I am trying to better understand the way Docker wires up the network and came across this question. Note: I don't believe this has anything to do with Docker per se, that was only the vehicle under which it came up. Please feel free to correct if this is a misperception on my part!
With Docker up and running in Swarm mode, the following iptables command is executed:
> iptables -t filter -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:bootps
ACCEPT udp -- anywhere anywhere udp dpt:bootps
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DOCKER-ISOLATION all -- anywhere anywhere
DOCKER all -- anywhere (1) anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere (2) anywhere
ACCEPT all -- anywhere (3) anywhere
DOCKER all -- anywhere (4) anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
I added the 1,2,3,4 numbers in the output. Numbers 1 and 4 seem to be duplicates. Likewise, 2 and 3 seem like exact copies of one another. What is the purpose of these? Are they really duplicates? If not, how do I see the next level of information which would then discern them?
Separately, in the first section, if anyone can explain dpt:domain
vs dpt:bootps
that would be cool too!