It looked like dockerd already did this through iptables, but apparently this needs to be specifically enabled for the firewall zone for iptables masquerading to work: # Masquerading allows for docker ingress and egress (this is the juicy bit)įirewall-cmd -zone=public -add-masquerade -permanent Long story short - for this to work, I had to enable masquerading. I was used to be able to find the whole truth in iptables, so this will take some getting used to. That means most - if not all - of the firewalld configuration will be applied outside the scope of iptables. While inspecting network rules with iptables, I realized that the switch to nftables means that iptables is now an abstraction layer that only shows a small part of the nftables rules. After spending a couple of days looking at logs and configurations for the involved components, I was about to throw in the towel and revert back to Fedora 30, where this seems to work straight out of the box.įocusing on firewalling, I realized that disabling firewalld seemed to do the trick, but I would prefer not to do that.

Docker centos 8