更新不了ip组，也不能添加在线订阅

日志

ping不通网关和百度，但能ping通宿主机

1/ # ip a
21: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
3    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
4    inet 127.0.0.1/8 scope host lo
5       valid_lft forever preferred_lft forever
6    inet6 ::1/128 scope host 
7       valid_lft forever preferred_lft forever
82: eth0@if136: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP 
9    link/ether ca:db:23:21:1f:a6 brd ff:ff:ff:ff:ff:ff
10    inet 172.22.222.4/24 brd 172.22.222.255 scope global eth0
11       valid_lft forever preferred_lft forever
12/ # ping 192.168.8.1
13PING 192.168.8.1 (192.168.8.1): 56 data bytes
14^C
15--- 192.168.8.1 ping statistics ---
1620 packets transmitted, 0 packets received, 100% packet loss
17/ # ping 192.168.8.60
18PING 192.168.8.60 (192.168.8.60): 56 data bytes
1964 bytes from 192.168.8.60: seq=0 ttl=64 time=0.054 ms
2064 bytes from 192.168.8.60: seq=1 ttl=64 time=0.128 ms
21^C
22--- 192.168.8.60 ping statistics ---
232 packets transmitted, 2 packets received, 0% packet loss
24round-trip min/avg/max = 0.054/0.091/0.128 ms
25/ # ping www.baidu.com
26PING www.baidu.com (183.2.172.17): 56 data bytes
27^C
28--- www.baidu.com ping statistics ---
292 packets transmitted, 0 packets received, 100% packet loss
30/ # ip route
31default via 172.22.222.1 dev eth0 
32172.22.222.0/24 dev eth0 scope link  src 172.22.222.4 
33/ # 

如mgt容器日志图所示，waf需要与该网址成功通信才可以在线订阅

iptables放行后解决

1iptables -I DOCKER-USER -i safeline-ce -o vmbr0 -j ACCEPT
2iptables -I DOCKER-USER -i vmbr0 -o safeline-ce -m state --state RELATED,ESTABLISHED -j ACCEPT
3apt install install iptables-persistent
4netfilter-persistent save