Rke: Failed to start [rke-etcd-port-listener]

[hyahm]

version info
rancher version: v2.2.5

[root@vultr ~]# iptables -F
[root@vultr ~]# iptables -X
[root@vultr ~]# docker version
Client:
 Version:         1.13.1
 API version:     1.26
 Package version: docker-1.13.1-96.gitb2f74b2.el7.centos.x86_64
 Go version:      go1.10.3
 Git commit:      b2f74b2/1.13.1
 Built:           Wed May  1 14:55:20 2019
 OS/Arch:         linux/amd64

Server:
 Version:         1.13.1
 API version:     1.26 (minimum version 1.12)
 Package version: docker-1.13.1-96.gitb2f74b2.el7.centos.x86_64
 Go version:      go1.10.3
 Git commit:      b2f74b2/1.13.1
 Built:           Wed May  1 14:55:20 2019
 OS/Arch:         linux/amd64
 Experimental:    false
[root@vultr ~]# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)

add a new custom cluster

Kubernetes Version : v1.14.3-rancher1-1
Network : flannel

next
run as root

 docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:v2.2.5 --server https://reg.hyahm.com:10443 --token 9xphpbpnbg7nkznhsmk5hqr648rtlnfhhfbqsp7dnpxd9h9pbkb65w --etcd --controlplane --worker

in UI

[Failed to start [rke-etcd-port-listener] container on host [207.148.102.239]: Error response from daemon: driver failed programming external connectivity on endpoint rke-etcd-port-listener (07d9c1502eafaff6f40714d8a0dfa872555b50a435e42088fccded4ea20a6cdd): (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 2380 -j DNAT --to-destination 172.17.0.2:1337 ! -i docker0: iptables: No chain/target/match by that name. (exit status 1))]

if possible i can give you server

[superseb]

This is usually resolved by restarting Docker to make sure the chain exists. It creates it on start, if its removed in the mean time, it usually means something on the system is changing iptables (firewalld for instance)

Nevermind, I see you are flushing iptables manually. Don't do that or restart Docker.

[hyahm]

how to make sure the chain exists?

[hyahm]

yes, restart Docker