title: Do docker and podman iptables rules conflict?
body: <p>I've installed both Docker and Podman on the same machine. Is that my first problem? Maybe. But my goal is run both and I'd like to continue anyway.</p>
  
  <p>My problem is this: there seems to be an iptables conflict between Docker's rules and Podman's rules, <em>and</em> my working solution doesn't make any sense to me.</p>
  
  <p>Version info:
  OS: RHEL 7.6
  Podman: 0.11.1.1
  Docker: 18.09.1
  Iptables: 1.4.21</p>
  
  <p>Two points of information:</p>
  
  <ol>
  <li>The docker daemon adds iptables rules for container networking on startup.</li>
  <li>Podman adds iptables rules via CNI (Container Network Interface) for container networking when you run a container.</li>
  </ol>
  
  <p>I'm running a container with podman that exposes a port (let's say, 5000, for example). I've constructed 3 test cases that help illustrate my question and the extremely weird behavior I encounter in case 3 that makes remote access work. Read on.</p>
  
  <ol>
  <li><p>The first case makes complete sense: I install Podman normally, <em>without any installation of Docker</em>, and the run the container. Poof! Container runs and I can remotely access the port, as I expect.</p></li>
  <li><p>The second case is where remote access fails. I install Podman normally, <em>install and run the Docker service</em>, then run my container <em>with Podman</em>. Boom. Remote access fails because there is no route to the host.</p></li>
  </ol>
  
  <p>Before I go on to the third case, it's important to note two very specific iptables rules. You can view these rules (if you have a Docker daemon running and a Podman container up) by running:</p>
  
  <pre><code>iptables -t nat -nL PREROUTING
  </code></pre>
  
  <p>The output of the command is:</p>
  
  <pre><code>Chain PREROUTING (policy ACCEPT)
  target    prot opt source            destination
  DOCKER    all  --  0.0.0.0/0         0.0.0.0/0      ADDRTYPE match dst-type LOCAL
  CNI-HOSTPORT-DNAT    all  --  0.0.0.0/0         0.0.0.0/0      ADDRTYPE match dst-type LOCAL
  </code></pre>
  
  <p>Now comes the third case:</p>
  
  <ol start="3">
  <li>So I'm poking around in iptables, and I know enough to be dangerous.</li>
  </ol>
  
  <p>I decide to delete the <code>CNI-HOSTPORT-DNAT</code> rule:</p>
  
  <pre><code>iptables -t nat -D PREROUTING 2
  </code></pre>
  
  <p>And suddenly, I can remotely access the container via port 5000 again.</p>
  
  <p>My question is:</p>
  
  <p>Why does removing the aforementioned rule makes things work again? You would think that removing a CNI-generated rule would break Podman networking. But it doesn't. I'm baffled!</p>
  
  <p>Thanks in advance.</p>
  
  <p>UPDATE: figured out the issue, and it was my fault.</p>
  
  <p>My packets were getting correctly sent to the FORWARD chain after DNAT, but I have a default of DROP on that chain, and no rule on that chain to accept packets bound for port 5000. Once I added a FORWARD rule to accept dport=5000 packets, it started working.</p>
  
  <p>This question can be closed.</p>