-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request moby#48640 from robmry/iptables-static-forward-rules
Create static iptables rules during bridge driver init
- Loading branch information
Showing
42 changed files
with
590 additions
and
264 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
148 changes: 148 additions & 0 deletions
148
integration/network/bridge/iptablesdoc/generated/swarm-portmap.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,148 @@ | ||
| ## Swarm service, with a published port | ||
|
|
||
| Equivalent to: | ||
|
|
||
| docker service create -p 8080:80 busybox top | ||
|
|
||
| The filter table is: | ||
|
|
||
| Chain INPUT (policy ACCEPT 0 packets, 0 bytes) | ||
| num pkts bytes target prot opt in out source destination | ||
|
|
||
| Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 DOCKER-USER 0 -- * * 0.0.0.0/0 0.0.0.0/0 | ||
| 2 0 0 DOCKER-INGRESS 0 -- * * 0.0.0.0/0 0.0.0.0/0 | ||
| 3 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED | ||
| 4 0 0 DOCKER-ISOLATION-STAGE-1 0 -- * * 0.0.0.0/0 0.0.0.0/0 | ||
| 5 0 0 DOCKER 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst | ||
| 6 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0 | ||
| 7 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0 | ||
| 8 0 0 DROP 0 -- docker_gwbridge docker_gwbridge 0.0.0.0/0 0.0.0.0/0 | ||
| 9 0 0 ACCEPT 0 -- docker_gwbridge !docker_gwbridge 0.0.0.0/0 0.0.0.0/0 | ||
|
|
||
| Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) | ||
| num pkts bytes target prot opt in out source destination | ||
|
|
||
| Chain DOCKER (1 references) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 DROP 0 -- !docker0 docker0 0.0.0.0/0 0.0.0.0/0 | ||
| 2 0 0 DROP 0 -- !docker_gwbridge docker_gwbridge 0.0.0.0/0 0.0.0.0/0 | ||
|
|
||
| Chain DOCKER-INGRESS (1 references) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 ACCEPT 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 | ||
| 2 0 0 ACCEPT 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:8080 ctstate RELATED,ESTABLISHED | ||
| 3 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0 | ||
|
|
||
| Chain DOCKER-ISOLATION-STAGE-1 (1 references) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 DOCKER-ISOLATION-STAGE-2 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0 | ||
| 2 0 0 DOCKER-ISOLATION-STAGE-2 0 -- docker_gwbridge !docker_gwbridge 0.0.0.0/0 0.0.0.0/0 | ||
|
|
||
| Chain DOCKER-ISOLATION-STAGE-2 (2 references) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 DROP 0 -- * docker_gwbridge 0.0.0.0/0 0.0.0.0/0 | ||
| 2 0 0 DROP 0 -- * docker0 0.0.0.0/0 0.0.0.0/0 | ||
|
|
||
| Chain DOCKER-USER (1 references) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0 | ||
|
|
||
|
|
||
| <details> | ||
| <summary>iptables commands</summary> | ||
|
|
||
| -P INPUT ACCEPT | ||
| -P FORWARD ACCEPT | ||
| -P OUTPUT ACCEPT | ||
| -N DOCKER | ||
| -N DOCKER-INGRESS | ||
| -N DOCKER-ISOLATION-STAGE-1 | ||
| -N DOCKER-ISOLATION-STAGE-2 | ||
| -N DOCKER-USER | ||
| -A FORWARD -j DOCKER-USER | ||
| -A FORWARD -j DOCKER-INGRESS | ||
| -A FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT | ||
| -A FORWARD -j DOCKER-ISOLATION-STAGE-1 | ||
| -A FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER | ||
| -A FORWARD -i docker0 -o docker0 -j ACCEPT | ||
| -A FORWARD -i docker0 ! -o docker0 -j ACCEPT | ||
| -A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP | ||
| -A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT | ||
| -A DOCKER ! -i docker0 -o docker0 -j DROP | ||
| -A DOCKER ! -i docker_gwbridge -o docker_gwbridge -j DROP | ||
| -A DOCKER-INGRESS -p tcp -m tcp --dport 8080 -j ACCEPT | ||
| -A DOCKER-INGRESS -p tcp -m tcp --sport 8080 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT | ||
| -A DOCKER-INGRESS -j RETURN | ||
| -A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2 | ||
| -A DOCKER-ISOLATION-STAGE-1 -i docker_gwbridge ! -o docker_gwbridge -j DOCKER-ISOLATION-STAGE-2 | ||
| -A DOCKER-ISOLATION-STAGE-2 -o docker_gwbridge -j DROP | ||
| -A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP | ||
| -A DOCKER-USER -j RETURN | ||
|
|
||
|
|
||
| </details> | ||
|
|
||
| Note that: | ||
|
|
||
| - There's a bridge network called `docker_gwbridge` for swarm ingress. | ||
| - Its rules follow the usual pattern for a network with inter-container communication disabled. | ||
| - There's an additional chain `DOCKER-INGRESS`. | ||
| - The jump to `DOCKER-INGRESS` is in the `FORWARD` chain, after the jump to `DOCKER-USER`. | ||
|
|
||
| And the corresponding nat table: | ||
|
|
||
| Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 DOCKER-INGRESS 0 -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL | ||
| 2 0 0 DOCKER 0 -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL | ||
|
|
||
| Chain INPUT (policy ACCEPT 0 packets, 0 bytes) | ||
| num pkts bytes target prot opt in out source destination | ||
|
|
||
| Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 DOCKER-INGRESS 0 -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL | ||
| 2 0 0 DOCKER 0 -- * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL | ||
|
|
||
| Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 MASQUERADE 0 -- * docker_gwbridge 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match src-type LOCAL | ||
| 2 0 0 MASQUERADE 0 -- * !docker_gwbridge 172.18.0.0/16 0.0.0.0/0 | ||
| 3 0 0 MASQUERADE 0 -- * !docker0 172.17.0.0/16 0.0.0.0/0 | ||
|
|
||
| Chain DOCKER (2 references) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 RETURN 0 -- docker_gwbridge * 0.0.0.0/0 0.0.0.0/0 | ||
| 2 0 0 RETURN 0 -- docker0 * 0.0.0.0/0 0.0.0.0/0 | ||
|
|
||
| Chain DOCKER-INGRESS (2 references) | ||
| num pkts bytes target prot opt in out source destination | ||
| 1 0 0 DNAT 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 to:172.18.0.2:8080 | ||
| 2 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0 | ||
|
|
||
|
|
||
| <details> | ||
| <summary>iptables commands</summary> | ||
|
|
||
| -P PREROUTING ACCEPT | ||
| -P INPUT ACCEPT | ||
| -P OUTPUT ACCEPT | ||
| -P POSTROUTING ACCEPT | ||
| -N DOCKER | ||
| -N DOCKER-INGRESS | ||
| -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER-INGRESS | ||
| -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER | ||
| -A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER-INGRESS | ||
| -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER | ||
| -A POSTROUTING -o docker_gwbridge -m addrtype --src-type LOCAL -j MASQUERADE | ||
| -A POSTROUTING -s 172.18.0.0/16 ! -o docker_gwbridge -j MASQUERADE | ||
| -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE | ||
| -A DOCKER -i docker_gwbridge -j RETURN | ||
| -A DOCKER -i docker0 -j RETURN | ||
| -A DOCKER-INGRESS -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.18.0.2:8080 | ||
| -A DOCKER-INGRESS -j RETURN | ||
|
|
||
|
|
||
| </details> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.