The solution for this problem is a simple bash script (combined to an awk script) to manage our iptables rules.

our container is not able to reach internet.

our container is not reachable from the outside world.

% Total % Received % Xferd Average Speed Time Time Time CurrentĠ 0 0 0 0 0 0 0 -:-:- 0:00:06 -:-:- 0 Systemctl stop ufw|firewalld # <- the service (ufw or firewalld) may change from distro to distro In our dump we can see some other rules added by docker: A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2 A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp -dport 80 -j ACCEPT

A FORWARD -i docker0 -o docker0 -j ACCEPT A FORWARD -i docker0 ! -o docker0 -j ACCEPT A FORWARD -o docker0 -m conntrack -ctstate RELATED,ESTABLISHED -j ACCEPT A OUTPUT ! -d 127.0.0.0/8 -m addrtype -dst-type LOCAL -j DOCKER A PREROUTING -m addrtype -dst-type LOCAL -j DOCKER Now for example we have the need to expose our nginx container to the world:

DOCKER-ISOLATION-STAGE-1 all - anywhere anywhereĪCCEPT all - anywhere anywhere ctstate RELATED,ESTABLISHEDĬhain DOCKER-ISOLATION-STAGE-1 (1 references)ĭOCKER-ISOLATION-STAGE-2 all - anywhere anywhereĬhain DOCKER-ISOLATION-STAGE-2 (1 references)

Iptables windows