{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/", "slug": "dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks", "url": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/" }, "title": "Include the container bridge in Microsoft Tunnel address-conflict checks", "summary": "Why can a Tunnel gateway fail to route a corporate network even when its client pool is distinct?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:14+00:00", "modified_at": "2026-09-10T01:40:03+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 240, "potentially_affected": "Apply this review to the Linux container-host network for Microsoft Tunnel. Inspect the active runtime and bridge configuration rather than assuming the documented default is still in use.", "dse_recommendation": "Add the container bridge as its own entry in the gateway's address inventory.", "primary_source": { "name": "Prerequisites the Microsoft Tunnel VPN for Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-security/microsoft-tunnel/prerequisites", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft Tunnel’s Docker and Podman containers use a bridge network to forward traffic through their Linux host. If that bridge overlaps a corporate network, the gateway cannot successfully route traffic to that network. The documented defaults are 172.17.0.0/16 for Docker and 10.88.0.0/16 for Podman. Microsoft provides procedures for changing them, but requires Tunnel Gateway installation before changing the bridge configuration. Microsoft Learn.

\n

Applicability

\n

Apply this review to the Linux container-host network for Microsoft Tunnel. Inspect the active runtime and bridge configuration rather than assuming the documented default is still in use.

\n

DSE recommendation

\n

Add the container bridge as its own entry in the gateway’s address inventory. Compare the actual bridge range with the corporate destinations that clients must reach. If a conflict is found, have the network and Linux owners plan the runtime-specific change through an approved maintenance procedure. Preserve the initial bridge and routing state, select an agreed nonoverlapping range, and follow the documented installation-order requirement. Do not paste the source’s example replacement address into a production design.

\n

Verification

\n

After an approved change, inspect the effective bridge configuration and test a named destination in the formerly conflicting network from an intended tunnel client. Also verify an unaffected destination to detect unintended routing changes. Keep the client address pool and container bridge results separate so a successful check of one is not recorded as proof of the other.

\n

Official references

\n

Microsoft Learn: Prerequisites the Microsoft Tunnel VPN for Microsoft Intune.

", "content_text": "Source facts\nMicrosoft Tunnel’s Docker and Podman containers use a bridge network to forward traffic through their Linux host. If that bridge overlaps a corporate network, the gateway cannot successfully route traffic to that network. The documented defaults are 172.17.0.0/16 for Docker and 10.88.0.0/16 for Podman. Microsoft provides procedures for changing them, but requires Tunnel Gateway installation before changing the bridge configuration. Microsoft Learn.\nApplicability\nApply this review to the Linux container-host network for Microsoft Tunnel. Inspect the active runtime and bridge configuration rather than assuming the documented default is still in use.\nDSE recommendation\nAdd the container bridge as its own entry in the gateway’s address inventory. Compare the actual bridge range with the corporate destinations that clients must reach. If a conflict is found, have the network and Linux owners plan the runtime-specific change through an approved maintenance procedure. Preserve the initial bridge and routing state, select an agreed nonoverlapping range, and follow the documented installation-order requirement. Do not paste the source’s example replacement address into a production design.\nVerification\nAfter an approved change, inspect the effective bridge configuration and test a named destination in the formerly conflicting network from an intended tunnel client. Also verify an unaffected destination to detect unintended routing changes. Keep the client address pool and container bridge results separate so a successful check of one is not recorded as proof of the other.\nOfficial references\nMicrosoft Learn: Prerequisites the Microsoft Tunnel VPN for Microsoft Intune.", "content_markdown": "## Source facts\n\nMicrosoft Tunnel’s Docker and Podman containers use a bridge network to forward traffic through their Linux host. If that bridge overlaps a corporate network, the gateway cannot successfully route traffic to that network. The documented defaults are 172.17.0.0/16 for Docker and 10.88.0.0/16 for Podman. Microsoft provides procedures for changing them, but requires Tunnel Gateway installation before changing the bridge configuration. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-security/microsoft-tunnel/prerequisites).\n\n## Applicability\n\nApply this review to the Linux container-host network for Microsoft Tunnel. Inspect the active runtime and bridge configuration rather than assuming the documented default is still in use.\n\n## DSE recommendation\n\nAdd the container bridge as its own entry in the gateway’s address inventory. Compare the actual bridge range with the corporate destinations that clients must reach. If a conflict is found, have the network and Linux owners plan the runtime-specific change through an approved maintenance procedure. Preserve the initial bridge and routing state, select an agreed nonoverlapping range, and follow the documented installation-order requirement. Do not paste the source’s example replacement address into a production design.\n\n## Verification\n\nAfter an approved change, inspect the effective bridge configuration and test a named destination in the formerly conflicting network from an intended tunnel client. Also verify an unaffected destination to detect unintended routing changes. Keep the client address pool and container bridge results separate so a successful check of one is not recorded as proof of the other.\n\n## Official references\n\n[Microsoft Learn: Prerequisites the Microsoft Tunnel VPN for Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-security/microsoft-tunnel/prerequisites)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/", "url": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Include the container bridge in Microsoft Tunnel address-conflict checks", "item": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/", "url": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/", "headline": "Include the container bridge in Microsoft Tunnel address-conflict checks", "description": "Why can a Tunnel gateway fail to route a corporate network even when its client pool is distinct?", "abstract": "Why can a Tunnel gateway fail to route a corporate network even when its client pool is distinct?", "articleBody": "Source facts\nMicrosoft Tunnel’s Docker and Podman containers use a bridge network to forward traffic through their Linux host. If that bridge overlaps a corporate network, the gateway cannot successfully route traffic to that network. The documented defaults are 172.17.0.0/16 for Docker and 10.88.0.0/16 for Podman. Microsoft provides procedures for changing them, but requires Tunnel Gateway installation before changing the bridge configuration. Microsoft Learn.\nApplicability\nApply this review to the Linux container-host network for Microsoft Tunnel. Inspect the active runtime and bridge configuration rather than assuming the documented default is still in use.\nDSE recommendation\nAdd the container bridge as its own entry in the gateway’s address inventory. Compare the actual bridge range with the corporate destinations that clients must reach. If a conflict is found, have the network and Linux owners plan the runtime-specific change through an approved maintenance procedure. Preserve the initial bridge and routing state, select an agreed nonoverlapping range, and follow the documented installation-order requirement. Do not paste the source’s example replacement address into a production design.\nVerification\nAfter an approved change, inspect the effective bridge configuration and test a named destination in the formerly conflicting network from an intended tunnel client. Also verify an unaffected destination to detect unintended routing changes. Keep the client address pool and container bridge results separate so a successful check of one is not recorded as proof of the other.\nOfficial references\nMicrosoft Learn: Prerequisites the Microsoft Tunnel VPN for Microsoft Intune.", "datePublished": "2026-09-10T00:26:14+00:00", "dateModified": "2026-09-10T01:40:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-342-include-the-container-bridge-in-microsoft-tunnel-address-conflict-checks/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Include the container bridge in Microsoft Tunnel address-conflict checks" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 240, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Prerequisites the Microsoft Tunnel VPN for Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-security/microsoft-tunnel/prerequisites" } } ] } }