Docker overriding iptables rules, in my case. I was using somebody else's project distributed via docker-compose config, which made the port for elasticsearch public, which I was not aware of (I don't normally use docker or elasticsearch). Luckily I was able to regenerate the data stored in elasticsearch, though I had to do it twice because it got wiped again after regeneration and then I had to google what the hell is going on.