Ubuntu 22.04 LTS – Docker bridge networking broken after nftables changes – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Containers cannot reach external networks or published ports behave inconsistently.

Environment & Reproduction

Ubuntu 22.04 with Docker engine and modified nftables/iptables policy.

Root Cause Analysis

Required NAT and forwarding chains are overridden or not applied in active backend.

Quick Triage

Check docker network inspect bridge and nft list ruleset for missing nat prerouting/postrouting paths.

Step-by-Step Diagnosis

Validate kernel forwarding sysctl and compare firewall policy before and after Docker restart.

Solution – Primary Fix

Restore compatible firewall backend, allow Docker-managed chains, and restart docker service.

Solution – Alternative Approaches

Use user-defined bridge with explicit network policy managed in infrastructure code.

Verification & Acceptance Criteria

Containers resolve DNS, reach internet, and exposed services are reachable as intended.

Rollback Plan

Revert recent nftables rule deployment and restore prior known-good ruleset.

Prevention & Hardening

Test firewall updates in staging with container connectivity checks.

Related Errors & Cross-Refs

Kubernetes CNI outages can stem from similar forwarding and NAT misconfiguration.

Related tutorial: View the step-by-step tutorial for Ubuntu 22.04 LTS.

View all Ubuntu 22.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu 22.04 Docker networking and nftables compatibility notes.