Linux firewall firewalld does not take effect and cannot intercept Docker mapped ports

There is a strange phenomenon today, the firewall on the centos server does not open port 8103, but it can still be accessed

The ports opened by the server are as follows:

It can be seen that port 8103 is not open

The open services are as follows:

A certain 3D system has not been opened, but it can be accessed normally

Restarted the firewall and restarted the server, but this problem has not been resolved. What a pain in the ass! ! !

When executing systemctl status firewalld, I suddenly found such a warning

WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).

When the firewall starts, it will delete the rules added by docker to iptables. This is why we often restart the firewalld service and then restart the docker container. This problem can be solved by restarting the docker service. Of course, this is related to our topic today. irrelevant.

At this point, I finally found the reason why the port interception failed, as follows:

When docker run -p starts, it will add rules to iptables. The bottom layer of the firewall is based on iptables, so starting with the -p parameter is equivalent to punching a hole in the firewall.

Because I am controlling port access on the host machine of docker, it is simple and rude to let docker not use iptables directly. The operation is as follows:

vi /usr/lib/systemd/system/docker.service

Add --iptables=false to the file

systemctl daemon-reload

systemctl restart docker

Restart Docker and you're done! ! !

Note: Complete the above steps and use the system firewall to control port access, but there will be no access between docker containers, and the external network cannot be accessed within the container .

Use a NAT-like network method to allow docker to access the external network

firewall-cmd --permanent --zone=public --add-masquerade

Talk about using this method to solve the disadvantages caused by docker ignoring the system firewall problem: the real IP of the client cannot be obtained in the container . Because it is similar to a NAT network, the subnet IP of the docker0 network is often recorded in the nginx log. For some businesses Unable to obtain real IP may not be tolerated, it depends on personal choice.