14dcb255432d1</code> commit in git. I used <code>cd kubernetes/cluster; KUBERNETES_PROVIDER=ubuntu ./kube-up.sh</code> followed by <code>cd kubernetes/cluster/ubuntu; ./deployAddons.sh</code> to start the cluster. Everything went fine and the cluster got up.</p>
  
  <p>My <code>/ubuntu/config-default.sh</code> is as follows:</p>
  
  <pre><code># Define all your cluster nodes, MASTER node comes first"
  # And separated with blank space like &lt;user_1@ip_1&gt; &lt;user_2@ip_2&gt; &lt;user_3@ip_3&gt; 
  export nodes=${nodes:-"root@192.168.48.170 root@192.168.48.180"}
  
  # Define all your nodes role: a(master) or i(minion) or ai(both master and minion), must be the order same 
  role=${role:-"ai i"}
  # If it practically impossible to set an array as an environment variable
  # from a script, so assume variable is a string then convert it to an array
  export roles=($role)
  
  # Define minion numbers
  export NUM_NODES=${NUM_NODES:-2}
  # define the IP range used for service cluster IPs.
  # according to rfc 1918 ref: https://tools.ietf.org/html/rfc1918 choose a private ip range here.
  export SERVICE_CLUSTER_IP_RANGE=${SERVICE_CLUSTER_IP_RANGE:-192.168.3.0/24}  # formerly PORTAL_NET
  # define the IP range used for flannel overlay network, should not conflict with above SERVICE_CLUSTER_IP_RANGE
  export FLANNEL_NET=${FLANNEL_NET:-172.16.0.0/16}
  
  # Optionally add other contents to the Flannel configuration JSON
  # object normally stored in etcd as /coreos.com/network/config.  Use
  # JSON syntax suitable for insertion into a JSON object constructor
  # after other field name:value pairs.  For example:
  # FLANNEL_OTHER_NET_CONFIG=', "SubnetMin": "172.16.10.0", "SubnetMax": "172.16.90.0"'
  
  export FLANNEL_OTHER_NET_CONFIG
  FLANNEL_OTHER_NET_CONFIG=''
  
  # Admission Controllers to invoke prior to persisting objects in cluster
  export ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,SecurityContextDeny
  
  # Path to the config file or directory of files of kubelet
  export KUBELET_CONFIG=${KUBELET_CONFIG:-""}
  
  # A port range to reserve for services with NodePort visibility
  SERVICE_NODE_PORT_RANGE=${SERVICE_NODE_PORT_RANGE:-"30000-32767"}
  
  # Optional: Enable node logging.
  ENABLE_NODE_LOGGING=false
  LOGGING_DESTINATION=${LOGGING_DESTINATION:-elasticsearch}
  
  # Optional: When set to true, Elasticsearch and Kibana will be setup as part of the cluster bring up.
  ENABLE_CLUSTER_LOGGING=false
  ELASTICSEARCH_LOGGING_REPLICAS=${ELASTICSEARCH_LOGGING_REPLICAS:-1}
  
  # Optional: When set to true, heapster, Influxdb and Grafana will be setup as part of the cluster bring up.
  ENABLE_CLUSTER_MONITORING="${KUBE_ENABLE_CLUSTER_MONITORING:-true}"
  
  # Extra options to set on the Docker command line.  This is useful for setting
  # --insecure-registry for local registries.
  DOCKER_OPTS=${DOCKER_OPTS:-""}
  
  # Extra options to set on the kube-proxy command line.  This is useful
  # for selecting the iptables proxy-mode, for example.
  KUBE_PROXY_EXTRA_OPTS=${KUBE_PROXY_EXTRA_OPTS:-""}
  
  # Optional: Install cluster DNS.
  ENABLE_CLUSTER_DNS="${KUBE_ENABLE_CLUSTER_DNS:-true}"
  # DNS_SERVER_IP must be a IP in SERVICE_CLUSTER_IP_RANGE
  DNS_SERVER_IP=${DNS_SERVER_IP:-"192.168.3.10"}
  DNS_DOMAIN=${DNS_DOMAIN:-"cluster.local"}
  DNS_REPLICAS=${DNS_REPLICAS:-1}
  
  # Optional: Install Kubernetes UI
  ENABLE_CLUSTER_UI="${KUBE_ENABLE_CLUSTER_UI:-true}"
  
  # Optional: Enable setting flags for kube-apiserver to turn on behavior in active-dev
  RUNTIME_CONFIG="--basic-auth-file=password.csv"
  
  # Optional: Add http or https proxy when download easy-rsa.
  # Add envitonment variable separated with blank space like "http_proxy=http://10.x.x.x:8080 https_proxy=https://10.x.x.x:8443"
  PROXY_SETTING=${PROXY_SETTING:-""}
  
  DEBUG=${DEBUG:-"false"}
  </code></pre>
  
  <p>Then, I created a pod using the following yml file:</p>
  
  <pre><code>apiVersion: v1
  kind: Pod
  metadata:
    name: nginx
    labels:
      app: nginx
  spec:
    containers:
    - name: nginx
      image: nginx
      ports:
      - containerPort: 80
  </code></pre>
  
  <p>And a service using the following yml:</p>
  
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    name: nginx-service
  spec:
    ports:
    - port: 8000
      targetPort: 80
      protocol: TCP
    selector:
      app: nginx
    type: NodePort
  </code></pre>
  
  <p>Then, I got into the started container terminal using <code>docker exec -it [CONTAINER_ID] bash</code>. There are mainly two problems:</p>
  
  <ol>
  <li>I cannot ping external domains like google.com, but I can ping external IPs like 8.8.8.8. So the container has internet access.</li>
  <li>Internal services resolve to correct Internal ClusterIPs, but I cannot ping that IP from inside the container.</li>
  </ol>
  
  <p>The host's <code>/etc/resolve.conf</code> file is as follows:</p>
  
  <pre><code>nameserver 8.8.8.8
  nameserver 127.0.1.1
  </code></pre>
  
  <p>The container's <code>/etc/resolve.conf</code> file is as follows:</p>
  
  <pre><code>search default.svc.cluster.local svc.cluster.local cluster.local
  nameserver 192.168.3.10
  nameserver 8.8.8.8
  nameserver 127.0.1.1
  options ndots:5
  </code></pre>
  
  <p>Regarding the first problem, I think it could be related to either SkyDNS nameservers  misconfigurarion or a custom configuration that I have to do but I am not aware of.</p>
  
  <p>However, I dont have any idea about why the containers cannot ping ClusterIPs.</p>
  
  <p>Any workarounds?</p>