@@ -223,7 +223,7 @@ func New(ctx context.Context, cfgOptions ...config.Option) (_ *Controller, retEr

 		return nil, err

 	}

-	c.setupUserChains()

+	c.setupPlatformFirewall()

 	return c, nil

 }

@@ -4,6 +4,7 @@ import (

 	"context"

 	"errors"

 	"fmt"

+	"net"

 	"github.com/containerd/log"

 	"github.com/docker/docker/daemon/libnetwork/internal/nftables"

@@ -27,6 +28,12 @@ func (c *Controller) selectFirewallBackend() error {

 	return nil

 }

+func (c *Controller) setupPlatformFirewall() {

+	c.setupUserChains()

+	// Add handler for iptables rules restoration in case of a firewalld reload

+	c.handleFirewalldReload()

+}

+

 // Sets up the DOCKER-USER chain for each iptables version (IPv4, IPv6) that's

 // enabled in the controller's configuration.

 func (c *Controller) setupUserChains() {

@@ -71,3 +78,56 @@ func setupUserChain(ipVersion iptables.IPVersion) error {

 	}

 	return nil

 }

+

+func (c *Controller) handleFirewalldReload() {

+	handler := func() {

+		services := make(map[serviceKey]*service)

+

+		c.mu.Lock()

+		for k, s := range c.serviceBindings {

+			if k.ports != "" && len(s.ingressPorts) != 0 {

+				services[k] = s

+			}

+		}

+		c.mu.Unlock()

+

+		for _, s := range services {

+			c.handleFirewallReloadService(s)

+		}

+	}

+	// Add handler for iptables rules restoration in case of a firewalld reload

+	iptables.OnReloaded(handler)

+}

+

+func (c *Controller) handleFirewallReloadService(s *service) {

+	s.Lock()

+	defer s.Unlock()

+	if s.deleted {

+		log.G(context.TODO()).Debugf("handleFirewallReloadService called for deleted service %s/%s", s.id, s.name)

+		return

+	}

+	for nid := range s.loadBalancers {

+		n, err := c.NetworkByID(nid)

+		if err != nil {

+			continue

+		}

+		ep, sb, err := n.findLBEndpointSandbox()

+		if err != nil {

+			log.G(context.TODO()).Warnf("handleFirewallReloadService failed to find LB Endpoint Sandbox for %s/%s: %v -- ", n.ID(), n.Name(), err)

+			continue

+		}

+		if sb.osSbox == nil {

+			return

+		}

+		if ep != nil {

+			var gwIP net.IP

+			if gwEP, _ := sb.getGatewayEndpoint(); gwEP != nil {

+				gwIP = gwEP.Iface().Address().IP

+			}

+			if err := restoreIngressPorts(gwIP, s.ingressPorts); err != nil {

+				log.G(context.TODO()).Errorf("Failed to add ingress: %v", err)

+				return

+			}

+		}

+	}

+}

@@ -6,4 +6,4 @@ func (c *Controller) selectFirewallBackend() error {

 	return nil

 }

-func (c *Controller) setupUserChains() {}

+func (c *Controller) setupPlatformFirewall() {}

@@ -403,6 +403,24 @@ func addIngressPorts(gwIP net.IP, ingressPorts []*PortConfig) error {

 	return nil

 }

+func restoreIngressPorts(gwIP net.IP, ingressPorts []*PortConfig) error {

+	// TODO IPv6 support

+	iptable := iptables.GetIptable(iptables.IPv4)

+

+	ingressMu.Lock()

+	defer ingressMu.Unlock()

+

+	if err := initIngressConfiguration(gwIP, iptable); err != nil {

+		return err

+	}

+

+	if err := programIngressPortsRules(gwIP, ingressPorts); err != nil {

+		return fmt.Errorf("failed to program ingress ports: %v", err)

+	}

+

+	return nil

+}

+

 func generateIngressRules(port *PortConfig, destIP net.IP) []iptables.Rule {

 	var (

 		protocol      = strings.ToLower(port.Protocol.String())

@@ -267,3 +267,58 @@ func TestDockerIngressChainPosition(t *testing.T) {

 		checkChain()

 	})

 }

+

+func TestRestoreIngressRulesOnFirewalldReload(t *testing.T) {

+	skip.If(t, testEnv.IsRemoteDaemon)

+	skip.If(t, testEnv.IsRootless, "rootless mode doesn't support Swarm-mode")

+	skip.If(t, testEnv.FirewallBackendDriver() != "iptables+firewalld", "nftables backend doesn't support Swarm-mode")

+	skip.If(t, !networking.FirewalldRunning(), "Need firewalld to test restoration ingress rules")

+	ctx := setupTest(t)

+

+	// Check the published port is accessible.

+	checkHTTP := func(_ poll.LogT) poll.Result {

+		res := icmd.RunCommand("curl", "-v", "-o", "/dev/null", "-w", "%{http_code}\n",

+			"http://"+stdnet.JoinHostPort("localhost", "8080"))

+		// A "404 Not Found" means the server responded, but it's got nothing to serve.

+		if !strings.Contains(res.Stdout(), "404") {

+			return poll.Continue("404 - not found in: %s, %+v", res.Stdout(), res)

+		}

+		return poll.Success()

+	}

+

+	d := swarm.NewSwarm(ctx, t, testEnv, daemon.WithSwarmIptables(true))

+	defer d.Stop(t)

+	c := d.NewClientT(t)

+	defer c.Close()

+

+	serviceID := swarm.CreateService(ctx, t, d,

+		swarm.ServiceWithName("test-ingress-on-firewalld-reload"),

+		swarm.ServiceWithCommand([]string{"httpd", "-f"}),

+		swarm.ServiceWithEndpoint(&swarmtypes.EndpointSpec{

+			Ports: []swarmtypes.PortConfig{

+				{

+					Protocol:      "tcp",

+					TargetPort:    80,

+					PublishedPort: 8080,

+					PublishMode:   swarmtypes.PortConfigPublishModeIngress,

+				},

+			},

+		}),

+	)

+	defer func() {

+		err := c.ServiceRemove(ctx, serviceID)

+		assert.NilError(t, err)

+	}()

+

+	t.Log("Waiting for the service to start")

+	poll.WaitOn(t, swarm.RunningTasksCount(ctx, c, serviceID, 1), swarm.ServicePoll)

+	t.Log("Checking http access to the service")

+	poll.WaitOn(t, checkHTTP, poll.WithTimeout(30*time.Second))

+

+	t.Log("Firewalld reload")

+	networking.FirewalldReload(t, d)

+

+	t.Log("Checking http access to the service")

+	// It takes a while before this works ...

+	poll.WaitOn(t, checkHTTP, poll.WithTimeout(30*time.Second))

+}