1

I need to configure iptables on a linux machine with running docker containers. If I save iptables rules with iptables-save > /etc/iptables/rules.v4, rules from all chains will be written to file.

But I want to save only INPUT, OUTPUT and DOCKER-USER chains, and don't want chains DOCKER, DOCKER-ISOLATION-STAGE-1, etc to be saved, since they contain rules added by docker automatically, which will be irrelevant after reboot.

As far as I know, iptables-save can save specific tables, but not specific chains.

Currently I consider to combine iptables-save with grep to cut rules from unwanted chains. Is there any better way to achieve same result?

1

You can use the basic iptables command with option -S (--list-rules) to get similar output for a given chain and table, eg:

$ sudo iptables -t filter -S OUTPUT
-P OUTPUT DROP
-A OUTPUT -o lo -j ACCEPT
...

but you will have to repeat this for each table and chain, and perhaps munge the output a little if you want compatibility for iptables-restore, for example adding headers per table like *filter and changing the default policy -P to :, and adding a COMMIT to each table.

0

If I remember correctly, turning off Docker should remove its entries from Iptables. So if you can stop Docker, you could write a script or a short command to do this operation including starting Docker again as fast as possible.

  • It is true. But I'd like to avoid stopping containers even for a short period of time. – Marat Safin Jun 13 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.