文章目录# 路由中的docker转发问题# （安全）联网# iptables# 路由中的docker转发问题以docker运行nginx为例，开放80端口docker run--name mynginx01-p80:80-it nginx/bin/bash iptables开放wan口80数据包路径ddns get: router lan address ↓ tcp port:80router wan ↓ ready forward to lan ---------- nat preforward: all port:80 and not from docker0 to docker0 ↓ ---------- filter forward: accept all to docker0 ↓ ---------- filter input: accept port:80 to lan from wan ↓ forward to router docker0 ↓ docker0:nginx下面为iptables的配置filter 表root@OpenWrt_D2550:~# iptables -nL --verboseChain INPUT(policy ACCEPT0packets,0bytes)pkts bytes target prot optinoutsourcedestination18523655ACCEPT all -- lo *0.0.0.0/00.0.0.0/0 /*!fw3 */74211718K ACCEPT all -- * *0.0.0.0/00.0.0.0/0 ctstate RELATED,ESTABLISHED /*!fw3 */18819927zone_lan_input all -- br-lan *0.0.0.0/00.0.0.0/0 /*!fw3 */00zone_wan_input all -- pppoe-wan *0.0.0.0/00.0.0.0/0 /*!fw3 */00zone_wan_input all -- eth1 *0.0.0.0/00.0.0.0/0 /*!fw3 */00zone_VPN_input all -- ipsec0 *0.0.0.0/00.0.0.0/0 /*!fw3 */ Chain FORWARD(policy DROP0packets,0bytes)pkts bytes target prot optinoutsourcedestination2006392K DOCKER-USERall -- * *0.0.0.0/00.0.0.0/02006392K DOCKER-ISOLATION-STAGE-1 all -- * *0.0.0.0/00.0.0.0/000ACCEPT all -- * docker00.0.0.0/00.0.0.0/0 ctstate RELATED,ESTABLISHED2006392K forwarding_rule all -- * *0.0.0.0/00.0.0.0/0 /*!fw3: Custom forwarding rule chain */1848382K ACCEPT all -- * *0.0.0.0/00.0.0.0/0 ctstate RELATED,ESTABLISHED /*!fw3 */00DOCKER all -- * docker00.0.0.0/00.0.0.0/000ACCEPT all -- docker0!docker00.0.0.0/00.0.0.0/000ACCEPT all -- docker0 docker00.0.0.0/00.0.0.0/00