linux - 双网卡下docker中的容器为何不能访问互联网？
双网卡下docker中的容器为何不能访问互联网？小胡子的小熊猫21发布于
2022-11-25 上海新手上路，请多包涵我有一台机器，双网卡，大致拓扑如下
10 网段用来通公网，而192网段的作用是：总公司做了国外的隧道，个别域名需要从总公司线路走。
我有一台机器，双网卡，大致拓扑如下
10 网段用来通公网，而192网段的作用是：总公司做了国外的隧道，个别域名需要从总公司线路走。
10 网段用来通公网，而192网段的作用是：总公司做了国外的隧道，个别域名需要从总公司线路走。
我在这台主机上安装了docker，发现容器与外网是不通的
下为 CentOS iptables docker 版本，网卡，路由及 iptables 规则信息
[root@localhost ~]# cat /etc/redhat-release
CentOS Linux release 7.9.2009 ????Core????
[root@localhost ~]# docker -v
Docker version 20.10.21, build baeda1f
[root@localhost ~]# docker version
Client:
Version: 20.10.21
API version: 1.41
Go version: go1.18.7
Git commit: baeda1f
Built: Tue Oct 25 17:56:30 2022
OS/Arch: linux/amd64
Context: default
Experimental: true
Server: Docker Engine - Community
Engine:
Version: 20.10.21
API version: 1.41 ????minimum version 1.12????
Go version: go1.18.7
Git commit: 3056208
Built: Tue Oct 25 18:02:03 2022
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v1.6.9
GitCommit: 1c90a442489720eec95342e1789ee8a5e1b9536f
runc:
Version: 1.1.4
GitCommit: v1.1.4-0-g5fd4c4d1
docker-init:
Version: 0.19.0
GitCommit: de40ad0
[root@localhost ~]#
[root@localhost ~]# cat /etc/redhat-release
CentOS Linux release 7.9.2009 ????Core????
[root@localhost ~]# docker version
Client:
Version: 20.10.21
API version: 1.41
Go version: go1.18.7
Git commit: baeda1f
Built: Tue Oct 25 17:56:30 2022
OS/Arch: linux/amd64
Context: default
Experimental: true
Server: Docker Engine - Community
Engine:
Version: 20.10.21
API version: 1.41 ????minimum version 1.12????
Go version: go1.18.7
Git commit: 3056208
Built: Tue Oct 25 18:02:03 2022
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v1.6.9
GitCommit: 1c90a442489720eec95342e1789ee8a5e1b9536f
runc:
Version: 1.1.4
GitCommit: v1.1.4-0-g5fd4c4d1
docker-init:
Version: 0.19.0
GitCommit: de40ad0
[root@localhost ~]# iptables -v
iptables v1.4.21: no command specified
Try `iptables -h' or 'iptables --help' for more information.
[root@localhost ~]# iptables --version
iptables v1.4.21
[root@localhost ~]#
[root@localhost ~]# cat /etc/redhat-release
CentOS Linux release 7.9.2009 ????Core????
[root@localhost ~]#
[root@localhost ~]# iptables --version
iptables v1.4.21
[root@localhost ~]# docker version
Client:
Version: 20.10.21
API version: 1.41
Go version: go1.18.7
Git commit: baeda1f
Built: Tue Oct 25 17:56:30 2022
OS/Arch: linux/amd64
Context: default
Experimental: true
Server: Docker Engine - Community
Engine:
Version: 20.10.21
API version: 1.41 ????minimum version 1.12????
Go version: go1.18.7
Git commit: 3056208
Built: Tue Oct 25 18:02:03 2022
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v1.6.9
GitCommit: 1c90a442489720eec95342e1789ee8a5e1b9536f
runc:
Version: 1.1.4
GitCommit: v1.1.4-0-g5fd4c4d1
docker-init:
Version: 0.19.0
GitCommit: de40ad0
[root@localhost ~]#
[root@localhost ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=yes
#IPV4_ROUTE_METRIC=102
IPV4_FAILURE_FATAL=yes
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=eth0
DEVICE=eth0
ONBOOT=yes
IPADDR=10.0.1.47
PREFIX=24
GATEWAY=10.0.1.1
DNS1=10.0.1.1
IPV6_PRIVACY=no
UUID=5fb06bd0-0bb0-7ffb-45f1-d6edd65f3e03
[root@localhost ~]#
[root@localhost ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth1
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=no
IPV4_ROUTE_METRIC=99
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=no
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=eth1
DEVICE=eth1
ONBOOT=yes
IPADDR=192.168.129.23
PREFIX=24
GATEWAY=192.168.129.1
DNS1=192.168.129.88
IPV6_PRIVACY=no
UUID=9c92fad9-6ecb-3e6c-eb4d-8a47c6f50c04
[root@localhost ~]#
[root@localhost ~]# ip route
default via 10.0.1.1 dev eth0 proto static metric 100
10.0.1.0/24 dev eth0 proto kernel scope link src 10.0.1.47 metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
192.168.25.0/24 via 192.168.129.1 dev eth1 proto static metric 99
192.168.129.0/24 dev eth1 proto kernel scope link src 192.168.129.23 metric 99
192.168.250.0/24 dev br-ac0d6f496e7c proto kernel scope link src 192.168.250.1
[root@localhost ~]# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o br-ac0d6f496e7c -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-ac0d6f496e7c -j DOCKER
-A FORWARD -i br-ac0d6f496e7c ! -o br-ac0d6f496e7c -j ACCEPT
-A FORWARD -i br-ac0d6f496e7c -o br-ac0d6f496e7c -j ACCEPT
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30092 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30100 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30099 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30098 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30097 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30096 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30095 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30094 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30093 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30091 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30090 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30089 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30088 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30087 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30086 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30085 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30084 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30083 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30082 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30081 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30080 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30079 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30078 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30077 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30076 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30075 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30074 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30073 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30072 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30071 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30070 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30069 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30068 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30067 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30066 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30065 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30064 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30063 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30062 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30061 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30060 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30059 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30058 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30057 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30056 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30055 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30054 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30053 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30052 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30051 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30050 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30049 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30048 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30047 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30046 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30045 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30044 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30043 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30042 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30041 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30040 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30039 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30038 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30037 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30036 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30034 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30033 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30017 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30007 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30027 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30020 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30008 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30030 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30035 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30032 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30031 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30029 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30028 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30026 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30025 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30024 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30023 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30022 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30021 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30019 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30018 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30016 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30015 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30014 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30013 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30012 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30011 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30010 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30009 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30006 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30005 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30004 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30003 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30002 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30001 -j ACCEPT
-A DOCKER -d 192.168.250.9/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 30000 -j ACCEPT
-A DOCKER -d 192.168.250.6/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 192.168.250.8/32 ! -i br-ac0d6f496e7c -o br-ac0d6f496e7c -p tcp -m tcp --dport 2222 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i br-ac0d6f496e7c ! -o br-ac0d6f496e7c -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o br-ac0d6f496e7c -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
[root@localhost ~]#
[root@localhost ~]# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N DOCKER
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 192.168.250.0/24 ! -o br-ac0d6f496e7c -j MASQUERADE
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 192.168.250.8/32 -d 192.168.250.8/32 -p tcp -m tcp --dport 2222 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30092 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30100 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30099 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30098 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30097 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30096 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30095 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30094 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30093 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30091 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30090 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30089 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30088 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30087 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30086 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30085 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30084 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30083 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30082 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30081 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30080 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30079 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30078 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30077 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30076 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30075 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30074 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30073 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30072 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30071 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30070 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30069 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30068 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30067 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30066 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30065 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30064 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30063 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30062 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30061 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30060 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30059 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30058 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30057 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30056 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30055 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30054 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30053 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30052 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30051 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30050 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30049 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30048 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30047 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30046 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30045 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30044 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30043 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30042 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30041 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30040 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30039 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30038 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30037 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30036 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30034 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30033 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30017 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30007 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30027 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30020 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30008 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30030 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30035 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30032 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30031 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30029 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30028 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30026 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30025 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30024 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30023 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30022 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30021 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30019 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30018 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30016 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30015 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30014 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30013 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30012 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30011 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30010 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30009 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30006 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30005 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30004 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30003 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30002 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30001 -j MASQUERADE
-A POSTROUTING -s 192.168.250.9/32 -d 192.168.250.9/32 -p tcp -m tcp --dport 30000 -j MASQUERADE
-A POSTROUTING -s 192.168.250.6/32 -d 192.168.250.6/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A DOCKER -i br-ac0d6f496e7c -j RETURN
-A DOCKER -i docker0 -j RETURN
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30092 -j DNAT --to-destination 192.168.250.9:30092
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30100 -j DNAT --to-destination 192.168.250.9:30100
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30099 -j DNAT --to-destination 192.168.250.9:30099
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30098 -j DNAT --to-destination 192.168.250.9:30098
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30097 -j DNAT --to-destination 192.168.250.9:30097
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30096 -j DNAT --to-destination 192.168.250.9:30096
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30095 -j DNAT --to-destination 192.168.250.9:30095
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30094 -j DNAT --to-destination 192.168.250.9:30094
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30093 -j DNAT --to-destination 192.168.250.9:30093
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30091 -j DNAT --to-destination 192.168.250.9:30091
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30090 -j DNAT --to-destination 192.168.250.9:30090
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30089 -j DNAT --to-destination 192.168.250.9:30089
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30088 -j DNAT --to-destination 192.168.250.9:30088
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30087 -j DNAT --to-destination 192.168.250.9:30087
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30086 -j DNAT --to-destination 192.168.250.9:30086
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30085 -j DNAT --to-destination 192.168.250.9:30085
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30084 -j DNAT --to-destination 192.168.250.9:30084
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30083 -j DNAT --to-destination 192.168.250.9:30083
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30082 -j DNAT --to-destination 192.168.250.9:30082
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30081 -j DNAT --to-destination 192.168.250.9:30081
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30080 -j DNAT --to-destination 192.168.250.9:30080
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30079 -j DNAT --to-destination 192.168.250.9:30079
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30078 -j DNAT --to-destination 192.168.250.9:30078
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30077 -j DNAT --to-destination 192.168.250.9:30077
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30076 -j DNAT --to-destination 192.168.250.9:30076
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30075 -j DNAT --to-destination 192.168.250.9:30075
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30074 -j DNAT --to-destination 192.168.250.9:30074
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30073 -j DNAT --to-destination 192.168.250.9:30073
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30072 -j DNAT --to-destination 192.168.250.9:30072
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30071 -j DNAT --to-destination 192.168.250.9:30071
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30070 -j DNAT --to-destination 192.168.250.9:30070
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30069 -j DNAT --to-destination 192.168.250.9:30069
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30068 -j DNAT --to-destination 192.168.250.9:30068
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30067 -j DNAT --to-destination 192.168.250.9:30067
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30066 -j DNAT --to-destination 192.168.250.9:30066
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30065 -j DNAT --to-destination 192.168.250.9:30065
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30064 -j DNAT --to-destination 192.168.250.9:30064
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30063 -j DNAT --to-destination 192.168.250.9:30063
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30062 -j DNAT --to-destination 192.168.250.9:30062
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30061 -j DNAT --to-destination 192.168.250.9:30061
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30060 -j DNAT --to-destination 192.168.250.9:30060
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30059 -j DNAT --to-destination 192.168.250.9:30059
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30058 -j DNAT --to-destination 192.168.250.9:30058
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30057 -j DNAT --to-destination 192.168.250.9:30057
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30056 -j DNAT --to-destination 192.168.250.9:30056
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30055 -j DNAT --to-destination 192.168.250.9:30055
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30054 -j DNAT --to-destination 192.168.250.9:30054
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30053 -j DNAT --to-destination 192.168.250.9:30053
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30052 -j DNAT --to-destination 192.168.250.9:30052
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30051 -j DNAT --to-destination 192.168.250.9:30051
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30050 -j DNAT --to-destination 192.168.250.9:30050
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30049 -j DNAT --to-destination 192.168.250.9:30049
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30048 -j DNAT --to-destination 192.168.250.9:30048
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30047 -j DNAT --to-destination 192.168.250.9:30047
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30046 -j DNAT --to-destination 192.168.250.9:30046
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30045 -j DNAT --to-destination 192.168.250.9:30045
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30044 -j DNAT --to-destination 192.168.250.9:30044
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30043 -j DNAT --to-destination 192.168.250.9:30043
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30042 -j DNAT --to-destination 192.168.250.9:30042
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30041 -j DNAT --to-destination 192.168.250.9:30041
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30040 -j DNAT --to-destination 192.168.250.9:30040
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30039 -j DNAT --to-destination 192.168.250.9:30039
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30038 -j DNAT --to-destination 192.168.250.9:30038
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30037 -j DNAT --to-destination 192.168.250.9:30037
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30036 -j DNAT --to-destination 192.168.250.9:30036
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30034 -j DNAT --to-destination 192.168.250.9:30034
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30033 -j DNAT --to-destination 192.168.250.9:30033
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30017 -j DNAT --to-destination 192.168.250.9:30017
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30007 -j DNAT --to-destination 192.168.250.9:30007
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30027 -j DNAT --to-destination 192.168.250.9:30027
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30020 -j DNAT --to-destination 192.168.250.9:30020
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30008 -j DNAT --to-destination 192.168.250.9:30008
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30030 -j DNAT --to-destination 192.168.250.9:30030
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30035 -j DNAT --to-destination 192.168.250.9:30035
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30032 -j DNAT --to-destination 192.168.250.9:30032
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30031 -j DNAT --to-destination 192.168.250.9:30031
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30029 -j DNAT --to-destination 192.168.250.9:30029
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30028 -j DNAT --to-destination 192.168.250.9:30028
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30026 -j DNAT --to-destination 192.168.250.9:30026
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30025 -j DNAT --to-destination 192.168.250.9:30025
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30024 -j DNAT --to-destination 192.168.250.9:30024
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30023 -j DNAT --to-destination 192.168.250.9:30023
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30022 -j DNAT --to-destination 192.168.250.9:30022
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30021 -j DNAT --to-destination 192.168.250.9:30021
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30019 -j DNAT --to-destination 192.168.250.9:30019
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30018 -j DNAT --to-destination 192.168.250.9:30018
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30016 -j DNAT --to-destination 192.168.250.9:30016
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30015 -j DNAT --to-destination 192.168.250.9:30015
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30014 -j DNAT --to-destination 192.168.250.9:30014
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30013 -j DNAT --to-destination 192.168.250.9:30013
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30012 -j DNAT --to-destination 192.168.250.9:30012
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30011 -j DNAT --to-destination 192.168.250.9:30011
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30010 -j DNAT --to-destination 192.168.250.9:30010
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30009 -j DNAT --to-destination 192.168.250.9:30009
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30006 -j DNAT --to-destination 192.168.250.9:30006
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30005 -j DNAT --to-destination 192.168.250.9:30005
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30004 -j DNAT --to-destination 192.168.250.9:30004
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30003 -j DNAT --to-destination 192.168.250.9:30003
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30002 -j DNAT --to-destination 192.168.250.9:30002
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30001 -j DNAT --to-destination 192.168.250.9:30001
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 30000 -j DNAT --to-destination 192.168.250.9:30000
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.6:80
-A DOCKER ! -i br-ac0d6f496e7c -p tcp -m tcp --dport 2222 -j DNAT --to-destination 192.168.250.8:2222
[root@localhost ~]# iptables -t raw -S
-P PREROUTING ACCEPT
-P OUTPUT ACCEPT
[root@localhost ~]# iptables -t mangle -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPTdocker 中有自定义的brige网络安装了jumpserver，iptables规则较多，防止关键信息缺少，就全部贴上了（本问题是在排查docker0内容器网络，docker中自定义brige网络也不能连接互联网）
现象如下图所示：（ETH1未收到数据包）
docker0 内容器无法 ping 通百度，抓包发现数据包能回到 ETH0，但是不能转给容器，
看到回包的 ttl 为1，怀疑路由环路，
猜测内网有网段跟docker网段冲突，测试更改过几次docker网段，排除此猜测
继续往下不知如何排查，
后续排查 iptables 规则，翻看官方文？？o????由于 docker 的 iptables 规则过于复杂，各种-j跳转到自定义链，排查未果。
后续排查 iptables 规则，翻看官方文？？o????由于 docker 的 iptables 规则过于复杂，各种-j跳转到自定义链，排查未果。
后续发现个现象
当我把 ETH1 的默认路由打开，且 metric 比 ETH0 小时，网络通了，
更改如下：
当我把 ETH1 的默认路由打开，且 metric 比 ETH0 小时，网络通了，
更改如下：
[root@localhost ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth1
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
# 此处加上默认路由
DEFROUTE=yes
# metric 比 ETH0 小
IPV4_ROUTE_METRIC=99
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=no
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=eth1
DEVICE=eth1
ONBOOT=yes
IPADDR=192.168.129.23
PREFIX=24
GATEWAY=192.168.129.1
DNS1=192.168.129.88
IPV6_PRIVACY=no
UUID=9c92fad9-6ecb-3e6c-eb4d-8a47c6f50c04如下图：（ETH0未收到数据包）
查看baidu的回包地址，发现是从总公司区域接入的互联网，也就是 10 网段没起到作用
此时的路由为：
[root@localhost ~]# ip route
default via 192.168.129.1 dev eth1 proto static metric 99
default via 10.0.1.1 dev eth0 proto static metric 100
10.0.1.0/24 dev eth0 proto kernel scope link src 10.0.1.47 metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
192.168.25.0/24 via 192.168.129.1 dev eth1 proto static metric 99
192.168.129.0/24 dev eth1 proto kernel scope link src 192.168.129.23 metric 99
192.168.250.0/24 dev br-ac0d6f496e7c proto kernel scope link src 192.168.250.1其余未做改动，
备注：不论是 10 还是 192 为主默认路由，主机跟互联网，主机跟容器，容器跟容器，都能通信，就是容器跟互联网不能通信
现在的问题是，按设计：只有特殊几个IP从总公司线路，其余全部走 10 网段通往公网，但是目前想让容器通网只能走 192，这样 10 网段就废掉了，目前已花费 3 天，可能是有某个我不知道的知识点，请教各位该如何排查我这个容器网络不通的问题
运维：请多包涵后续排查，发现出？？g????关开启了 禁止二级路由 功能，入？？f????据包 TTL 会被置为1，问题已？？e????
后续排查，发现出？？g????关开启了 禁止二级路由 功能，入？？f????据包 TTL 会被置为1，
