Bug: Firewall installation fails with Docker due to incorrect iptables-save deduplication

Environment

• Hiddify Manager: 14.0.5
• OS: Ubuntu 22.04 LTS
• Docker: 28.0.4
• iptables: 1.8.7 (nf_tables)
• Installation: Native Hiddify Manager installation, with Docker running on the same host

Problem

When installing, upgrading, or applying configurations in Hiddify Manager, the Firewall step fails with exit code 2.

The error occurs when Docker is installed and its DOCKER chain exists in multiple iptables tables.

Error logs

ip6tables-restore v1.8.7 (nf_tables):
Chain 'DOCKER' does not exist
Error occurred at line: 93

iptables-restore v1.8.7 (nf_tables):
Chain 'DOCKER' does not exist
Error occurred at line: 136

services/firewall failed (exit code 2)
These steps reported an error: Firewall
Finished with errors in: Firewall

Root cause

The issue is located in:

services/firewall/utils.sh

Specifically, the save_firewall() function uses the following commands:

iptables-save | awk '/^(\*|COMMIT)/ || !seen[$0]++' >/etc/iptables/rules.v4

ip6tables-save | awk '/^(\*|COMMIT)/ || !seen[$0]++' >/etc/iptables/rules.v6

The AWK deduplication logic maintains a single seen array across all iptables tables.

However, chain definitions with identical names can legitimately appear in different tables.

For example:

*filter
:DOCKER - [0:0]
...
COMMIT

*nat
:DOCKER - [0:0]
...
COMMIT

The current implementation incorrectly considers the second :DOCKER - [0:0] declaration a duplicate and removes it.

As a result, the nat table references the DOCKER chain without defining it, causing iptables-restore and ip6tables-restore to fail.

Proposed fix

Reset the AWK seen array whenever a new iptables table begins.

Replace:

awk '/^(\*|COMMIT)/ || !seen[$0]++'

With:

awk '/^\*/ {delete seen; print; next} /^COMMIT$/ {print; next} !seen[$0]++'

The resulting save_firewall() function becomes:

function save_firewall() {
    mkdir -p /etc/iptables/

    iptables-save |
        awk '/^\*/ {delete seen; print; next} /^COMMIT$/ {print; next} !seen[$0]++' \
        >/etc/iptables/rules.v4

    if has_ipv6; then
        ip6tables-save |
            awk '/^\*/ {delete seen; print; next} /^COMMIT$/ {print; next} !seen[$0]++' \
            >/etc/iptables/rules.v6

        ip6tables-restore </etc/iptables/rules.v6
    fi

    iptables-restore </etc/iptables/rules.v4
}

Testing and verification

After applying this modification:

1. bash -n completed successfully.
2. iptables-restore --test passed.
3. ip6tables-restore --test passed.
4. services/firewall/run.sh executed successfully.
5. The Firewall script returned exit code 0.
6. The original missing DOCKER chain errors disappeared.

The Firewall script was executed twice successfully after the fix.

Additional issue: Fix overwritten during updates

The issue returns when Hiddify Manager downloads and installs its configuration package again.

The update_from_github() function in:

scripts/common/hiddify_installer.sh

uses:

rsync -a "$work/tree/" /opt/hiddify-manager/

This replaces the locally patched services/firewall/utils.sh with the original buggy implementation.

The installer then immediately executes:

bash "$install_script" --no-gui --no-log

Consequently, the same Firewall failure can recur during the update process.

Expected behavior

• Firewall rules should be preserved independently for each iptables table.
• Docker's DOCKER chains should remain valid in both filter and nat.
• Installing or applying configurations should not fail because of valid Docker chains.
• The fix should be included in the distributed Hiddify Manager package so updates do not reintroduce the issue.

Actual behavior

The current deduplication logic incorrectly removes valid chain definitions across different tables, causing Firewall installation failures.

Suggested action

Please update the save_firewall() implementation in the source repository and include the fix in the next release.

I have reproduced the issue and verified the proposed modification on an Ubuntu 22.04 server running Docker 28.0.4 and Hiddify Manager 14.0.5.

Thank you.