Today I learned: Firewalld Masquerade & Docker

While using Docker on Fedora 34 I encountered an issue where my containers would not communicate properly. So I had a Docker Compose configuration with an internal network and a default bridge network. While I could ping the various servers from inside the containers, connections to various ports were failing. So ICMP traffic was up and running while the rest didn’t work. That is an obvious firewall configuration problem. Fedora 34 uses Firewalld as its firewall, while underneath it’s really iptables. Solving this particular problem requires enabling masquerading. First we would need to find out the active firewall zones:

sudo firewall-cmd --get-active-zones

FedoraServer

interfaces: eth0

docker

interfaces: br-0eb49bac0303 docker0

Bash response

In my case I am interested in the FedoraServer zone:

sudo firewall-cmd --zone=FedoraServer --add-masquerade --permanent
sudo firewall-cmd --reload

Then I would recommend restarting the Docker daemon:

sudo systemctl restart docker

This should do the trick!