Bug 1565149
| Summary: | Errors in journal after starting firewalld in RHEL Atomic Host 7.5 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Michael Nguyen <mnguyen> |
| Component: | docker | Assignee: | Antonio Murdaca <amurdaca> |
| Status: | CLOSED WONTFIX | QA Contact: | atomic-bugs <atomic-bugs> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.5 | CC: | amurdaca, lsm5, miabbott, pasik, tsweeney |
| Target Milestone: | rc | Keywords: | Extras |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-06-09 21:39:26 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
We have no plans to ship another version of Docker at this time. RHEL7 is in final support stages where only security fixes will get released. Customers should move to use Podman which is available starting in RHEL 7.6. |
Description of problem: I am seeing errors in the journal after enabling firewalld and restarting (see steps to reproduce). If I just enable and start firewalld, I do not see any errors until I reboot. I am still able to pull images from docker. I was also able to use the network (use curl) from within a container. How reproducible: Always Steps to Reproduce: 1. Boot latest RHEL Atomic Host 7.5 2. systemctl enable firewalld 3. reboot 4. check the journal for docker related errors in firewalld Actual results: Errors related to docker in firewalld journal Expected results: No errors Additional info: ● ostree://rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard Version: 7.5.0 (2018-04-05 10:29:00) Commit: 5df677dcfef08a87dd0ace55790e184a35716cf11260239216bfeba2eb7c60b0 GPGSignature: Valid signature by 567E347AD0044ADE55BA8A5F199E2F91FD431D51 Firewalld is installed. It can be enabled/disabled, started/stopped. If I enable and restart, there are many errors in the journal: $ sudo journalctl -u firewalld --all --no-pager – Logs begin at Thu 2018-04-05 19:45:51 UTC, end at Thu 2018-04-05 20:10:47 UTC. – Apr 05 20:08:48 rhelah systemd[1]: Starting firewalld - dynamic firewall daemon... Apr 05 20:08:48 rhelah systemd[1]: Started firewalld - dynamic firewall daemon. Apr 05 20:09:09 rhelah systemd[1]: Stopping firewalld - dynamic firewall daemon... Apr 05 20:09:10 rhelah systemd[1]: Stopped firewalld - dynamic firewall daemon. – Reboot – Apr 05 20:09:34 rhelah systemd[1]: Starting firewalld - dynamic firewall daemon... Apr 05 20:09:35 rhelah systemd[1]: Started firewalld - dynamic firewall daemon. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory Try `iptables -h' or 'iptables --help' for more information. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory Try `iptables -h' or 'iptables --help' for more information. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -D PREROUTING' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -D OUTPUT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -F DOCKER' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -X DOCKER' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -F DOCKER' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -X DOCKER' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -F DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -X DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -n -L DOCKER' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -n -L DOCKER' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -n -L DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION -j RETURN' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -C POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -C DOCKER -i docker0 -j RETURN' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -i docker0 -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER ! --dst 127.0.0.0/8' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -j DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -C POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE' failed: iptables: No chain/target/match by that name. Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -C DOCKER -i docker0 -j RETURN' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -i docker0 -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Apr 05 20:09:38 rhelah firewalld[734]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name.