---
title: The Docker daemon should be allowed to configure the firewall rules
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The Docker daemon should be allowed to
  configure the firewall rules
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The Docker daemon should be allowed to configure the firewall rules
Classification:complianceFramework:cis-dockerControl:2.4 
## Description{% #description %}

Docker should manage the iptables rules of its networks.

## Rationale{% #rationale %}

Docker writes the iptables rules that its container networking and published ports need. With iptables management off, the administrator must write those rules by hand, and a mistake can expose containers or break their networking.

## Audit{% #audit %}

Look for iptables on the dockerd command line and in `daemon.json`:

```bash
ps -o args= -C dockerd
grep '"iptables"' /etc/docker/daemon.json
```

Datadog reads `--iptables` on the dockerd command line or, if it isn't set there, `iptables` in `daemon.json`. It passes the rule when the setting is true or unset, and fails it when it is false.

## Remediation{% #remediation %}

Remove `--iptables=false` from the dockerd command line and `"iptables": false` from `daemon.json`. Then restart the daemon with `systemctl restart docker`.

## Impact{% #impact %}

None.

## Default value{% #default-value %}

Docker manages iptables.

## References{% #references %}

1. [https://docs.docker.com/reference/cli/dockerd/](https://docs.docker.com/reference/cli/dockerd/)
1. [https://docs.docker.com/engine/network/packet-filtering-firewalls/](https://docs.docker.com/engine/network/packet-filtering-firewalls/)