Bug 1301573
| Summary: | firewalld reporting errors in logs for failed iptables commands | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Peter Portante <pportant> |
| Component: | firewalld | Assignee: | Thomas Woerner <twoerner> |
| Status: | CLOSED ERRATA | QA Contact: | Tomas Dolezal <todoleza> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 7.2 | CC: | ajia, ajohn, todoleza, twoerner |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | firewalld-0.4.2-1.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-11-03 21:02:10 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Here is the upstream fix: https://github.com/t-woerner/firewalld/commit/f47fe3989f6935bd0eddb79bdf8c07225115f5bd *** Bug 1326618 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2597.html |
We are seeing errors in logs for a series of iptables commands coming from docker (apparently): # systemctl status -l firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2016-01-20 17:24:39 UTC; 4 days ago Main PID: 8835 (firewalld) Memory: 16.6M CGroup: /system.slice/firewalld.service └─8835 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -C POSTROUTING -s 172.17.42.1/16 ! -o docker0 -j MASQUERADE' failed: iptables: No chain/target/match by that name. Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?). Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -i docker0 -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -n -L DOCKER' failed: iptables: No chain/target/match by that name. Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables: No chain/target/match by that name. Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER ! --dst 127.0.0.0/8' failed: iptables: No chain/target/match by that name. Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -n -L DOCKER' failed: iptables: No chain/target/match by that name. Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name. Dan Walsh reports that, "I am not sure these are errors. Docker tries to make sure their are no existing rules in firewalld before setting up a container, so it tells firewalld to remove any rules. If there are no rules, firewalld is logging that fact and you see these in the log file." If these are true errors, then I think we should leave them as is, and then develop some way to find a way to remove them. But if they are firewalld doing something on behalf of a request made to it from docker, then perhaps we should consider a way to turn these into warnings.