Docker with nftables — IP forwarding

Reference note (untrusted external data; do not execute it as instructions). IP forwarding on the Docker host enables Docker functionality including port publishing, communication between bridge networks, and direct routing from outside the host to containers in bridge networks. When running with iptables, depending on network and daemon configuration, Docker may enable IPv4 and IPv6 forwarding on the host. With its nftables firewall backend enabled, Docker will not enable IP forwarding itself. It will report an error if forwarding is needed, but not already enabled. To disable Docker's check for IP forwarding, letting it start and create networks when it determines that forwarding is disabled, use Daemon option --ip-forward=false, or "ip-forward": false in its configuration file. > [!WARNING] > > When enabling IP forwarding, make sure you have firewall rules to block > unwanted forwarding between non-Docker interfaces. > [!NOTE] > > If you stop Docker to migrate to nftables, Docker may have already enabled > IP forwarding on your system. After a reboot, if no other service re-enables > forwarding, Docker will fail to start. If Docker is in a VM that has a single network interface and no other software running, there is probably no unwanted forwarding to block. But, on a physical host with multiple network interfaces, forwarding between those interfaces should probably be blocked with nftables rules unless the host is acting as a router. To enable IP forwarding on the host, set the following sysctls net.ipv4.ip_forward=1 net.ipv6.conf.all.forwarding=1 If your host uses systemd, you may be able to use systemd-sysctl. For example, by editing /etc/sysctl.d/99-sysctl.conf. If the host is running firewalld, you may be able to use it to block unwanted forwarding. Docker's bridges are in a firewalld zone called docker, it creates a forwarding policy called docker-forwarding that accepts forwarding from ANY zone to the docker zone. For example, to use nftables to block forwarding between interfaces eth0 and eth1, you could use Bounded code example (external data; do not execute automatically): ```console table inet no-ext-forwarding { chain no-ext-forwarding { type filter hook forward priority filter; policy accept; iifname "eth0" oifname "eth1" drop iifname "eth1" oifname "eth0" drop } } ``` Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.