This is a followup to https://unix.stackexchange.com/a/400203/21615 .

When using iptables-restore --noflush, :<chain> <policy> [<packets_count>:<bytes_count>] seems to flush the chain if <chain> is DOCKER-USER but does not flush if <chain> is INPUT.

Why is that?

Both chains exist when running iptables-restore. INPUT has a default policy, but DOCKER-USER does not. The last rule of DOCKER-USER is to RETURN to the FORWARD chain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.