{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/28133","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/28133/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/28133/comments","events_url":"https://api.github.com/repos/docker/docker/issues/28133/events","html_url":"https://github.com/docker/docker/issues/28133","id":187814042,"number":28133,"title":"iptables MASQUERADE rules not created with iptables set to off ip-masq set to true","user":{"login":"JimmyAstle","id":10352629,"avatar_url":"https://avatars.githubusercontent.com/u/10352629?v=3","gravatar_id":"","url":"https://api.github.com/users/JimmyAstle","html_url":"https://github.com/JimmyAstle","followers_url":"https://api.github.com/users/JimmyAstle/followers","following_url":"https://api.github.com/users/JimmyAstle/following{/other_user}","gists_url":"https://api.github.com/users/JimmyAstle/gists{/gist_id}","starred_url":"https://api.github.com/users/JimmyAstle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JimmyAstle/subscriptions","organizations_url":"https://api.github.com/users/JimmyAstle/orgs","repos_url":"https://api.github.com/users/JimmyAstle/repos","events_url":"https://api.github.com/users/JimmyAstle/events{/privacy}","received_events_url":"https://api.github.com/users/JimmyAstle/received_events","type":"User","site_admin":false},"labels":[{"id":237472034,"url":"https://api.github.com/repos/docker/docker/labels/area/networking","name":"area/networking","color":"fbca04","default":false},{"id":75627479,"url":"https://api.github.com/repos/docker/docker/labels/kind/question","name":"kind/question","color":"EBEFC9","default":false},{"id":375714123,"url":"https://api.github.com/repos/docker/docker/labels/version/1.12","name":"version/1.12","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-07T20:08:44Z","updated_at":"2016-11-07T22:46:11Z","closed_at":null,"body":"---------------------------------------------------\r\nBUG REPORT INFORMATION\r\n---------------------------------------------------\r\n**Description**\r\nWhen a new user defined docker bridge network is created and the docker daemon has `iptables=false` and `ip-masq=true` the nat masquerade rules are not created for the user defined bridge network. This causes machines attached to this network to have no external access outside of the docker host.\r\n\r\n***Use-Case**\r\nWe are running several containers on a single docker host and don't want Docker to automatically create iptables allow rules for all of the exposed ports for security reasons. We then manage our own iptables rules via Puppet.  Not sure if this is a bug but at the very least the documentation [https://docs.docker.com/engine/reference/commandline/dockerd/#/miscellaneous-options](url) is lacking any details when setting the `iptables` and `ip-masq` settings other then there explicit purpose. When setting `iptables` to false and `ip-masq` to true should Docker still create the masquerade rules related to the containers? I even went ahead and set `com.docker.network.bridge.enable_ip_masquerade=true` and the rules are not created. \r\n\r\n**Steps to reproduce the issue:**\r\n1. Setup a Ubuntu 16.04 Server 64 bit with docker 1.12.3. For this example this server has an IP address on eth0 of 192.168.100.40 and the default gateway is 192.168.100.1. The default gateway accepts pings.\r\n2. Set your Docker daemon with the following flags: `--ip-forward=true --iptables=false --ip-masq=true`\r\n3. Create a new Docker bridge network: `docker network create --driver bridge --gateway=192.168.10.1 --subnet=192.168.10.0/24 --opt \"com.docker.network.bridge.name\"=\"example\" example `\r\n4. Attach and run any container image so you can issue ping commands to the network created above: `docker run -itd --network=example busybox`\r\n5. Exec into the container and attempt to ping 192.168.100.1. \r\n\r\n**Describe the results you received:**\r\nA tcpdump on the server shows packets leaving the host to the correct destination and source but the masquerade iptables nat rules are never created for the new bridge network thus ipables doesnt know were to send the original packets. When I delete the network, turn on `iptables=true`, and recreate the network the correct masquerade rules are created along with all of the rules for the exposed ports which we dont want. \r\n\r\n**Describe the results you expected:**\r\nSince `ip-masq=true` I was expecting the nat masquerading rules to still be created and the exposed ports to not be created in the DOCKER chain. I didnt see anything in the documentation that mentioned the nat rules not being created with the `--iptables=false --ip-masq=true` settings in place. It would be good if the official documentation had more details in how docker is interacting with iptables on the host. At the very least if you disable iptables nat masquerade rules will not be created event though the settings are in place at the daemon and network level.\r\n\r\nI have a workaround of adding the nat masquerade rules via puppet but is this the expected behavior? \r\n\r\n\r\n**Output of `docker version`:**\r\n\r\n```\r\nClient:\r\n Version:      1.12.3\r\n API version:  1.24\r\n Go version:   go1.6.3\r\n Git commit:   6b644ec\r\n Built:        Wed Oct 26 22:01:48 2016\r\n OS/Arch:      linux/amd64\r\n\r\nServer:\r\n Version:      1.12.3\r\n API version:  1.24\r\n Go version:   go1.6.3\r\n Git commit:   6b644ec\r\n Built:        Wed Oct 26 22:01:48 2016\r\n OS/Arch:      linux/amd64\r\n```\r\n\r\n**Output of `docker info`:**\r\n\r\n```\r\nContainers: 15\r\n Running: 15\r\n Paused: 0\r\n Stopped: 0\r\nImages: 41\r\nServer Version: 1.12.3\r\nStorage Driver: aufs\r\n Root Dir: /opt/data/aufs\r\n Backing Filesystem: extfs\r\n Dirs: 189\r\n Dirperm1 Supported: true\r\nLogging Driver: json-file\r\nCgroup Driver: cgroupfs\r\nPlugins:\r\n Volume: local\r\n Network: host null bridge overlay\r\nSwarm: inactive\r\nRuntimes: runc\r\nDefault Runtime: runc\r\nSecurity Options: apparmor seccomp\r\nKernel Version: 4.4.0-45-generic\r\nOperating System: Ubuntu 16.04.1 LTS\r\nOSType: linux\r\nArchitecture: x86_64\r\nCPUs: 8\r\nTotal Memory: 7.796 GiB\r\nName: server..com\r\nID: XURH:HQYH:VWQ6:25GJ:DB2C:4RVF:B2KL:LJI3:GJ2W:ZYV7:C4T6:Z5LY\r\nDocker Root Dir: /opt/data\r\nDebug Mode (client): false\r\nDebug Mode (server): false\r\nRegistry: https://index.docker.io/v1/\r\nWARNING: bridge-nf-call-iptables is disabled\r\nWARNING: bridge-nf-call-ip6tables is disabled\r\nInsecure Registries:\r\n 127.0.0.0/8\r\n\r\n```\r\n\r\n**Additional environment details (AWS, VirtualBox, physical, etc.):**\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/258988006","html_url":"https://github.com/docker/docker/issues/28133#issuecomment-258988006","issue_url":"https://api.github.com/repos/docker/docker/issues/28133","id":258988006,"user":{"login":"JimmyAstle","id":10352629,"avatar_url":"https://avatars.githubusercontent.com/u/10352629?v=3","gravatar_id":"","url":"https://api.github.com/users/JimmyAstle","html_url":"https://github.com/JimmyAstle","followers_url":"https://api.github.com/users/JimmyAstle/followers","following_url":"https://api.github.com/users/JimmyAstle/following{/other_user}","gists_url":"https://api.github.com/users/JimmyAstle/gists{/gist_id}","starred_url":"https://api.github.com/users/JimmyAstle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JimmyAstle/subscriptions","organizations_url":"https://api.github.com/users/JimmyAstle/orgs","repos_url":"https://api.github.com/users/JimmyAstle/repos","events_url":"https://api.github.com/users/JimmyAstle/events{/privacy}","received_events_url":"https://api.github.com/users/JimmyAstle/received_events","type":"User","site_admin":false},"created_at":"2016-11-07T22:46:11Z","updated_at":"2016-11-07T22:46:11Z","body":"Thanks for the update Justin. This was the expected behavior as reported. Is it possible to add a few sentences to the documentation to save other folks from having the same issues I ran into? Maybe an additional sentence [https://docs.docker.com/engine/reference/commandline/dockerd/](url) like:   \r\n \"`--iptables=false` prevents the Docker daemon from adding iptables rules. This also means that nat masquerade rules will also not be created when using networks other than the default bridge resulting in not external connectivity outside of the docker host\"    \r\n\r\nOr something along those lines. In my research there are a number of folks who have also had this issue and a quick blurb in the docs would have saved folks a lot of time."}}
{"actor":{"display_login":"JimmyAstle"}}