Search code examples
dockerfirewalliptables

Can't delete docker container's default iptables rule

If I type iptables -L there is this line in the output :

Chain DOCKER (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:http-alt

My container is exposed publicly and I can request a dummy http server from everywhere (tested). I try to remove that rule so only 80 is only exposed inside my server (localhost:80). I tried :

root@ns25252:~# iptables -D DOCKER  --destination 172.17.0.2 -p tcp --dport 80 -j ACCEPT
iptables: Bad rule (does a matching rule exist in that chain?).

As the error implies, it can't find the matching rule.. How should I type to remove the line ?

Solution

  • It's usually easier to delete by number, unless there is a chance that the number could change between the time you listed the rules and the time you delete the rule.

    Here's how to delete by line number:

    # iptables -L --line-numbers
(snip)
Chain DOCKER (2 references)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:http
(snip)
# iptables -D DOCKER 1

    Alternatively, you can get the full specification by doing iptables -S. Example:

    # iptables -S
(snip)
-A DOCKER -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j ACCEPT
(snip)

    Turn the -A into a -D and use this as the args to iptables to delete the rule:

    # iptables -D DOCKER -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j ACCEPT

    NOTE: This answer perplexingly still gets upvotes from time to time. I have no idea what everyone is trying to actually accomplish, I just blindly answered an iptables-related question. If you want to start a Docker container that is not accessible to the outside world, that's an entirely different topic, and this is not an appropriate answer in your case. (Maybe start by not exposing/publishing the port.)