# Discourse failing to start due to docker/iptables issue

**URL:** https://meta.discourse.org/t/discourse-failing-to-start-due-to-docker-iptables-issue/314969
**Category:** Self-hosting
**Tags:** docker
**Created:** [July 4, 2024, 9:24am UTC](https://meta.discourse.org/t/discourse-failing-to-start-due-to-docker-iptables-issue/314969 "2024-07-04T09:24:03Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Isambard](https://avatars.discourse-cdn.com/v4/letter/i/858c86/32.png) [@Isambard](https://meta.discourse.org/u/Isambard)
#### Post date: [July 4, 2024, 9:24am UTC](https://meta.discourse.org/t/discourse-failing-to-start-due-to-docker-iptables-issue/314969/1 "2024-07-04T09:24:03Z")

</div>

Trying a ./launcher start app and I get the following error:

```plaintext
Error response from daemon: driver failed programming external connectivity on endpoint (): (iptables failed: iptables --wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d 172.17.0.5 --dport 80 -j ACCEPT: iptables: No chain/target/match by that name. (exit status 1)) Error: failed to start containers:

```

It claims no chain/match but iptables-save shows:

```plaintext
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 5432 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.4/32 -d 172.17.0.4/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.5/32 -d 172.17.0.5/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.17.0.2:443
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 5432 -j DNAT --to-destination 172.17.0.3:5432
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.17.0.2:80
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 8086 -j DNAT --to-destination 172.17.0.4:80
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 8087 -j DNAT --to-destination 172.17.0.5:

```

Any idea how to fix without having to restart docker service?

---

<div class="post-metadata">

### Author: ![Isambard](https://avatars.discourse-cdn.com/v4/letter/i/858c86/32.png) [@Isambard](https://meta.discourse.org/u/Isambard)
#### Post date: [July 5, 2024, 8:56am UTC](https://meta.discourse.org/t/discourse-failing-to-start-due-to-docker-iptables-issue/314969/2 "2024-07-05T08:56:37Z")

</div>

I think this was to a funny timing quirk where starting/stopping container rapidly messed up the NAT tables.

I gave up and restarted the docker service.