coexistence between nftables and iptables ?

coexistence between nftables and iptables ?

[PierluigiFrullani]

Hello all,
 first post here so please be indulgent.
I was wandering if I those two "technologies" can coexist. 
My problem is: I have a small machine that does firewalling for my home net, and on this machine there is also a docker environment. 
Docker use iptables for his internal stuff and for forwarding traffic between host ( and his net ) and dockers themselves. It does this by creating a quite complex number of rules and tables, which btw are handled by docker daemon  and scripts.

So far so good you might say. Well... no.
being that also my iptables rules are quite comples I used, when in need of modify them in some way, to flush all iptables and start all over again.
This will flush also all other docker rules so that the docker environment does not work anymore unless I stop and restart the daemon ( which obviously is not always acceptable ).

If I can use nftables for my firewalling and routing needs, and leave iptables only for docker, then I can flush my nftables whenever I want, without impacting docker environment.

Is that true ?
Is that possible ?


Thanks in advance and sorry for my poor english.

Pierluigi ( from Italy )

Re: coexistence between nftables and iptables ?

[George Shuklin]

There is DOCKER-USER chain for those things.

Don't try to use 'iptables for docker, nftables for filtering, it will 
cause a lot of bugs and issues.

See ready-made template which allow to add firewall rules into nftables 
to filter ports for both local (non-docker) and docker-hosted applications.

https://github.com/lidofinance/ansible-collection-server/blob/master/roles/docker_iptables/templates/iptables.rules.j2

(If you use Ansible, you can grab ready-made collection from Galaxy 
https://galaxy.ansible.com/ui/repo/published/lidofinance/server/docs/)


On 11/6/25 11:44 AM, PierluigiFrullani wrote:
> Hello all,
>   first post here so please be indulgent.
> I was wandering if I those two "technologies" can coexist.
> My problem is: I have a small machine that does firewalling for my home net, and on this machine there is also a docker environment.
> Docker use iptables for his internal stuff and for forwarding traffic between host ( and his net ) and dockers themselves. It does this by creating a quite complex number of rules and tables, which btw are handled by docker daemon  and scripts.
>
> So far so good you might say. Well... no.
> being that also my iptables rules are quite comples I used, when in need of modify them in some way, to flush all iptables and start all over again.
> This will flush also all other docker rules so that the docker environment does not work anymore unless I stop and restart the daemon ( which obviously is not always acceptable ).
>
> If I can use nftables for my firewalling and routing needs, and leave iptables only for docker, then I can flush my nftables whenever I want, without impacting docker environment.
>
> Is that true ?
> Is that possible ?
>
>
> Thanks in advance and sorry for my poor english.
>
> Pierluigi ( from Italy )
>
>
>

Re: coexistence between nftables and iptables ?

[PierluigiFrullani]

On Thursday, 6 November 2025 13:13:52 CET George Shuklin wrote:

> There is DOCKER-USER chain for those things.
Not really:
Or at least not really for my need:

# iptables -L -v -n | grep ^Cha | grep DO
Chain DOCKER (3 references)
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
Chain DOCKER-ISOLATION-STAGE-2 (3 references)
Chain DOCKER-USER (1 references)

~# iptables -t nat -L -v -n | grep ^Cha | grep DO
Chain DOCKER (2 references)


I do not need to play with DOCKER-USER chain. Rules created by daemon for me are fine.
I do need to modify all other rules ( INPUT-FORWARD-OUTPUT PRE and POSTROUTING ) for all other needs __except__ dockers, but I do this, usually by flushing all availables chains ( at least to be sure that at boot everything works ) 

In my firewall start script I have:
/usr/sbin/iptables -w  -F
/usr/sbin/iptables -w  -t nat -F
/usr/sbin/iptables -w  -t raw -F
/usr/sbin/iptables -w  -X

Obviously the -F and the -X will "kill" every  rule and chain, thus also DOCKERs one ( and  those that call the jump to DOCKERs )


> 
> Don't try to use 'iptables for docker, nftables for filtering, it will 
> cause a lot of bugs and issues.
That's my suspect :)

 
> See ready-made template which allow to add firewall rules into nftables 
> to filter ports for both local (non-docker) and docker-hosted applications.
> 
> https://github.com/lidofinance/ansible-collection-server/blob/master/roles/docker_iptables/templates/iptables.rules.j2
This link leads to an 404 page :(
 
> (If you use Ansible, you can grab ready-made collection from Galaxy 
> https://galaxy.ansible.com/ui/repo/published/lidofinance/server/docs/)
> 

Thanks 

Pigi