The host port is mapped when docker is running. Does it still need to be opened in iptables?

Question

{Code...} Those numbers 25, 143, and 587 below should be automatically added by docker. Do I still need to open the corresponding port of the host to access it?

学习ing · Answer

It depends on your docker network mode,

If it is bridge mode, the port mapping rule is ip:port:targetPort,
1. For example, 0.0.0.0:80:8080, this situation means that the 80 port of the host machine has a mapping relationship with the 8080 port of the container, and there is no restriction on the IP. At this time, any request for port 80 of the host machine All will be forwarded to port 8080 in the container, no additional iptables settings are required. (This is possible even if the firewall does not open port 80 in advance. Because port mapping will modify the iptables rules by itself).
2. If the IP address is explicitly specified, the iptables rule will limit that only port 80 of the IP can be accessed to port 8080 in the container. Docker port mapping is actually network interoperability achieved by modifying iptables rules.
If it is net mode, it is the same as setting up a port listening on the host. There will be no additional changes to iptables rules. At this time, you need to manually set iptables to allow external access;