Able to connect to some ports open in iptables and not others

Question

This is arch linux, kernel 4.18.0-rc3.

I've run these commands:

iptables -F
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP

iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# Allow local
iptables -A INPUT -i lo -j ACCEPT

# Allow services
iptables -A INPUT -p tcp -m tcp --dport 22 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 53 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 8000 -s 192.168.0.0/24 -j ACCEPT

# Allow established
iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

And running iptables -nvL produces:

Chain INPUT (policy DROP 2120 packets, 121K bytes)
 pkts bytes target     prot opt in     out     source               destination
  116 15649 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x00
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:!0x17/0x02 state NEW
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x3F
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
   36  2432 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:22
    1    44 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:53
    4   160 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    3   132 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:8000

Which I think looks good, I've omitted some extra docker chains that it adds itself. But then if I nmap from another host on the network I get:

Host is up (0.0020s latency).
Not shown: 997 filtered ports
PORT    STATE  SERVICE
22/tcp  open   ssh
53/tcp  open   domain
443/tcp closed https
MAC Address: D4:5D:DF:13:98:A5 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 4.89 seconds

So, the bit that doesn't work

• port 80 isn't there, but ss shows me it's listening and I can curl to it - nginx running in docker
• port 53 is there, and ss shows me it's listening but I can't dig it, it times out - dnsmasq not running in docker

I'm assuming these are related as if I stop the iptables service everything goes through ok, not sure which way to go next though. Any suggestions what I'm missing?

Edit:

$ docker ps
CONTAINER ID        IMAGE                 COMMAND                  CREATED             STATUS              PORTS                 NAMES
7c91645b13e0        jenkins/jenkins:lts   "/sbin/tini -- /usr/…"   11 hours ago        Up 11 hours         8080/tcp, 50000/tcp   jenkins_jenkins_1
be584769dae7        nginx:1               "nginx -g 'daemon of…"   11 hours ago        Up 10 hours         0.0.0.0:80->80/tcp    website_nginx_1
6fdc045ae863        mongo:3               "docker-entrypoint.s…"   36 hours ago        Up 11 hours         27017/tcp             wikijs_mongo_1
abf884b83aeb        requarks/wiki         "supervisord --nodae…"   36 hours ago        Up 11 hours         3000/tcp              wikijs_wiki_1

$ ss -tlan
State    Recv-Q Send-Q          Local Address:Port           Peer Address:Port
LISTEN   0      32                    0.0.0.0:53                  0.0.0.0:*
LISTEN   0      128                   0.0.0.0:22                  0.0.0.0:*
ESTAB    0      0                192.168.0.12:34196         192.168.0.209:8009
TIME-WAIT0      0         192.168.0.12%enp5s0:37082        138.201.81.199:80
ESTAB    0      0                192.168.0.12:58514        151.101.17.140:443
ESTAB    0      0                192.168.0.12:22             192.168.0.99:58500
ESTAB    0      0                192.168.0.12:34380         192.168.0.147:8009
ESTAB    0      0                  172.19.0.1:59316            172.19.0.3:80
ESTAB    0      0                  172.19.0.1:59304            172.19.0.3:80
LISTEN   0      128                         *:80                        *:*
LISTEN   0      128                         *:4243                      *:*
LISTEN   0      32                       [::]:53                     [::]:*
LISTEN   0      128                      [::]:22                     [::]:*
ESTAB    0      0       [::ffff:192.168.0.12]:80    [::ffff:192.168.0.99]:60214
ESTAB    0      0       [::ffff:192.168.0.12]:80    [::ffff:192.168.0.99]:60323

Answer 1

DNS not working was because iptables was allowing TCP not UDP. That's straightforward. HTTP I understand a little less, but by default the docker daemon runs as:

/usr/bin/dockerd -H fd://

I had this overridden to expose the docker daemon on a TCP port

/usr/bin/dockerd -H tcp://0.0.0.0:4243 -H unix:///var/run/docker.sock

What this has to do with the ports that the container services run on, I don't know. But by not exposing the docker daemon (I did need that, no longer do) it's working now.