Centos7 firewall 和 Docker 冲突解决 – 记忆角落

Centos7 firewall 和 Docker 冲突解决

/ 0评 / 1

Centos7 firewall 和 Docker 冲突解决

查看 firewalld 日志

tail -10 /var/log/firewalld

在日志中可以看到一些警告信息,是docker添加的nat规则,但是因为chain不存在,所以添加失败。一般情况下是没有什么问题,但是某些情况,比如容器内需要访问宿住机的服务,则可能出现问题。

image-20220516000201058

[root@iot_dev xinsec-web]# tail -10 /var/log/firewalld
2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).

2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name.

2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).

2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2' failed: iptables: No chain/target/match by that name.

2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).

解决

修改daemon.json

/etc/docker/daemon.json 文件中添加"iptables": false

{
  "registry-mirrors": [
    "https://hub-mirror.c.163.com",
    "https://docker.mirrors.ustc.edu.cn",
    "https://mirror.baidubce.com",
    "https://registry.docker-cn.com",
    "https://8i25ptuf.mirror.aliyuncs.com"
  ],
  "iptables": false
}
重启docker
# 性能调下优
cat>>/etc/sysctl.conf <<-EOF
net.ipv4.ip_forward = 1
EOF
sysctl -p

systemctl daemon-reload
systemctl restart docker

将firewalld换成iptables(推荐)

#查看firewalld是否启用
systemctl status firewalld
#停止firewalld
systemctl stop firewalld
#禁用firewalld(否则重启系统后会再次启动)
systemctl disable firewalld
#查看是否安装iptables
yum list installed | grep iptables-services
#如果没安装则安装下
yum install iptables-services -y
#重启iptables
systemctl restart iptables
#设置开机自启
systemctl enable iptables
#重启docker
systemctl restart docker

关闭防火墙(不推荐)

#查看firewalld是否启用
systemctl status firewalld
#停止firewalld
systemctl stop firewalld
#禁用firewalld(否则重启系统后会再次启动)
systemctl disable firewalld

发表评论

您的电子邮箱地址不会被公开。