Shorewall+Docker: Two Great Tastes That Taste Great Together

News and Events Blog

AI-generated summary

The discussion revolves around integrating Shorewall with Docker, as both assume exclusive control over the firewall configuration. codinghorror shares a solution using Shorewall’s extension scripts to save and restore Docker-related firewall rules, ensuring both systems coexist.

kpfleming expresses appreciation for Shorewall, while John_Davidson suggests updating the initial solution to address Docker’s changed iptables implementation. jdeyton provides further modifications to prepend rules instead of appending, making the solution more compatible with aggressive Shorewall rules.

By implementing these scripts and adjustments, users can successfully integrate Shorewall and Docker, maintaining both their firewall configurations and Docker’s port forwarding system.

1

As has been mentioned previously, we lurve us some Docker here at Discourse. We also lurve us some security, and I’ve recently been replacing our “artisinally handcrafted iptables firewall rules” with a Shorewall-managed configuration, which plays better with Puppet. Unfortunately, as it stands, like my twin three year olds, they don’t always play well. The…

This topic is for comments on the original blog entry at: Shorewall+Docker: Two Great Tastes That Taste Great Together

8 Likes
2

Big fan of Shorewall, been using it for a looong time.

2 Likes
3

Docker has changed their iptables implementation so that the rules captured and replaced are no longer complete.

As a suggestion the revisions posted below should correct the issue and be more tolerant of future changes

/etc/shorewall/init and /etc/shorewall/stop should become

if iptables -t nat -L DOCKER >/dev/null 2>&1; then
    echo '*nat' > /etc/shorewall/docker_rules
    iptables -t nat -S | grep -i docker >> /etc/shorewall/docker_rules
    echo 'COMMIT' >> /etc/shorewall/docker_rules

    echo '*filter' >> /etc/shorewall/docker_rules
    iptables -t filter -S | grep -i docker >> /etc/shorewall/docker_rules
    echo 'COMMIT' >> /etc/shorewall/docker_rules
fi

and /etc/shorewall/start should be

if [ -f /etc/shorewall/docker_rules ]; then
    iptables-restore -n < /etc/shorewall/docker_rules

    rm -f /etc/shorewall/docker_rules
fi
4 Likes
4

Apologies for the thread necromancy, but since this was what got my own swarm services working with shorewall, someone else may find these additional notes handy.

The above scripts may or may not work as expected for your needs, and that’s because you when run iptables -S it gives you the rules back in an append format. If your shorewall rules are fairly aggressive like mine, a simple append means you’ll likely get a DROP long before you reach any of the Docker-specific iptables chains.

Here are my modifications to prepend the rules instead:

Here are /etc/shorewall/{init,stop}:

rules=/etc/shorewall/.docker_rules
if iptables -t nat -L DOCKER >/dev/null 2>&1; then
    echo '*nat' > $rules
    iptables -t nat -S | grep -i docker > $rules.nat
    grep '^-N' $rules.nat >> $rules
    tac $rules.nat | sed -n 's/^-A \([^ ]\+\) /-I \1 1 /p' >> $rules
    rm -f $rules.nat
    echo 'COMMIT' >> $rules

    echo '*filter' >> $rules
    iptables -t filter -S | grep -i docker > $rules.filter
    grep '^-N' $rules.filter >> $rules
    tac $rules.filter | sed -n 's/^-A \([^ ]\+\) /-I \1 1 /p' >> $rules
    rm -f $rules.filter
    echo 'COMMIT' >> $rules
fi

And here is /etc/shorewall/start:

rules=/etc/shorewall/.docker_rules
if [ -f $rules ]; then
    iptables-restore -n < $rules
    rm -f $rules
fi