Docker Container Not Receiving Packets on Specific Port in Oracle Cloud (OL7)

Docker containers on Oracle Cloud Linux 7 often fail to receive packets on specific ports due to strict firewall configurations. This issue typically stems from the host-level firewalld service blocking incoming traffic before it reaches the Docker daemon, or incorrect NAT rules in iptables preventing proper packet translation. The root cause is usually that the default Docker network bridge does not bypass the system firewall by default in OL7 environments. When a container exposes a port using the -p flag, Docker attempts to add iptables rules to allow traffic. However, if the host firewall is active and configured with high security policies, it may drop these packets entirely. Additionally, Oracle Cloud Infrastructure (OCI) uses virtual networks where security lists must explicitly allow inbound traffic for the specific port and protocol. Without correct configuration at both the OCI level and the OS level, connections will timeout or be refused.

Checking OCI Security Lists

Before diving into server-side configurations, you must verify that the cloud provider allows the traffic. Oracle Cloud uses Virtual Cloud Networks (VCNs) with security lists that act as virtual firewalls. If the instance's public IP cannot reach the port, no amount of local troubleshooting will help. Navigate to the Oracle Cloud Console and locate your Compute Instance. Under the Networking section, find the VCN associated with your instance. Click on the Security List linked to the subnet where your instance resides. Ensure there is an Ingress Rule that matches your requirements: - Stateless: Usually unchecked for simple HTTP/HTTPS or custom port access. - Source CIDR: Set to 0.0.0.0/0 for public internet access, or restrict it to specific IP ranges for security. - IP Protocol: Select TCP. - Destination Port Range: Enter the specific port number (e.g., 8080 or 3000) that your Docker container is listening on. If this rule is missing, add it immediately. This step is critical because OCI intercepts traffic at the hypervisor level before it even hits the guest OS network interface.

Configuring Firewalld on OL7

Oracle Linux 7 uses firewalld as the default dynamic firewall manager. Unlike older systems that used plain iptables, firewalld manages zones and services. Docker relies on direct routing through iptables, which can conflict with firewalld if not properly integrated. First, check the status of the firewall: ```bash sudo systemctl status firewalld ``` If it is active, you need to ensure that the port is allowed within the current zone. By default, firewalld might be set to "drop" or "reject" incoming connections that are not explicitly permitted. To allow a specific port, use the following command: ```bash sudo firewall-cmd --permanent --add-port=YOUR_PORT/tcp sudo firewall-cmd --reload ``` Replace YOUR_PORT with the actual port number. The --permanent flag ensures the rule persists across reboots, while --reload applies the changes without dropping existing connections. This approach is safer than flushing all rules, as it only opens the necessary door.

Verifying Docker Network Configuration

Once the external firewalls are cleared, inspect the Docker container's internal networking. Use the docker ps command to see which ports are mapped: ```bash docker ps ``` Look at the PORTS column. It should show something like 0.0.0.0:HOST_PORT->CONTAINER_PORT/tcp. If it shows 127.0.0.1 instead of 0.0.0.0, the port is only accessible from localhost, not from the external network. To fix this, restart the container with the correct binding: ```bash docker run -d -p 0.0.0.0:HOST_PORT:CONTAINER_PORT IMAGE_NAME ``` Using 0.0.0.0 binds the port to all available network interfaces, allowing external access. If you are using Docker Compose, ensure the ports section in your docker-compose.yml file specifies the host IP correctly or omits it to bind to all interfaces.

Troubleshooting iptables Rules

In some cases, firewalld may not interact smoothly with Docker's automatic iptables management. You can check the current iptables rules to see if Docker has successfully added its forwarding rules. Run: ```bash sudo iptables -L -n -v ``` Look for chains named DOCKER or FORWARD. If you see DROP or REJECT rules affecting the Docker bridge interface (docker0), there may be a conflict. Instead of flushing the entire table, which deletes all rules including essential ones, target the specific chain. You can flush the Docker-specific chain safely: ```bash sudo iptables -F DOCKER ``` This clears stale or conflicting rules generated by previous container runs without affecting the core system firewall. After flushing, restart the Docker service to regenerate clean rules: ```bash sudo systemctl restart docker ```

Testing Connectivity

After applying these changes, test the connectivity from an external machine. Use telnet or nc (netcat) to verify the port is open: ```bash telnet YOUR_PUBLIC_IP YOUR_PORT ``` Or use curl if it is an HTTP service: ```bash curl http://YOUR_PUBLIC_IP:YOUR_PORT ``` If the connection times out, revisit the OCI Security List and Firewalld settings. If it connects but the application fails, check the container logs using docker logs CONTAINER_ID to ensure the application inside is actually listening on the expected port. For more information on managing DNS within your containers, see [Rebooting DNS Server in Docker Container](/news/1243235/reboot-dns-server-docker). If you are experiencing issues connecting your container to external Oracle databases, refer to [Docker Container Can't Connect to Outside Oracle Server](/news/1080514/docker-container-can-t-connect-to-oracle-server).

Frequently Asked Questions

Why does my container work locally but not on Oracle Cloud?

Local testing bypasses the external network layers, so issues with OCI Security Lists or host firewalls are invisible. Always test from an external IP address to confirm end-to-end connectivity.

Is it safe to disable firewalld completely?

Disabling firewalld is generally not recommended as it leaves the system vulnerable. Instead, configure precise rules to allow only the necessary ports, maintaining security while enabling Docker functionality.

How do I check if Docker is binding to the correct interface?

Use docker ps and look at the PORTS column. If it shows 127.0.0.1, the container is only accessible via localhost. Change the mapping to 0.0.0.0 to expose it to all interfaces.

What causes iptables conflicts with Docker on OL7?

Conflicts arise when firewalld and Docker both attempt to manage packet filtering rules simultaneously. Flushing the specific DOCKER chain in iptables resolves stale rules without disrupting the main firewall.

Can I use a different port to avoid firewall issues?

Changing ports does not resolve firewall misconfigurations. The underlying issue is that the firewall is blocking traffic regardless of the port number. Correct the firewall rules for the new port instead.