Home » Error: iptables failed: No chain/target/match by that name in Docker
Systems & Servers

Error: iptables failed: No chain/target/match by that name in Docker

Read time: 3 min Updated: 2026-08-23
✨ Quick Answer

The error iptables failed: iptables --wait -t nat -A DOCKER ... No chain/target/match by that name occurs when the Linux firewall daemon (UFW, Firewalld, or raw iptables) is reloaded while the Docker daemon is running, flushing the active DOCKER and DOCKER-USER routing chains from the kernel NAT table.

The error iptables failed: iptables --wait -t nat -A DOCKER ... No chain/target/match by that name occurs when the Linux firewall daemon (UFW, Firewalld, or raw iptables) is reloaded while the Docker daemon is running, flushing the active DOCKER and DOCKER-USER routing chains from the kernel NAT table.

When attempting to bind ports for a new container (-p 8080:80), Docker fails immediately because the required packet routing chains no longer exist.

Quick Diagnostics

Cause
UFW or Firewalld reloaded after Docker started
Solution
Restart the Docker service with sudo systemctl restart docker
Cause
Mismatch between iptables-legacy and nftables
Solution
Switch active alternative with sudo update-alternatives --config iptables
Cause
Missing kernel NAT routing modules
Solution
Manually load modules using sudo modprobe ip_tables && sudo modprobe iptable_nat

Step-by-Step Solution

Restart Docker daemon to restore NAT chains The most effective and immediate fix is restarting the Docker service so it can re-inject its network filtering rules:

BASH 
sudo systemctl restart docker

Verify container launch:

BASH 
docker compose up -d

Order UFW and Docker service restarts If you frequently manage firewall rules with UFW on Ubuntu/Debian, always reload Docker immediately after modifying UFW:

BASH 
sudo ufw reload && sudo systemctl restart docker

Check iptables backend configuration On modern Linux distributions (Debian 12+, Ubuntu 24.04, RHEL 9), verify that iptables points to the consistent iptables-nft or iptables-legacy binary:

BASH 
sudo update-alternatives --config iptables

Select the default option aligned with your distro standard.

Load essential Linux networking kernel modules If running inside a cloud VPS or unprivileged Proxmox LXC container:

BASH 
sudo modprobe ip_tables
sudo modprobe iptable_nat
sudo modprobe iptable_filter

Prevention Advice

Recommended security practices:

  • Use DOCKER-USER chain: Never insert custom iptables rules directly into the DOCKER chain. Always place custom ingress restrictions inside DOCKER-USER.
  • Reverse proxy architecture: Consider exposing only standard 80/443 ports via a dedicated reverse proxy (Nginx, Traefik, Caddy) rather than publishing dozens of arbitrary port bindings directly.