how DOCKER chain in iptables works? - docker

Question

I'm new to docker.
Recently I experienced somewhat strange scenario.
I created ubuntu instance in OCI(Oracle Cloud Infrastructure).
When I started nginx process in this ubuntu instance, access from external network fails.
When I started nginx with docker container, access from external network successes.
After some search, I found that INPUT chain in iptables does not allow tcp 80.
Additionally, docker will update my iptables to ADD rule in PREROUTING chain.
Here is result of command sudo iptables -nL -t nat.
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DOCKER all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DOCKER all -- 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 0.0.0.0/0
MASQUERADE tcp -- 172.17.0.2 172.17.0.2 tcp dpt:80
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:172.17.0.2:80
But as you can see in DOCKER chain, I think, RETURN rule is always applied former than DNAT rule.
This means, DOCKER chain does not do anything!
Can anybody give any explanations on this?
One possible assumption is that RETURN rule is applied last regardless of order of rule. (But I'm not sure this is true or not).
Thanks!

Answer 1

RETURN rule actually will be applied at first, but it is not mean to ignore other rules. There also have another two variables IN and OUT which describe the rule's input and output.
You can add -v to your command to show it.
$ iptables -nL -v -t nat
......
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
12 720 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0
1691 107K DNAT tcp -- !docker0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8601 to:172.17.0.2:8601
......