Q&A
CentOS7にDockerをインストールしてコンテナをポートフォワーディングしています。
以下のリンクを参考にカスタムiptablesを作成しましたが、以下のコマンドでDockerを再起動するとfirewalldでエラーが発生します。
https://stackoverflow.com/questions/31667160/running-docker-container-iptables-no-chain-target-match-by-that-name
iptables -F
iptables -X
service iptables restart
systemctl restart firewalld
systemctl daemon-reload
systemctl restart docker
どなたか助けてください。宜しくお願いします。
systemctl
1 2# systemctl status firewalld -l 3● firewalld.service - firewalld - dynamic firewall daemon 4 Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) 5 Active: active (running) since 日 2022-03-06 15:57:26 JST; 1min 8s ago 6 Docs: man:firewalld(1) 7 Main PID: 12213 (firewalld) 8 Tasks: 2 9 Memory: 22.1M 10 CGroup: /system.slice/firewalld.service 11 └─12213 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopid 12 13 3月 06 15:57:42 example.com firewalld[12213]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER' failed: iptables: No chain/target/match by that name. 14 3月 06 15:57:42 example.com firewalld[12213]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATION-STAGE-1' failed: iptables: No chain/target/match by that name. 15 3月 06 15:57:42 example.com firewalld[12213]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATION-STAGE-1' failed: iptables: No chain/target/match by that name. 16 3月 06 15:57:42 example.com firewalld[12213]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATION-STAGE-2' failed: iptables: No chain/target/match by that name. 17 3月 06 15:57:42 example.com firewalld[12213]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATION-STAGE-2' failed: iptables: No chain/target/match by that name. 18 3月 06 15:57:42 example.com firewalld[12213]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name. 19 3月 06 15:57:42 example.com firewalld[12213]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name. 20 3月 06 15:57:42 example.com firewalld[12213]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?). 21 3月 06 15:57:42 example.com firewalld[12213]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-fb5a03b6fb8e -o br-fb5a03b6fb8e -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?). 22 3月 06 15:57:43 example.com firewalld[12213]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).
iptables
1*nat 2:PREROUTING ACCEPT [144:8072] 3:INPUT ACCEPT [87:5208] 4:OUTPUT ACCEPT [118:8055] 5:POSTROUTING ACCEPT [118:8055] 6:DOCKER - [0:0] 7-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER 8-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER 9-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE 10COMMIT 11*filter 12:INPUT ACCEPT [0:0] 13:FORWARD ACCEPT [0:0] 14:OUTPUT ACCEPT [5781:5099614] 15:DOCKER - [0:0] 16-A FORWARD -o docker0 -j DOCKER 17-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 18-A FORWARD -i docker0 ! -o docker0 -j ACCEPT 19-A FORWARD -i docker0 -o docker0 -j ACCEPT 20COMMIT