vendor libnetwork @1861587 #28257

sanimej · 2016-11-10T20:30:47Z

With this change if ip_forward is enabled by docker daemon then the iptables FORWARD policy will be set to DROP. On a docker upgrade if ip_forward is already enabled this change will not take effect, because in that case the user might have intended to have the default policy ACCEPT. Changing it to DROP will break such setups. Current users of docker can avoid this issue by either

setting the FORWARD policy to DROP manually
reload the host before upgrading to 1.13. If docker daemon enabled ip_forward its not persistent. So after a reload the fix will take effect and the policy will be set to DROP.

Signed-off-by: Santhosh Manohar santhosh@docker.com

Signed-off-by: Santhosh Manohar <santhosh@docker.com>

mavenugo

LGTM

vieux · 2016-11-10T21:31:57Z

LGTM

AlmirKadric · 2017-01-21T07:48:04Z

this seems to have broken the following fix #490
I haven't been able to work around this with the daemon config file either
IP forwarding is broken on docker for windows

EDIT: I worked around the issue with iptables: false inside my docker daemon config. However this is extremely undesirable and probably unacceptable to most people. If anyone has a better fix please let me know. Otherwise we will need a nice way to configure iptables entries from docker compose (per network) or daemon config (we need a command line to interact with this).

1ma · 2017-01-26T12:36:17Z

It appears this change of policy broke my use case (PHP debugging with XDebug, which involves opening TCP connections from the container back to the host).

How can I restore the old policy (short of pinning the 1.12.6 version on my development machine)?

1ma · 2017-01-26T15:51:49Z

Solved. Note that if you accidentally upgraded to 1.13 its not enough to downgrade back to 1.12, the iptables default policy has to be manually reverted.

pprishchepa · 2017-01-26T15:56:07Z

@1ma what if I remove docker 1.13 and install 1.12, should I fix iptables policy manually?

1ma · 2017-01-26T17:02:51Z

Yes, that's what I had to do.

* Swarm-mode is the fastest cluster to deploy since it doesn't require to pull anything from outside. * Add the output nodes for swarm-mode too. * Disable copy logs (I think a better practice is to copy logs on demand). * Don't run test_create_list_sign_delete_clusters, because it is very unstable on the CI. Partially-Implements: blueprint swarm-mode-support 2nd commit message: Update to Fedora Atomic 26 This patch moves the current master to test against Fedora Atomic 26, in addition, it switches to downloading from Fedora mirrors. 2nd-Change-Id: I9a97c0eb78b2c9d10e8be1501babb19e73ee70c1 3rd commit message: Set default iptables FORWARD policy to ACCEPT With the release of Docker 1.13 which is available in Fedora Atomic 26, it no longer sets the policy of the FORWARD chain to ACCEPT[1]. Therefore, CNI networking such as Flannel will cease to work. This patch sets the policy to ACCEPT so that traffic can work once again for deployments which are based on Docker versions which are newer than 1.13 [1]: moby/moby#28257 3rd-Change-Id: I1457602748619f38f87542fc01a2996ee80e58b7 Closes-Bug: #1708454 Co-Authored-By: Mohammed Naser <mnaser@vexxhost.com> Change-Id: I86d4dcc94fff622be4ee2acc8dd60ed81bc5d433

Docker 1.13 has changed a default policy of FORWARD chain to DROP (moby/moby#28257) which makes containers inaccessible from a remote host when the bridge is exposed. The change breaks e.g. the AWSVPC mode. To overcome this we install an explicit rule for accepting forwarded ingress traffic to an exposed subnet which is appended to the WEAVE-EXPOSE chain. The chain is a target of the rule "-t filter -A FORWARD -o weave".

…ecent Docker versions. Some details: moby/moby#28257

* replace service to systemctl call for sync time * Add forward policy accept after docker install due to moby/moby#28257 break gtw node Change-Id: I790bc9c1b2f203119d4142ec25956634bf6bb94f

See moby/moby#28257

…ting. Relevant issues: * moby/moby#28257 * boot2docker/boot2docker#1364

…routing. Relevant issues: * moby/moby#28257 * boot2docker/boot2docker#1364

bharathvishwanathan · 2019-09-02T08:30:28Z

Is Ip-forwarding required to run docker. If i disable ipforwarding will it impact any functionality of docker application.

thaJeztah · 2019-09-04T09:33:33Z

@bharathvishwanathan please don't use old PR's (this pull request was merged three years ago) to start new discussions.

Please keep in mind that the GitHub issue tracker is not intended as a general support forum,
but for reporting bugs and feature requests. For other type of questions, consider using one of;

the Docker community Slack channel
the Docker Support Forums - https://forums.docker.com
StackOverflow

vendor libnetwork @1861587

90bc275

Signed-off-by: Santhosh Manohar <santhosh@docker.com>

GordonTheTurtle added the status/0-triage label Nov 10, 2016

vdemeester added status/2-code-review and removed status/0-triage labels Nov 10, 2016

thaJeztah added this to the 1.13.0 milestone Nov 10, 2016

mavenugo approved these changes Nov 10, 2016

View reviewed changes

vieux added status/4-merge and removed status/2-code-review labels Nov 10, 2016

vieux merged commit f700a86 into moby:master Nov 10, 2016

thaJeztah added the impact/changelog label Nov 10, 2016

mavenugo mentioned this pull request Dec 1, 2016

Add sysctl changes as suggested by lynis linuxkit/linuxkit#819

Merged

sanimej deleted the iptables branch January 4, 2017 19:24

bebehei mentioned this pull request Jan 20, 2017

docker 1.13 container is not reachable after giving IP-address jpetazzo/pipework#211

Closed

AlmirKadric mentioned this pull request Jan 21, 2017

ip-forwarding broken in 1.13.0 due to #28257 fix #30338

Closed

thriqon mentioned this pull request Jan 24, 2017

Published k8s service is not available kubernetes/kubernetes#40349

Closed

This was referenced Jan 31, 2017

Upgrading docker 1.13 on nodes causes outbound container traffic to stop working kubernetes/kubernetes#40182

Closed

Docker 1.13 defaults IP forwarding to DROP weaveworks/weave#2758

Closed

jbeda mentioned this pull request Feb 2, 2017

Handle nodes with iptables FORWARD DROP better kubernetes/kubernetes#39823

Closed

bboreham mentioned this pull request Feb 8, 2017

Don't use ip_forward to expose containers to the public internet #11508

Closed

This was referenced Feb 16, 2017

Container can not be accessed by another Docker host flannel-io/flannel#609

Closed

flannel 0.7.0 + docker 1.13.0 issue flannel-io/flannel#603

Closed

holser mentioned this pull request Feb 21, 2017

iptables switch for docker kubernetes-sigs/kubespray#1059

Merged

wenjianhn mentioned this pull request Mar 8, 2017

docker-engine 1.12.6, 1.13.0, 1.13.1 blocks DHCP #31245

Closed

crawford mentioned this pull request Mar 9, 2017

Docker v1.13 possibly causes outbound kubernetes container traffic to stop working coreos/bugs#1842

Closed

KDF5000 mentioned this pull request May 21, 2017

Flannel.1 cannot forward the packets to docker0 flannel-io/flannel#731

Closed

blalor mentioned this pull request May 19, 2017

Docker interferes with rkt's IP masquerading rkt/rkt#3683

Open

thaJeztah mentioned this pull request Jul 19, 2017

Can't access container IPs from oustide the host machine #34164

Closed

murali-reddy mentioned this pull request Aug 11, 2017

add filter table FORWARD chain rule to forward traffic from "kube-bridge" cloudnativelabs/kube-router#120

Closed

tmjd mentioned this pull request Aug 22, 2017

Traffic from GCE LoadBalancer blocked by iptables filter projectcalico/canal#98

Closed

gwind mentioned this pull request Sep 11, 2017

The Pod-To-Pod network does not work when deploy flanneld with DaemonSet in kubernetes 1.7.5 kubernetes/kubernetes#51881

Closed

ToroNZ pushed a commit to ToroNZ/k8s-snowflake that referenced this pull request Dec 28, 2017

BYO - Added iptables FORWARD ACCEPT rule due to moby/moby#28257

d1db8cf

ToroNZ pushed a commit to ToroNZ/k8s-snowflake that referenced this pull request Dec 28, 2017

Added iptables FORWARD ACCEPT due to moby/moby#28257

3383a0d

caseycs mentioned this pull request Feb 16, 2018

Add a note about adjusting iptables xiaopeng163/docker-k8s-lab#12

Merged

caseycs added a commit to caseycs/docker-k8s-lab that referenced this pull request Feb 16, 2018

Add a note about adjusting iptables, so tutorial will also work for r…

3f8eddb

…ecent Docker versions. Some details: moby/moby#28257

iamrgon added a commit to iamrgon/ansible-kubernetes-openshift-pi3 that referenced this pull request Jul 22, 2018

docker: disable --iptables usage

d2db235

See moby/moby#28257

tianon mentioned this pull request Nov 28, 2018

Hit ip forwarding problem from macOS to container in v18.09.0 while v18.06.1-ce works well boot2docker/boot2docker#1364

Closed

chinthakagodawita added a commit to chinthakagodawita/dinghy that referenced this pull request Jan 8, 2019

Fixed issue with moby block IP forwarding and hence our container rou…

14eb0f3

…ting. Relevant issues: * moby/moby#28257 * boot2docker/boot2docker#1364

chinthakagodawita added a commit to chinthakagodawita/dinghy that referenced this pull request Jan 8, 2019

Fixed issue with moby blocking IP forwarding and hence our container …

8e3d9b6

…routing. Relevant issues: * moby/moby#28257 * boot2docker/boot2docker#1364

futuretea mentioned this pull request May 10, 2021

[BUG] If default FORWARD policy is DROP, vm use vlan 1 network (vid=1) can't access other host harvester/harvester#841

Open

Mainfrezzer mentioned this pull request Sep 17, 2024

Docker IPv6 (ip6tables) support breaks unrelated bridges #48365

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

vendor libnetwork @1861587 #28257

vendor libnetwork @1861587 #28257

sanimej commented Nov 10, 2016

mavenugo left a comment

vieux commented Nov 10, 2016

AlmirKadric commented Jan 21, 2017 •

edited

Loading

1ma commented Jan 26, 2017

1ma commented Jan 26, 2017

pprishchepa commented Jan 26, 2017

1ma commented Jan 26, 2017

bharathvishwanathan commented Sep 2, 2019

thaJeztah commented Sep 4, 2019

vendor libnetwork @1861587 #28257

vendor libnetwork @1861587 #28257

Conversation

sanimej commented Nov 10, 2016

mavenugo left a comment

Choose a reason for hiding this comment

vieux commented Nov 10, 2016

AlmirKadric commented Jan 21, 2017 • edited Loading

1ma commented Jan 26, 2017

1ma commented Jan 26, 2017

pprishchepa commented Jan 26, 2017

1ma commented Jan 26, 2017

bharathvishwanathan commented Sep 2, 2019

thaJeztah commented Sep 4, 2019

AlmirKadric commented Jan 21, 2017 •

edited

Loading