Centos7 firewall 和 Docker 冲突解决

查看 firewalld 日志

tail -10 /var/log/firewalld

在日志中可以看到一些警告信息，是docker添加的nat规则，但是因为chain不存在，所以添加失败。一般情况下是没有什么问题，但是某些情况，比如容器内需要访问宿住机的服务，则可能出现问题。

[root@iot_dev xinsec-web]# tail -10 /var/log/firewalld
2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).

2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name.

2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).

2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2' failed: iptables: No chain/target/match by that name.

2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).

解决

修改daemon.json

在 /etc/docker/daemon.json 文件中添加"iptables": false

{
  "registry-mirrors": [
    "https://hub-mirror.c.163.com",
    "https://docker.mirrors.ustc.edu.cn",
    "https://mirror.baidubce.com",
    "https://registry.docker-cn.com",
    "https://8i25ptuf.mirror.aliyuncs.com"
  ],
  "iptables": false
}

重启docker

# 性能调下优
cat>>/etc/sysctl.conf <<-EOF
net.ipv4.ip_forward = 1
EOF
sysctl -p

systemctl daemon-reload
systemctl restart docker

将firewalld换成iptables（推荐）

#查看firewalld是否启用
systemctl status firewalld
#停止firewalld
systemctl stop firewalld
#禁用firewalld（否则重启系统后会再次启动）
systemctl disable firewalld
#查看是否安装iptables
yum list installed | grep iptables-services
#如果没安装则安装下
yum install iptables-services -y
#重启iptables
systemctl restart iptables
#设置开机自启
systemctl enable iptables
#重启docker
systemctl restart docker

关闭防火墙(不推荐)

#查看firewalld是否启用
systemctl status firewalld
#停止firewalld
systemctl stop firewalld
#禁用firewalld（否则重启系统后会再次启动）
systemctl disable firewalld