After turning on the firewall in Linux, the Docker container starts with an error: ERROR: Failed to Setup IP tables: Unable to enable SKIP DNAT rule Solution

Table of contents

1. Error scenarios and phenomena

2. Cause analysis

3. Solution

---

1. Error scenarios and phenomena

After linux turns on or restarts the firewall, when creating a docker custom network

docker network create --driver bridge --subnet 192.168.0.0/16 --gateway 192.168.0.1 frayernet

报错：[root@VM-16-5-centos home]# docker network create --driver bridge --subnet 192.168.0.0/16 --gateway 192.168.0.1 frayernet
Error response from daemon: Failed to Setup IP tables: Unable to enable SKIP DNAT rule:  (iptables failed: iptables --wait -t nat -I DOCKER -i br-3d8c7623fb81 -j RETURN: iptables: No chain/target/match by that name.
 (exit status 1))

as follows:

[root@VM-16-5-centos home]# docker network create --driver bridge --subnet 192.168.0.0/16 --gateway 192.168.0.1 frayernet
Error response from daemon: Failed to Setup IP tables: Unable to enable SKIP DNAT rule:  (iptables failed: iptables --wait -t nat -I DOCKER -i br-3d8c7623fb81 -j RETURN: iptables: No chain/target/match by that name.
 (exit status 1))

2. Cause analysis

Docker is a containerization technology. If the status of the host firewall changes, Docker will not be able to set the IP of the container.

The test attempts to start an existing mysql container,

[root@VM-16-5-centos conf]# docker start c092

The same error occurs:

Error response from daemon: driver failed programming external connectivity on endpoint mysql5.7-cdcs-cd (ac43ff409d232efe3eace11b5f2b9d08b8f98c949e7fb43323bc289240560e38):  (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 3306 -j DNAT --to-destination 172.17.0.3:3306 ! -i docker0: iptables: No chain/target/match by that name.
 (exit status 1))
Error: failed to start containers: c092

3. Solution

Enter the command service docker restart to restart the following Docker

[root@VM-16-5-centos home]# service docker restart