Shorewall+Docker: Two Great Tastes That Taste Great Together

News and Events Blog
4

Apologies for the thread necromancy, but since this was what got my own swarm services working with shorewall, someone else may find these additional notes handy.

The above scripts may or may not work as expected for your needs, and that’s because you when run iptables -S it gives you the rules back in an append format. If your shorewall rules are fairly aggressive like mine, a simple append means you’ll likely get a DROP long before you reach any of the Docker-specific iptables chains.

Here are my modifications to prepend the rules instead:

Here are /etc/shorewall/{init,stop}:

rules=/etc/shorewall/.docker_rules
if iptables -t nat -L DOCKER >/dev/null 2>&1; then
    echo '*nat' > $rules
    iptables -t nat -S | grep -i docker > $rules.nat
    grep '^-N' $rules.nat >> $rules
    tac $rules.nat | sed -n 's/^-A \([^ ]\+\) /-I \1 1 /p' >> $rules
    rm -f $rules.nat
    echo 'COMMIT' >> $rules

    echo '*filter' >> $rules
    iptables -t filter -S | grep -i docker > $rules.filter
    grep '^-N' $rules.filter >> $rules
    tac $rules.filter | sed -n 's/^-A \([^ ]\+\) /-I \1 1 /p' >> $rules
    rm -f $rules.filter
    echo 'COMMIT' >> $rules
fi

And here is /etc/shorewall/start:

rules=/etc/shorewall/.docker_rules
if [ -f $rules ]; then
    iptables-restore -n < $rules
    rm -f $rules
fi