Whirlweaser

Unraid 6.11.5. Alright, this one I struggled with for a couple weeks, I guess. Tried all kinds of different configurations but seems like the problem was just with iptables. Story so far: I'm using custom Docker bridge with disabled icc and masquerading, since all of this will be taken care of by my router (OPNsense in VM). In order for Docker containers to access internet, I have to use the router as a gateway, which is set as a default one in the Unraid host (thanks, libvirt). Now the interesting part. If I use the predefined `docker0` network (btw maybe you should add a possibility to remove it, since it's not useful for everyone), container can reach out to the internet just fine. Same goes for any created Docker network (bridge), but it only lasts until Unraid is rebooted! After a reboot Internet is unreachable from a container (`Destination Port Unreachable`). The problem lies in the order of the iptables rules in the `FORWARD` chain: root@unraid:~# iptables -L -v -n Chain INPUT (policy ACCEPT 1933 packets, 206K bytes) pkts bytes target prot opt in out source destination 4704 476K LIBVIRT_INP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 5415 3513K DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0 5415 3513K DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0 0.0.0.0/0 3972 4288K ACCEPT all -- * docker5 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 0 0 DOCKER all -- * docker5 0.0.0.0/0 0.0.0.0/0 2996 226K ACCEPT all -- docker5 !docker5 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0 278 19226 LIBVIRT_FWX all -- * * 0.0.0.0/0 0.0.0.0/0 278 19226 LIBVIRT_FWI all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 LIBVIRT_FWO all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- * docker4 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 0 0 DOCKER all -- * docker4 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- docker4 !docker4 0.0.0.0/0 0.0.0.0/0 0 0 WIREGUARD all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 DROP all -- docker4 docker4 0.0.0.0/0 0.0.0.0/0 0 0 DROP all -- docker5 docker5 0.0.0.0/0 0.0.0.0/0 Here `docker5` is a freshly created bridge, and `docker4` was created before the reboot. The only difference is that they are separated by the libvirt rules. The manual solution: if I move the three `docker4` rules above the `LIBVIRT_FWX` rule manually, to mimic a scenario when this network was created via console just now, this network starts working properly. It would be great if you add a fix, so that the custom Docker network rules are put before the libvirt rules.