---
title: "Docker Bridge Network Bypasses LAN-Based Whitelists"
aliases: [docker-bridge-network-whitelist, docker-172-subnet, docker-lan-whitelist]
tags: [docker, networking, whitelist, qbittorrent, homelab, subnets]
sources:
  - "daily/2026-05-03.md"
created: 2026-05-03
updated: 2026-05-03
---

# Docker Bridge Network Bypasses LAN-Based Whitelists

## The Problem

Docker containers on the default bridge network are assigned IPs in the `172.16.0.0/12` range (e.g., `172.17.0.2`), **not** your LAN range (e.g., `192.168.1.x`). Services that implement IP-based auth bypass or whitelists using a LAN CIDR will not recognize Docker containers as trusted.

**Common scenario:** qBittorrent WebUI has `AuthSubnetWhitelist` set to `192.168.1.0/24` to allow LAN access without password. A Docker container (e.g., monitoring agent, Glance dashboard, Homarr) trying to access the qBittorrent API from the same host gets an auth failure because its `172.17.0.x` IP is not in the `192.168.1.0/24` whitelist.

## Fix: Add Docker Subnet to Whitelist

Add `172.16.0.0/12` to any service's IP whitelist to cover all Docker bridge addresses:

```ini
# qBittorrent.conf
[Preferences]
WebUI\AuthSubnetWhitelist=192.168.1.0/24, 172.16.0.0/12
WebUI\AuthSubnetWhitelistEnabled=true
```

## Alternative: Use Host Networking

If the container doesn't need network isolation, `network_mode: "host"` avoids Docker NAT entirely — the container uses the host's `192.168.x.x` IP directly:

```yaml
services:
  my-service:
    network_mode: "host"
```

## Docker Bridge IP Ranges

| Range | Notes |
|-------|-------|
| `172.17.0.0/16` | Default `bridge` network |
| `172.18.0.0/16` | First custom network |
| `172.16.0.0/12` | All possible Docker bridge addresses (safe to whitelist) |

## Related Concepts

- [[wiki/concepts/qbittorrent-slow-speed-checklist]] — qBittorrent full checklist including WebUI auth config
- [[wiki/concepts/docker-lxc-dns-configuration]] — Docker containers also need explicit DNS config in LXC

## Sources

- [[daily/2026-05-03.md]] — Docker container could not access qBittorrent WebUI; fix was adding `172.16.0.0/12` to `AuthSubnetWhitelist` alongside the existing `192.168.1.0/24` entry
