不重启docker, 修复iptables: No chain/target/match by that name问题

最新推荐文章于 2024-05-20 22:17:10 发布
最新推荐文章于 2024-05-20 22:17:10 发布
阅读量1.4k 收藏 3
点赞数 1
分类专栏： linux 文章标签： docker 运维 iptables chain 重启
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/inaUI/article/details/107954687
版权

文章目录

一. 如下修改iptables配置文件, 并重启iptables服务

注: 修改前建议把旧的/etc/sysconfig/iptables文件做好备份

# 网络地址转换表
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:DOCKER - [0:0]

# ... previous rules start [如果有旧的规则写在这里] ...
# ... previous rules end ...

-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
## 这里的172.17.0.0/16还是172.18.0.0/16根据实际情况变化
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
COMMIT

# 包过滤表
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]

# ... previous rules start [如果有旧的规则写在这里, 示例如下] ...
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 48888 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 30080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 30443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 34443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 40001:40050 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
# ... previous rules end ...

-A FORWARD -o docker0 -j DOCKER
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
COMMIT

二. 前后的状态[记录变化便于理解]

1. 新启动的docker服务会自动在iptables中生成记录

[root@cloud dir]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 9382 1078K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
   26  1988 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
    4   355 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
  113  6780 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
   14   724 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:48888
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:30080
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:30443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:34443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpts:40001:40050
  220 33279 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   84  9560 DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   84  9560 DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   34  3376 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    6   312 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
   44  5872 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 1914 packets, 279K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.4           tcp dpt:3306
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.2           tcp dpt:4443
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.2           tcp dpt:443
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.2           tcp dpt:80
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:80
    1    52 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:40010
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:40009
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:40008
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:40007
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:40006
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:40005
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:40004
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:40003
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:40002
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:40001
    3   156 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.5           tcp dpt:80

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination
   44  5872 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
   84  9560 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
   44  5872 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
   84  9560 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

2. 手动修改/etc/sysconfig/iptables配置文件并重启iptables后

[root@cloud dir]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   52  3643 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:48888
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:30080
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:30443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:34443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpts:40001:40050
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:50006
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 77 packets, 13232 bytes)
 pkts bytes target     prot opt in     out     source               destination

3. 按"一"中修改重启iptables后

[root@cloud dir]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  265 18301 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    3   180 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:48888
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:30080
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:30443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:34443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpts:40001:40050
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:50006
    6  1147 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited
    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 329 packets, 44537 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER (1 references)
 pkts bytes target     prot opt in     out     source               destination
inaUI
关注
  • 1
    点赞
  • 踩
  • 3
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
解决 docker 启动容器报 iptables: No chain/target/match by that name
JineD的博客
02-20 3万+
问题： Error response from daemon: driver failed programming external connectivity on endpoint jenkins (a8ea15bf9b3dbed599d059d638f79f9dd5e875556c39bfb41e6563d3feedb81b): (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 50000 -j.
Docker 启动时报错：iptables:No chain/target/match by the name
天涯的浪子
04-18 1万+
问题：jenkins的docker containner启动失败，报错：failed programming external connectivity … iptables: No chain/target/match by that name” 解决：百度了好多，有说没有iptables的mod的，等等，直觉搞得有点复杂，不是解决问题之法，因为之前是好用的，之前就没有这个模块，所以判定不
Docker【2】iptables 错误解决
最新发布
CharlesYuangc的博客
05-20 956
解决：iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 8080 -j DNAT --to-destination 172.17.0.2:80 ! -i docker0: iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
嵌嵌的爱
05-26 5089
iptables: No chain/target/match by that name.
ubuntu vps安装docker报错：Cannot connect to the Docker daemon at unix:///var/run/docker.sock.问题解决
09-30
在Ubuntu VPS上安装Docker时，可能会遇到一个常见的错误：“Cannot connect to the Docker daemon at unix:///var/run/docker.sock.” 这个问题通常是由于Docker守护进程未运行或者是由于Linux内核版本过低导致的。...
Win10 WSL运行docker报错：Cannot connect to the Docker daemon at unix:///var/run/docker.sock.
01-20
在Windows 10中使用Windows Subsystem for Linux (WSL) 运行Docker时，可能会遇到“Cannot connect to the Docker daemon at unix:///var/run/docker.sock.”的错误。这个错误通常意味着Docker守护进程（Docker ...
Docker中iptables规则在iptables重启后丢失的完整过程
01-09
1、在跳板机上使用ansible命令测试机器B时，报错如下，于是就怀疑是网络防火墙的问题 10.10.0.86 | FAILED >> { failed: true, msg: /bin/sh: /usr/bin/python: No such file or directory\r\nOpenSSH_7.6p1 ...
Error response from daemon: Get https://registry-1.docker.io/v2/: dial tcp: lookup registry-1.docker
01-20
Error response from daemon: Get https://registry-1.docker.io/v2/: dial tcp: lookup registry-1.docker 一通百度，发现原来是dns服务器的错误，把服务器改成8.8.8.8或者114.114.114.114即可 具体做法: vim /etc/...
iptables:No chain/target/match by the name
zmm0420的专栏
09-24 7395
今天docker启动redis时发现docker出错了，iptables报错，没法启动docker。因为之前有关闭了防火墙。 产生原因分析： docker 服务启动的时候，docker服务会向iptables注册一个链，以便让docker服务管理的containner所暴露的端口之间进行通信 通过命令iptables -L可以查看iptables 链。 在开发环境中，如果你删除了iptables中的docker链，或者iptables的规则被丢失了（例如重启firewalld），docker就.
docker0: iptables: No chain/target/match by that name
qq_43193782的博客
04-02 1684
报错为：docker0: iptables: No chain/target/match by that name原因：docker服务iptables问题解决方式：重启docker服务system restart docker。
【Docker】启动container的时候出现iptables: No chain/target/match by that name
热门推荐
2024 做自己的太阳
10-17 8万+
问题： Error response from daemon: driver failed programming external connectivity on endpoint jenkins (a8ea15bf9b3dbed599d059d638f79f9dd5e875556c39bfb41e6563d3feedb81b): (iptables failed: iptables ...
centos6.8 docker0: iptables: No chain/target/match by that name
weixin_30551947的博客
01-08 132
现象：之前docker gitlab运行的一直好好的，突然有一天访问不了，但容器却还运行着。于是我把gitlab容器重启，发现启动不了了，报错：docker0: iptables: No chain/target/match by that name错误原因：修改iptables规则后，重启了iptables，但没有重启docker解决方案：重启docker: service resta...
Centos 7 docker 启动容器 iptables 报 No chain/target/match by that name
l192168134的博客
07-08 1万+
本文作者： 伯乐在线 - 少邪 。未经作者许可，禁止转载！ 欢迎加入伯乐在线 专栏作者。 启动一个有 nat 映射端口的容器时，iptables 报 No chain/target/match by that name Shell 12docker run -d -p
解决iptables参数-m physdev出现iptables: No chain/target/match by that name.错误
opkg list
03-02 8805
事情是这样的，我使用iptables命令出现错误： iptables -A INPUT -m physdev --physdev-in ap1_0 -j DROP iptables: No chain/target/match by that name. 解决办法： 1.iptables的match匹配是需要内核支持的，可以内核目录下make menuconfig查看选项，重点是xtabl...
failed to start daemon: Error initializing network controller: Error creating default "bridge" network: Failed to program NAT chain: Failed to inject DOCKER in PREROUTING chain: iptables failed: iptables --wait -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER: iptables: No chain/target/match by that name.
06-08
这个错误通常与Docker网络设置有关。...你可以尝试重新安装iptables或者检查iptables配置文件以解决这个问题。另外，你也可以尝试在Docker启动时指定--iptables选项，以使用不同的iptables配置文件。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值