# Docker overwrites nftables firewall

**URL:** <https://forums.docker.com/t/docker-overwrites-nftables-firewall/123585>\
**Category:** General\
**Tags:** docker\
**Created:** [April 18, 2022, 11:02am UTC](https://forums.docker.com/t/docker-overwrites-nftables-firewall/123585 "2022-04-18T11:02:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![inceptor](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/inceptor/32/32497_2.png) [@inceptor](https://forums.docker.com/u/inceptor)\
**Post date:** [April 18, 2022, 11:02am UTC](https://forums.docker.com/t/docker-overwrites-nftables-firewall/123585/1 "2022-04-18T11:02:28Z")

</div>

Hi All, I’m still new with docker,

I’m using rocky linux 8.5, I’ve been having trouble with docker overwriting nftables rules. The INPUT chain would follow docker making it accept all connection.

Alternatively I’ve tried changing the table to inet but it only follow the inet FORWARD chain making containers unable to get internet access.

I have a basic config in /etc/sysconfig/nftables.conf

```auto
table ip filter {
        chain INPUT {
		type filter hook input priority 0; policy drop;
		ct state invalid counter drop
		ct state {established,related} counter accept
		iif lo accept
		iif != lo ip daddr 127.0.0.1/8 counter drop
		iif != lo ip6 daddr ::1/128 counter drop
		ip saddr xxx.xxx.xxx.xxx tcp dport 22 accept
	}
	chain FORWARD {
		type filter hook forward priority 0; policy drop;
		counter
	}
	chain OUTPUT {
		type filter hook output priority 0; policy accept;
		counter
	}
}	

```

I would appreciate any help i can get.

---

<div class="post-metadata">

**Author:** ![jrglindemann](https://avatars.discourse-cdn.com/v4/letter/j/e47774/32.png) [@jrglindemann](https://forums.docker.com/u/jrglindemann)\
**Post date:** [February 26, 2023, 3:55pm UTC](https://forums.docker.com/t/docker-overwrites-nftables-firewall/123585/2 "2023-02-26T15:55:37Z")

</div>

Hello @inceptor ,

I think i have the same problem. Could you solve it or understand it in the meantime?

Thank you.

[THIS](https://forums.docker.com/t/strange-connection-problem-with-a-portainer-container/134839/2) is my posting.