2

I am trying to better understand the way Docker wires up the network and came across this question. Note: I don't believe this has anything to do with Docker per se, that was only the vehicle under which it came up. Please feel free to correct if this is a misperception on my part!

With Docker up and running in Swarm mode, the following iptables command is executed:

> iptables -t filter -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DOCKER-ISOLATION  all  --  anywhere      anywhere
DOCKER     all  --  anywhere     (1)     anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere     (2)     anywhere
ACCEPT     all  --  anywhere     (3)     anywhere
DOCKER     all  --  anywhere     (4)     anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

I added the 1,2,3,4 numbers in the output. Numbers 1 and 4 seem to be duplicates. Likewise, 2 and 3 seem like exact copies of one another. What is the purpose of these? Are they really duplicates? If not, how do I see the next level of information which would then discern them?

Separately, in the first section, if anyone can explain dpt:domain vs dpt:bootps that would be cool too!

5

The rule "pairs" 1-4 and 2-3 you noted are most likely not duplicates, but you can't see the differences in the output of the command you used. if you use iptables -L -v you will get additional output that may reveal the differences - this usually occurs (in my experience) when the rules are operating on different interfaces.

The dpt:domain and dpt:bootps are different destination port specifications. dpt:domain is destination port 53 (domain, or DNS), while dpt:bootps is destination port 67 (DHCP).

Edit: you are correct, this situation has nothing to do with Docker directly. It's a relatively common situation that was exposed by Docker in your environment, but occurs outside of a Docker environment just as often.

1

To give a supplement answer to your second question: Running iptables -L -n would return IP addresses and ports in numeric format and not translating them into hostnames and service names. As such dpt:domain and dpt:bootps would be printed as dpt:53 and dpt:67. This applies to every host/port you are not aware of the servicename behind.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.