Red Hat Bugzilla – Bug 1301573
firewalld reporting errors in logs for failed iptables commands
Last modified: 2016-11-03 17:02:10 EDT
We are seeing errors in logs for a series of iptables commands coming from docker (apparently): # systemctl status -l firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2016-01-20 17:24:39 UTC; 4 days ago Main PID: 8835 (firewalld) Memory: 16.6M CGroup: /system.slice/firewalld.service └─8835 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -C POSTROUTING -s 172.17.42.1/16 ! -o docker0 -j MASQUERADE' failed: iptables: No chain/target/match by that name. Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?). Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -i docker0 -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -n -L DOCKER' failed: iptables: No chain/target/match by that name. Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables: No chain/target/match by that name. Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER ! --dst 127.0.0.0/8' failed: iptables: No chain/target/match by that name. Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -n -L DOCKER' failed: iptables: No chain/target/match by that name. Jan 20 17:24:40 perf48.example.com firewalld[8835]: 2016-01-20 12:24:40 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name. Dan Walsh reports that, "I am not sure these are errors. Docker tries to make sure their are no existing rules in firewalld before setting up a container, so it tells firewalld to remove any rules. If there are no rules, firewalld is logging that fact and you see these in the log file." If these are true errors, then I think we should leave them as is, and then develop some way to find a way to remove them. But if they are firewalld doing something on behalf of a request made to it from docker, then perhaps we should consider a way to turn these into warnings.
Here is the upstream fix: https://github.com/t-woerner/firewalld/commit/f47fe3989f6935bd0eddb79bdf8c07225115f5bd
*** Bug 1326618 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2597.html