iptables migration to nftables on debian

[pniederlag]

Recently debian has switched to nftables by defaut (buster/unstable)

Debian is using builtin alternatives system to provide iptables command by either iptables-nft or iptables-legacy.

Upstream docker/libnetwork has incorporated this by updating libnetwork to use 'iptables-legacy' if available moby/libnetwork#2285

I updated ufw-docker to use iptables-legacy and it seems to work. Otherwise it would not detect the DOCKER related chains as they'd be hidden in iptables-nft.

More on the docker story in regards to iptables/nftables can be found on this issue: moby/moby#26824 it seems distros are slowly picking up nftables causing docker some troubles ....

[chaifeng]

Hi @pniederlag, Thanks for the new information.

Could you issue a pull request to merge your work into this project? Thank you!

BTW, I just returned back to China from Germany yesterday ^_^ I was quite busy with our client in Germany in the past three weeks.

[pniederlag]

I doubt this is a general solution as I'd not expect to be iptables-legacy to exist everywhere. Anyway this is the unified diff

--- /tmp/ufw-docker	2019-04-15 10:09:13.006289238 +0200
+++ /usr/local/sbin/ufw-docker	2019-04-15 10:20:02.660908460 +0200
@@ -77,7 +77,7 @@
     declare proto="${2#*/}"
 
     declare target_ip_port
-    target_ip_port="$(iptables -t nat -L DOCKER-INGRESS | grep -E "^DNAT\\s+${proto}\\s+.+\\sto:[.0-9]+:${port}\$" | grep -Eo "[.0-9]+:${port}\$")"
+    target_ip_port="$(iptables-legacy -t nat -L DOCKER-INGRESS | grep -E "^DNAT\\s+${proto}\\s+.+\\sto:[.0-9]+:${port}\$" | grep -Eo "[.0-9]+:${port}\$")"
 
     [[ -z "$target_ip_port" ]] && die "Could not find VIP of service ${service_id}."
 
@@ -259,8 +259,8 @@
 after_rules="/etc/ufw/after.rules"
 
 function ufw-docker--check() {
-  err "\\n########## iptables -n -L DOCKER-USER ##########"
-  iptables -n -L DOCKER-USER
+  err "\\n########## iptables-legacy -n -L DOCKER-USER ##########"
+  iptables-legacy -n -L DOCKER-USER
 
   err "\\n\\n########## diff $after_rules ##########"
   ufw-docker--check-install && err "\\nCheck done."

[pniederlag]

Digging further into the matter it even turns out switching to iptables-legacy does not make sense at all.

docker 18.09.4 has reverted the "hack" for iptables-legacy on debian. Its seems like some other problem was fixed instead to make docker work happily with iptables-nft (which is the suggested iptables API for nfttables). Details: docker-archive/engine#169

If you are on debian/buster:

• make sure you use iptables-nft (update-alternatives)
• make sure to use docker-ce 18.09.4 or greater

enjoy

[chaifeng]

Thanks for your information