`
hanqunfeng
  • 浏览: 1540903 次
  • 性别: Icon_minigender_1
  • 来自: 北京
社区版块
存档分类
最新评论

docker学习笔记之七:解决 -i docker0: iptables: No chain/target/match by that name.

阅读更多

启动容器时,有可能会遇到如下问题,比如启动redis容器:

sudo docker run -d -p 6379:6379 --name redis redis:latest

docker: Error response from daemon: failed to create endpoint redis on network bridge: iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 10.211.55.9 --dport 6379 -j DNAT --to-destination 172.17.0.4:6379 ! -i docker0: iptables: No chain/target/match by that name.
 (exit status 1).

 

通过分析异常信息,发现是因为在进行原地址到目标地址转换的时候没有在docker主机的iptables规则中找到nat表规则,只有filter表规则。

 

在filter表上面增加nat表配置规则信息,需要说明的是docker容器的网段是172.17.0.0/16,另外需要注意filter表中也要有docker链的相关配置。

sudo vi /etc/sysconfig/iptables

  1. # sample configuration for iptables service
    # you can edit this manually or use system-config-firewall
    # please do not ask us to add additional ports/services to this default configuration
    *nat
    :PREROUTING ACCEPT [27:11935]
    :INPUT ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    :POSTROUTING ACCEPT [0:0]
    :DOCKER -[0:0]
    -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
    -A OUTPUT !-d 127.0.0.0/8-m addrtype --dst-type LOCAL -j DOCKER
    -A POSTROUTING -s 172.17.0.0/16!-o docker0 -j MASQUERADE
    COMMIT
    #
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    :DOCKER -[0:0]
    -A FORWARD -o docker0 -j DOCKER
    -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -i docker0 !-o docker0 -j ACCEPT
    -A FORWARD -i docker0 -o docker0 -j ACCEPT
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22-j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 9090-j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 1521-j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 6379-j ACCEPT
    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited
    COMMIT
     

重启iptables

sudo systemctl restart iptables.service 

 

重新启动容器即可。

 

 

0
1
分享到:
评论

相关推荐

Global site tag (gtag.js) - Google Analytics