title: How to correct configuration for firewalld and docker/nginx?
body: <p>I have a CentOS 7 server which was running happily for 600+ days until it was rebooted recently, after which incoming web requests were receiving HTTP523 (Origin Is Unreachable) error codes (via Cloudflare, if that makes a difference?) unless I stopped the <code>firewalld</code> service. Things run fine without <code>firewalld</code>, but I'd rather not leave it disabled!</p>
  <p>I've tried stopping <code>docker</code> and <code>firewalld</code> and restarting them in various sequences, but the same <code>523</code> error occurs unless I stop <code>firewalld</code>.</p>
  <p><code>/var/log/firewalld</code> contains a few warnings that might help:</p>
  <ul>
  <li><code>WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-8acb606a3b50 -o br-8acb606a3b50 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).</code></li>
  <li><code>WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).</code></li>
  <li><code>WARNING: AllowZoneDrifting is enabled. This is considered a n insecure configuration option. It will be removed in a future release. Please consider disabling it now.</code></li>
  <li><code>WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.4.21: Couldn't load target 'DOCKER':No such file or directory</code></li>
  <li><code>WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING' failed: iptables: Bad rule (does a matching rule exist in that chain?).</code></li>
  <li><code>WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT' failed: iptables: Bad rule (does a matching rule exist in that chain?)</code></li>
  <li><code>WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -F DOCKER' failed: iptables: No chain/target/match by that name.</code></li>
  </ul>
  <p>I've found seemingly conflicting advice around the place regarding any manual configuration/commands required:</p>
  <ol>
  <li><a href="https://forums.centos.org/viewtopic.php?t=74270" rel="nofollow noreferrer"><code>firewall-cmd --permanent --zone=trusted --add-interface=docker0</code> on a CentOS forum</a></li>
  <li><a href="https://docs.docker.com/network/iptables/#integration-with-firewalld" rel="nofollow noreferrer"><code>firewall-cmd --zone=trusted --remove-interface=docker0 --permanent</code> on the offical Docker docs</a> -- surely that's the opposite of the above?</li>
  <li><a href="https://github.com/moby/moby/issues/35043#issuecomment-356036671" rel="nofollow noreferrer">a bunch of manual <code>firewall-cmd</code> commands on a Docker github issue</a> -- surely all of that isn't required?</li>
  <li>this one looks promising -- <a href="https://github.com/moby/moby/issues/16137#issuecomment-271615192" rel="nofollow noreferrer"><code>nmcli</code>, <code>NetworkManager</code> and <code>firewall-cmd --permanent --zone=trusted --change-interface=docker0</code></a></li>
  </ol>
  <p>I don't fully understand where the <code>br-8acb606a3b50</code> interface comes from, or whether I need to do anything to configure it as well as <code>docker0</code> if I use a solution like <code>4.</code> above? It was all working fine automatically for years until the reboot!</p>
  <p>Are some magic <code>firewalld</code> incantations now required (and why?!) or is there some way I can get the system to get back into the correct auto/default configuration it was in prior to rebooting?</p>
  <pre><code>$ docker -v
  Docker version 20.10.5, build 55c4c88
  $ firewall-cmd --version
  0.6.3
  $ firewall-cmd --get-zones
  block dmz docker drop external home internal public trusted work
  </code></pre>