{"action":"opened","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/1089","labels_url":"https://api.github.com/repos/openshift/origin/issues/1089/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/1089/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/1089/events","html_url":"https://github.com/openshift/origin/issues/1089","id":58402982,"number":1089,"title":"docker containers lose route to outside after an iptables restart","user":{"login":"sosiouxme","id":29690,"avatar_url":"https://avatars.githubusercontent.com/u/29690?v=3","gravatar_id":"","url":"https://api.github.com/users/sosiouxme","html_url":"https://github.com/sosiouxme","followers_url":"https://api.github.com/users/sosiouxme/followers","following_url":"https://api.github.com/users/sosiouxme/following{/other_user}","gists_url":"https://api.github.com/users/sosiouxme/gists{/gist_id}","starred_url":"https://api.github.com/users/sosiouxme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sosiouxme/subscriptions","organizations_url":"https://api.github.com/users/sosiouxme/orgs","repos_url":"https://api.github.com/users/sosiouxme/repos","events_url":"https://api.github.com/users/sosiouxme/events{/privacy}","received_events_url":"https://api.github.com/users/sosiouxme/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-20T20:01:36Z","updated_at":"2015-02-20T20:01:36Z","closed_at":null,"body":"If I restart iptables, docker0 routes get nuked. Then containers can not reach the outside world until docker is restarted. I'm not sure whether this would exactly be considered a bug or a \"don't do that\"  but we could at least mention it in the [troubleshooting guide](https://github.com/openshift/origin/blob/master/docs/debugging-openshift.md).\r\n\r\n```\r\n# iptables-save > /tmp/iptables.pre-iptables-restart                                                                                                                                         \r\n# systemctl restart iptables\r\n# iptables-save > /tmp/iptables.post-iptables-restart                                                                                                                                       \r\n# diff -u /tmp/iptables.pre-iptables-restart /tmp/iptables.post-iptables-restart\r\n--- /tmp/iptables.pre-iptables-restart  2015-02-20 14:53:44.933378863 -0500\r\n+++ /tmp/iptables.post-iptables-restart 2015-02-20 14:54:04.327378863 -0500\r\n@@ -1,26 +1,8 @@\r\n-*nat\r\n-:PREROUTING ACCEPT [488:34031]\r\n-:INPUT ACCEPT [487:33971]\r\n-:OUTPUT ACCEPT [2527:173067]\r\n-:POSTROUTING ACCEPT [2527:173067]\r\n-:DOCKER - [0:0]\r\n-:KUBE-PORTALS-CONTAINER - [0:0]\r\n-:KUBE-PORTALS-HOST - [0:0]\r\n--A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER\r\n--A PREROUTING -j KUBE-PORTALS-CONTAINER\r\n--A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER\r\n--A OUTPUT -j KUBE-PORTALS-HOST\r\n--A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE\r\n--A DOCKER ! -i docker0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.17.0.3:443\r\n--A DOCKER ! -i docker0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.17.0.3:80\r\n-COMMIT\r\n *filter\r\n :INPUT ACCEPT [0:0]\r\n :FORWARD ACCEPT [0:0]\r\n-:OUTPUT ACCEPT [444036:224165180]\r\n+:OUTPUT ACCEPT [1114:689257]\r\n -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n -A INPUT -p tcp -m state --state NEW -m tcp --dport 10250 -j ACCEPT\r\n -A INPUT -p tcp -m state --state NEW -m tcp --dport 8443:8444 -j ACCEPT\r\n@@ -33,11 +15,6 @@\r\n -A INPUT -i lo -j ACCEPT\r\n -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\r\n -A INPUT -j REJECT --reject-with icmp-host-prohibited\r\n--A FORWARD -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT\r\n--A FORWARD -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 443 -j ACCEPT\r\n--A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\r\n--A FORWARD -i docker0 ! -o docker0 -j ACCEPT\r\n--A FORWARD -i docker0 -o docker0 -j ACCEPT\r\n -A FORWARD -j REJECT --reject-with icmp-host-prohibited\r\n COMMIT\r\n```\r\n\r\nThen inside a container...\r\n```\r\nbash-4.2# curl 173.194.37.49:80\r\ncurl: (7) Failed connect to 173.194.37.49:80; No route to host\r\n```"}}