我正在使用 docker swarm 观察 iptables 上的奇怪行为。也许有人可以解释那里发生了什么。首先使用 清零 FORWARD 链上的计数器iptables -Z FORWARD，然后在一分钟后iptables -L FORWARD -n -v --line-numbers：
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 115K 62M DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0
2 57041 57M DOCKER-INGRESS all -- * * 0.0.0.0/0 0.0.0.0/0
3 1299K 1009M DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0
4 1299K 1009M DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0 0.0.0.0/0
5 0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
6 0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0
7 0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
8 0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
9 154K 159M ACCEPT all -- * docker_gwbridge 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
10 5420 299K DOCKER all -- * docker_gwbridge 0.0.0.0/0 0.0.0.0/0
11 1140K 850M ACCEPT all -- docker_gwbridge !docker_gwbridge 0.0.0.0/0 0.0.0.0/0
12 0 0 DROP all -- docker_gwbridge docker_gwbridge 0.0.0.0/0 0.0.0.0/0
为了确保规则 1 和规则 3 相同，我运行了iptables -S FORWARD：
-P FORWARD DROP
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-INGRESS
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker_gwbridge -j DOCKER
-A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT
-A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP
我知道有时会发生重复的规则，但为什么第二次出现的规则计数的数据包（1299K）比第一次出现的数据包（115K）更多？