tail -10 /var/log/firewalld
在日志中可以看到一些警告信息，是docker添加的nat规则，但是因为chain不存在，所以添加失败。一般情况下是没有什么问题，但是某些情况，比如容器内需要访问宿住机的服务，则可能出现问题。
[root@iot_dev xinsec-web]# tail -10 /var/log/firewalld
2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).
2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name.
2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).
2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2' failed: iptables: No chain/target/match by that name.
2022-05-15 23:56:19 WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).
daemon.json在 /etc/docker/daemon.json 文件中添加"iptables": false
{
"registry-mirrors": [
"https://hub-mirror.c.163.com",
"https://docker.mirrors.ustc.edu.cn",
"https://mirror.baidubce.com",
"https://registry.docker-cn.com",
"https://8i25ptuf.mirror.aliyuncs.com"
],
"iptables": false
}
# 性能调下优
cat>>/etc/sysctl.conf <<-EOF
net.ipv4.ip_forward = 1
EOF
sysctl -p
systemctl daemon-reload
systemctl restart docker
#查看firewalld是否启用
systemctl status firewalld
#停止firewalld
systemctl stop firewalld
#禁用firewalld（否则重启系统后会再次启动）
systemctl disable firewalld
#查看是否安装iptables
yum list installed | grep iptables-services
#如果没安装则安装下
yum install iptables-services -y
#重启iptables
systemctl restart iptables
#设置开机自启
systemctl enable iptables
#重启docker
systemctl restart docker
#查看firewalld是否启用
systemctl status firewalld
#停止firewalld
systemctl stop firewalld
#禁用firewalld（否则重启系统后会再次启动）
systemctl disable firewalld