Re: coexistence between nftables and iptables ?

On Thursday, 6 November 2025 13:13:52 CET George Shuklin wrote:

> There is DOCKER-USER chain for those things.
Not really:
Or at least not really for my need:

# iptables -L -v -n | grep ^Cha | grep DO
Chain DOCKER (3 references)
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
Chain DOCKER-ISOLATION-STAGE-2 (3 references)
Chain DOCKER-USER (1 references)

~# iptables -t nat -L -v -n | grep ^Cha | grep DO
Chain DOCKER (2 references)


I do not need to play with DOCKER-USER chain. Rules created by daemon for me are fine.
I do need to modify all other rules ( INPUT-FORWARD-OUTPUT PRE and POSTROUTING ) for all other needs __except__ dockers, but I do this, usually by flushing all availables chains ( at least to be sure that at boot everything works ) 

In my firewall start script I have:
/usr/sbin/iptables -w  -F
/usr/sbin/iptables -w  -t nat -F
/usr/sbin/iptables -w  -t raw -F
/usr/sbin/iptables -w  -X

Obviously the -F and the -X will "kill" every  rule and chain, thus also DOCKERs one ( and  those that call the jump to DOCKERs )


> 
> Don't try to use 'iptables for docker, nftables for filtering, it will 
> cause a lot of bugs and issues.
That's my suspect :)

 
> See ready-made template which allow to add firewall rules into nftables 
> to filter ports for both local (non-docker) and docker-hosted applications.
> 
> https://github.com/lidofinance/ansible-collection-server/blob/master/roles/docker_iptables/templates/iptables.rules.j2
This link leads to an 404 page :(
 
> (If you use Ansible, you can grab ready-made collection from Galaxy 
> https://galaxy.ansible.com/ui/repo/published/lidofinance/server/docs/)
> 

Thanks 

Pigi