Yes, looks promising!
@Rilr Feel free to try and report back if it works! We can then add it to the documentation 
1 Like
Here’s the firewalld log from yesterday:
May 20 13:33:28 cirrus systemd[1]: firewalld.service: Consumed 1.426s CPU time.
May 20 13:33:28 cirrus systemd[1]: Stopped firewalld.service - firewalld - dynamic firewall daemon.
May 20 13:33:28 cirrus systemd[1]: firewalld.service: Deactivated successfully.
May 20 13:33:28 cirrus systemd[1]: Stopping firewalld.service - firewalld - dynamic firewall daemon...
May 20 12:34:15 cirrus firewalld[13472]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-55959a46b>
May 20 12:13:17 cirrus firewalld[13472]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-a20b3536d>
May 20 12:13:17 cirrus firewalld[13472]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o d>
May 20 12:13:16 cirrus systemd[1]: Started firewalld.service - firewalld - dynamic firewall daemon.
May 20 12:13:16 cirrus systemd[1]: Starting firewalld.service - firewalld - dynamic firewall daemon...
May 20 12:09:44 cirrus systemd[1]: firewalld.service: Consumed 1.215s CPU time.
May 20 12:09:44 cirrus systemd[1]: Stopped firewalld.service - firewalld - dynamic firewall daemon.
May 20 12:09:44 cirrus systemd[1]: firewalld.service: Deactivated successfully.
May 20 12:09:43 cirrus systemd[1]: Stopping firewalld.service - firewalld - dynamic firewall daemon...
May 20 11:54:07 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-a20b3536d08>
May 20 11:44:18 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o doc>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATIO>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATIO>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATIO>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATIO>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATIO>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATIO>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER' failed:>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER' failed:>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -X DOCKER' failed: ip>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -F DOCKER' failed: ip>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT' failed: ip>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING' failed>
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT -m addrtype>
Try `iptables -h' or 'iptables --help' for more information.
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT -m addrtype>
Try `iptables -h' or 'iptables --help' for more information.
May 20 11:44:17 cirrus firewalld[714]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING -m addr>
Try `iptables -h' or 'iptables --help' for more information.
May 20 11:06:31 fedora systemd[1]: Started firewalld.service - firewalld - dynamic firewall daemon.
May 20 11:06:31 fedora systemd[1]: Starting firewalld.service - firewalld - dynamic firewall daemon...
Today, I followed that link, and got this from the comments:
firewall-cmd --permanent --zone=trusted --add-interface=docker0
firewall-cmd --reload
but since doing that (after cleaning it all down to start from fresh). I can’t get past the domain name part of the AIO install.
Domain does not point to this server or reverse proxy not configured correctly.
looking in the firewall logs, they now look worse:
ay 21 10:11:49 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-111a657892b>
May 21 10:11:49 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-cef227f4784>
May 21 10:11:49 cirrus firewalld[747]: ERROR: ZONE_CONFLICT: 'docker0' already bound to 'trusted'
May 21 10:11:49 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o doc>
May 21 10:11:49 cirrus firewalld[747]: ERROR: ZONE_CONFLICT: 'docker0' already bound to 'trusted'
May 21 10:11:48 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o doc>
May 21 10:11:05 cirrus firewalld[747]: WARNING: ALREADY_ENABLED: docker0
May 21 09:56:47 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-111a657892b>
May 21 09:55:12 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-cef227f4784>
May 21 09:55:06 cirrus firewalld[747]: ERROR: ZONE_CONFLICT: 'docker0' already bound to 'trusted'
May 21 09:55:06 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o doc>
May 21 09:55:05 cirrus firewalld[747]: ERROR: ZONE_CONFLICT: 'docker0' already bound to 'trusted'
May 21 09:55:05 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o doc>
May 21 09:54:04 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o doc>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o doc>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATIO>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATIO>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATIO>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATIO>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATIO>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATIO>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER' failed:>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER' failed:>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -X DOCKER' failed: ip>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -F DOCKER' failed: ip>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT' failed: ip>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING' failed>
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT -m addrtype>
Try `iptables -h' or 'iptables --help' for more information.
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT -m addrtype>
Try `iptables -h' or 'iptables --help' for more information.
May 21 09:54:03 cirrus firewalld[747]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING -m addr>
Try `iptables -h' or 'iptables --help' for more information.
May 21 09:54:01 fedora systemd[1]: Started firewalld.service - firewalld - dynamic firewall daemon.
May 21 09:54:01 fedora systemd[1]: Starting firewalld.service - firewalld - dynamic firewall daemon...
Now i’m trying what the author suggested.
sudo sed -i 's/FirewallBackend=nftables/FirewallBackend=iptables/g' /etc/firewalld/firewalld.conf
sudo systemctl restart firewalld docker
I found that docker wouldn’t start. the two changes i had applied are seemingly incompatible. so if you tried adding docker0 to trusted, then remove it now:
sudo firewall-cmd --permanent --zone=trusted --remove-interface=docker0
sudo firewall-cmd --reload
i’m now in the long wait again to see this works as I download all the packages/containers etc.
but my firewalld logs still look less than good:
May 21 10:25:08 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o doc>
May 21 10:25:08 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-cef227f4784>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o doc>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i br-111a657892b>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATIO>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATIO>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATIO>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATIO>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATIO>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATIO>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER' failed:>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER' failed:>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -X DOCKER' failed: ip>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -F DOCKER' failed: ip>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT' failed: ip>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING' failed>
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT -m addrtype>
Try `iptables -h' or 'iptables --help' for more information.
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT -m addrtype>
Try `iptables -h' or 'iptables --help' for more information.
May 21 10:25:07 cirrus firewalld[748]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING -m addr>
Try `iptables -h' or 'iptables --help' for more information.
Bingo.
Containers
Apache (Running)
Database (Running)
Nextcloud (Running)
Redis (Running)
Collabora (Running)
Talk (Running)
ClamAV (Running)
I don’t know if this is a long term option, if fedora and it’s updates will be happy.
but it’s working, so thank you @szaimen and @SysKeeper
1 Like
Great that you were able to fix it!
I googled a bit and it seems like the issue is so well known that it is even mentioned on the official firewalld website https://firewalld.org/:
1 Like