lxd-docker-firewall-conflict

Adjust iptables FORWARD policy to accept LXD bridge traffic.

3|1|Updated Mar 31, 2026

Search Tags:#Docker #networking #firewall #LXD #iptables

Ready to run

npx skills add https://github.com/soulmachine/skills --skill lxd-docker-firewall-conflict

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: lxd-docker-firewall-conflict
Source: https://github.com/soulmachine/skills/tree/main/lxd-docker-firewall-conflict
Command: npx skills add https://github.com/soulmachine/skills --skill lxd-docker-firewall-conflict

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill diagnoses and resolves the Docker/LXD firewall conflict, enabling LXD containers/VMs to access the internet when running on a host with Docker.

Core Features & Use Cases

Firewall Conflict Resolution: Fix the well-known conflict where Docker's iptables FORWARD chain policy is set to DROP, affecting LXD network traffic.
Automated Fix: Automatically detect managed LXD bridges, add DOCKER-USER ACCEPT rules, and persist them with a systemd unit for reboot stability.
Use Case: If you encounter "Network is unreachable" errors in LXD containers or VMs, this Skill can help by accepting the LXD bridge in Docker's DOCKER-USER chain.

Quick Start

Run the command 'bash scripts/fix-lxd-docker-forward.sh' to apply the fix and restore internet access for LXD containers.

Frequently Asked Questions about lxd-docker-firewall-conflict

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Why do LXD containers lose internet access when running on a Docker host?▼

The conflict occurs because Docker sets the iptables FORWARD chain policy to DROP, which blocks network traffic for LXD bridge interfaces. This prevents LXD containers and VMs from accessing the internet when both systems run on the same host.

How do I fix the Docker LXD iptables FORWARD chain conflict?▼

Run the fix-lxd-docker-forward.sh script to automatically add ACCEPT rules for managed LXD bridges in Docker's DOCKER-USER chain. This adjusts the iptables FORWARD policy and restores internet access for LXD containers.

Does the Docker LXD firewall fix persist across system reboots?▼

Yes, the fix persists across reboots by installing a systemd unit that re-applies the iptables DOCKER-USER ACCEPT rules on startup. This ensures LXD containers maintain network access after system restarts.

Do I need root privileges to resolve Docker and LXD networking conflicts?▼

Yes, root privileges are required to modify iptables configurations and create systemd units for persistence. The environment must be a Docker host with LXD installed and managed bridges configured.

What happens if I do not apply the DOCKER-USER ACCEPT rules for LXD?▼

Without the DOCKER-USER ACCEPT rules, LXD containers and VMs will encounter "Network is unreachable" errors. Docker's default iptables FORWARD DROP policy will continue to block LXD bridge traffic, preventing internet access.