following situation: i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4 I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to collect syslog input.

in some situations, after restarting the container, syslog traffic is not forwarded to the container anymore.

'iptables -nvL' shows that there is no traffic matching the rule applied to the forwarding chain during container start. The traffic counter of the INPUT chain is considerably higher than in the FORWARD chain.

I notice this behavior on all containers that are exposing UDP ports to the world, containers with TCP based services are working as expected.

restarting the containers and the docker service is without success.

I'm mainly collecting firewall trafficlogs, so the syslog traffic flow is quite constant. I'm collecting approx 1,5k Syslog traps per second.

My workaround here is to stop all traffic to the host for about 10 seconds (currently by blackholing the traffic on an upstream router)

After stopping syslog export on one single firewall node for a few seconds, traffic from this specific firewall is forwarded to the container as expected. But only from this single one.

I think that this is an issue of iptables. It seems that iptables is caching the forwarding-infrmation for a few seconds and is ignoring any new applied rules as long as traffic is present.

I've done no additional configuration on iptables here. Everything is done by docker. I have no ufw, conntrackd or anything installed.

Any suggests how to solve this issue?

best regards Andreas

  • I've also run into this problem, and it's been plaguing me for months. I have collectd sending data to Riemann (in a Docker container) via UDP. On the container restart, collectd's data doesn't appear until I restart that process. I hadn't made the 10s connection, but that ties with what I'm seeing.
    – blalor
    Dec 21, 2014 at 13:02
  • what is your docker host system? Currently i'm trying to reproduce this issue without docker. Just with bridge-utils and iptables. Dec 22, 2014 at 21:08

1 Answer 1


Looks like this related to conntrack. It's been flagged as a Docker bug: https://github.com/docker/docker/issues/8795 There's a workaround listed there; I successfully got one of my hosts working again with a conntrack -F.

  • Adding the workaround would improve this answer. Links can and do break and that makes the answer less useful
    – Dave M
    Jan 5, 2015 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .