4 ms·

The Docker container is using a separate network namespace with a separate virtual interface that packets are routed to. The "PREROUTING" chain runs before the

by remram 5y ago

The Docker container is using a separate network namespace with a separate virtual interface that packets are routed to. The "PREROUTING" chain runs before the "INPUT" chain so yes, the rules you put in "INPUT" won't apply.

rzzzt 5y ago
Its rules also go into the "nat" table instead of the "filter" table. Use "iptables -L -t nat" to display them.
- remram 5y ago
  Or iptables-save (note the nat and filter sections)