CODEWITHSUNDEEP
dockernginxcentos7cloudflarefirewalld
DrMeers
DrMeers

Reputation: 4207

How to correct configuration for firewalld and docker/nginx?

I have a CentOS 7 server which was running happily for 600+ days until it was rebooted recently, after which incoming web requests were receiving HTTP523 (Origin Is Unreachable) error codes (via Cloudflare, if that makes a difference?) unless I stopped the firewalld service. Things run fine without firewalld, but I'd rather not leave it disabled!

I've tried stopping docker and firewalld and restarting them in various sequences, but the same 523 error occurs unless I stop firewalld.

/var/log/firewalld contains a few warnings that might help:

I've found seemingly conflicting advice around the place regarding any manual configuration/commands required:

  1. firewall-cmd --permanent --zone=trusted --add-interface=docker0 on a CentOS forum
  2. firewall-cmd --zone=trusted --remove-interface=docker0 --permanent on the offical Docker docs -- surely that's the opposite of the above?
  3. a bunch of manual firewall-cmd commands on a Docker github issue -- surely all of that isn't required?
  4. this one looks promising -- nmcli, NetworkManager and firewall-cmd --permanent --zone=trusted --change-interface=docker0

I don't fully understand where the br-8acb606a3b50 interface comes from, or whether I need to do anything to configure it as well as docker0 if I use a solution like 4. above? It was all working fine automatically for years until the reboot!

Are some magic firewalld incantations now required (and why?!) or is there some way I can get the system to get back into the correct auto/default configuration it was in prior to rebooting?

$ docker -v
Docker version 20.10.5, build 55c4c88
$ firewall-cmd --version
0.6.3
$ firewall-cmd --get-zones
block dmz docker drop external home internal public trusted work

Upvotes: 8

Views: 14110

Answers (2)

anemyte
anemyte

Reputation: 20296

To recap the chat investigation, this particular problem wasn't related to Docker and containers. The problem was in firewalld not having rules for NGINX running as a proxy for containers on the host. The solution was to add permanent firewalld rules for HTTP and HTTPS traffic:

sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload

Warning messages like this one:

WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-8acb606a3b50 -o br-8acb606a3b50 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?)

... can appear during normal operation, when Docker attempts to delete a rule without checking its existence first. In other words, containers can be running smoothly even when there are warnings like this.

Upvotes: 9

entomologyx
entomologyx

Reputation: 21

I had some similar problems with Podman and for me i had to upgrade from Debian 9 to Debian 10 in order to fix it, because of the way firewalld handles iptables vs nftables.

Upvotes: 2

Related Questions