Nftables vs dockerd

Installing and Using OpenWrt
6

i added the empty bridge option to init script but it does not help.

  1. reset to default settings, no additional zone config whatsoever, only the service created 3xACCEPT docker zone.
    it ends up having these docker related chains / rules:
 chain input_docker {
                 jump accept_from_docker
         }
 
         chain output_docker {
                 jump accept_to_docker
         }
 
         chain forward_docker {
                 jump accept_to_docker
         }
 
         chain helper_docker {
         }
 
         chain accept_from_docker {
         }
 
         chain accept_to_docker {
         }

no other docker related config: neither in input, output or forward chain in spite docker zone config all 3 ACCEPT.

with this setup container starts, my lan interface is 10.0.0.1 and docker container is bind to 10.0.0.2 which is an alias for lan. container is adguard home DNS resolver.

$ docker ps
CONTAINER ID   IMAGE                 COMMAND                  CREATED        STATUS         PORTS                                                                                                                                                                                                                                                                                                                                NAMES
c28128f7dab5   adguard/adguardhome   "/opt/adguardhome/Ad…"   27 hours ago   Up 7 minutes   10.0.0.2:53->53/tcp, 10.0.0.2:80->80/tcp, 10.0.0.2:53->53/udp, 10.0.0.2:443->443/udp, 10.0.0.2:443->443/tcp, 10.0.0.2:784->784/udp, 67-68/udp, 10.0.0.2:853->853/tcp, 10.0.0.2:3000->3000/tcp, 10.0.0.2:853->853/udp, 3001/tcp, 10.0.0.2:5443->5443/udp, 10.0.0.2:5443->5443/tcp, 10.0.0.2:8853->8853/udp, 3000-3001/udp, 6060/tcp   adguard

running DNS request against adguard fails:

 $ nslookup google.com 10.0.0.2
 Server:         10.0.0.2
 Address:        10.0.0.2:53
 
 ;; connection timed out; no servers could be reached
  1. set forwarding docker -> wan in docker zone config:
 firewall.@forwarding[2]=forwarding
 firewall.@forwarding[2].src='docker'
 firewall.@forwarding[2].dest='wan'

now, as should, there is a new rule in forward_docker chain but still nothing in forward chain:

 chain forward {
                 type filter hook forward priority filter; policy drop;
                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
                 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
                 iifname "eth0" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
                 iifname "eth4" jump forward_console comment "!fw4: Handle console IPv4/IPv6 forward traffic"
                 iifname "br-guest" jump forward_guest comment "!fw4: Handle guest IPv4/IPv6 forward traffic"
 				jump handle_reject
         }
 		
 chain input_docker {
 		jump accept_from_docker
 }
 
 chain output_docker {
 		jump accept_to_docker
 }
 
 chain forward_docker {
 		jump accept_to_wan comment "!fw4: Accept docker to wan forwarding"
 		jump accept_to_docker
 }
 
 chain helper_docker {
 }
 
 chain accept_from_docker {
 }
 
 chain accept_to_docker {
 }

DNS request still fails:

$ nslookup google.com 10.0.0.2
Server:         10.0.0.2
Address:        10.0.0.2:53

;; connection timed out; no servers could be reached
  1. adding missing rules by hand to forward and to accept_to_docker chain:
nft list chain inet fw4 forward; nft list chain inet fw4 forward_docker; nft list chain inet fw4 accept_to_d
ocker
table inet fw4 {
        chain forward {
                type filter hook forward priority filter; policy drop;
                ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
                iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
                iifname "eth0" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
                iifname "eth4" jump forward_console comment "!fw4: Handle console IPv4/IPv6 forward traffic"
                iifname "br-guest" jump forward_guest comment "!fw4: Handle guest IPv4/IPv6 forward traffic"
                iifname "docker0" jump forward_docker comment "added by me"
                jump handle_reject
        }
}
table inet fw4 {
        chain forward_docker {
                jump accept_to_wan comment "!fw4: Accept docker to wan forwarding"
                jump accept_to_docker
        }
}
table inet fw4 {
        chain accept_to_docker {
                oifname "docker0" accept comment "added by me"
        }
}

and finally DNS is working:

$ nslookup google.com 10.0.0.2
Server:         10.0.0.2
Address:        10.0.0.2:53

Non-authoritative answer:
Name:   google.com
Address: 216.58.212.206

Non-authoritative answer:
Name:   google.com
Address: 2a00:1450:4009:823::200e

note: all this with the same docker config as in first post, i.e. list blocked_interfaces wan with the extra iptables args, which adds this legacy firewall rule too but this works as expected:

-A DOCKER-USER -i eth0 -o docker0 -m conntrack ! --ctstate RELATED,ESTABLISHED -j REJECT --reject-with icmp-port-unreachable