Shorewall+Docker: Two Great Tastes That Taste Great Together

announcements blog
1

As has been mentioned previously, we lurve us some Docker here at Discourse. We also lurve us some security, and I’ve recently been replacing our “artisinally handcrafted iptables firewall rules” with a Shorewall-managed configuration, which plays better with Puppet. Unfortunately, as it stands, like my twin three year olds, they don’t always play well. The…

This topic is for comments on the original blog entry at: http://blog.discourse.org/2015/11/shorewalldocker-two-great-tastes-that-taste-great-together/

8 Likes
2

Big fan of Shorewall, been using it for a looong time.

2 Likes
3

Docker has changed their iptables implementation so that the rules captured and replaced are no longer complete.

As a suggestion the revisions posted below should correct the issue and be more tolerant of future changes

/etc/shorewall/init and /etc/shorewall/stop should become

if iptables -t nat -L DOCKER >/dev/null 2>&1; then
    echo '*nat' > /etc/shorewall/docker_rules
    iptables -t nat -S | grep -i docker >> /etc/shorewall/docker_rules
    echo 'COMMIT' >> /etc/shorewall/docker_rules

    echo '*filter' >> /etc/shorewall/docker_rules
    iptables -t filter -S | grep -i docker >> /etc/shorewall/docker_rules
    echo 'COMMIT' >> /etc/shorewall/docker_rules
fi

and /etc/shorewall/start should be

if [ -f /etc/shorewall/docker_rules ]; then
    iptables-restore -n < /etc/shorewall/docker_rules

    rm -f /etc/shorewall/docker_rules
fi
4 Likes
4

Apologies for the thread necromancy, but since this was what got my own swarm services working with shorewall, someone else may find these additional notes handy.

The above scripts may or may not work as expected for your needs, and that’s because you when run iptables -S it gives you the rules back in an append format. If your shorewall rules are fairly aggressive like mine, a simple append means you’ll likely get a DROP long before you reach any of the Docker-specific iptables chains.

Here are my modifications to prepend the rules instead:

Here are /etc/shorewall/{init,stop}:

rules=/etc/shorewall/.docker_rules
if iptables -t nat -L DOCKER >/dev/null 2>&1; then
    echo '*nat' > $rules
    iptables -t nat -S | grep -i docker > $rules.nat
    grep '^-N' $rules.nat >> $rules
    tac $rules.nat | sed -n 's/^-A \([^ ]\+\) /-I \1 1 /p' >> $rules
    rm -f $rules.nat
    echo 'COMMIT' >> $rules

    echo '*filter' >> $rules
    iptables -t filter -S | grep -i docker > $rules.filter
    grep '^-N' $rules.filter >> $rules
    tac $rules.filter | sed -n 's/^-A \([^ ]\+\) /-I \1 1 /p' >> $rules
    rm -f $rules.filter
    echo 'COMMIT' >> $rules
fi

And here is /etc/shorewall/start:

rules=/etc/shorewall/.docker_rules
if [ -f $rules ]; then
    iptables-restore -n < $rules
    rm -f $rules
fi