# Shorewall+Docker: Two Great Tastes That Taste Great Together
**URL:** https://meta.discourse.org/t/shorewall-docker-two-great-tastes-that-taste-great-together/35966
**Category:** Blog
**Created:** [November 24, 2015, 3:22am UTC](https://meta.discourse.org/t/shorewall-docker-two-great-tastes-that-taste-great-together/35966 "2015-11-24T03:22:51Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [November 24, 2015, 3:22am UTC](https://meta.discourse.org/t/shorewall-docker-two-great-tastes-that-taste-great-together/35966/1 "2015-11-24T03:22:51Z")
As has been mentioned previously, we lurve us some Docker here at Discourse. We also lurve us some security, and I’ve recently been replacing our “artisinally handcrafted iptables firewall rules” with a Shorewall-managed configuration, which plays better with Puppet. Unfortunately, as it stands, like my twin three year olds, they don’t always play well. The…
* * *
This topic is for comments on the original blog entry at: [Shorewall+Docker: Two Great Tastes That Taste Great Together](http://blog.discourse.org/2015/11/shorewalldocker-two-great-tastes-that-taste-great-together/)
---
### Author:  [@kpfleming](https://meta.discourse.org/u/kpfleming)
#### Post date: [November 25, 2015, 6:44pm UTC](https://meta.discourse.org/t/shorewall-docker-two-great-tastes-that-taste-great-together/35966/2 "2015-11-25T18:44:03Z")
Big fan of Shorewall, been using it for a looong time.
---
### Author:  [@John\_Davidson](https://meta.discourse.org/u/John_Davidson)
#### Post date: [April 21, 2016, 1:45pm UTC](https://meta.discourse.org/t/shorewall-docker-two-great-tastes-that-taste-great-together/35966/3 "2016-04-21T13:45:48Z")
Docker has changed their iptables implementation so that the rules captured and replaced are no longer complete.
As a suggestion the revisions posted below should correct the issue and be more tolerant of future changes
`/etc/shorewall/init` and `/etc/shorewall/stop` should become
```
if iptables -t nat -L DOCKER >/dev/null 2>&1; then
echo '*nat' > /etc/shorewall/docker_rules
iptables -t nat -S | grep -i docker >> /etc/shorewall/docker_rules
echo 'COMMIT' >> /etc/shorewall/docker_rules
echo '*filter' >> /etc/shorewall/docker_rules
iptables -t filter -S | grep -i docker >> /etc/shorewall/docker_rules
echo 'COMMIT' >> /etc/shorewall/docker_rules
fi
```
and `/etc/shorewall/start` should be
```
if [-f /etc/shorewall/docker_rules]; then
iptables-restore -n < /etc/shorewall/docker_rules
rm -f /etc/shorewall/docker_rules
fi
```
---
### Author:  [@jdeyton](https://meta.discourse.org/u/jdeyton)
#### Post date: [December 19, 2020, 7:47am UTC](https://meta.discourse.org/t/shorewall-docker-two-great-tastes-that-taste-great-together/35966/4 "2020-12-19T07:47:17Z")
Apologies for the thread necromancy, but since this was what got my own swarm services working with shorewall, someone else may find these additional notes handy.
The above scripts may or may not work as expected for your needs, and that’s because you when run `iptables -S` it gives you the rules back in an _append_ format. If your shorewall rules are fairly aggressive like mine, a simple append means you’ll likely get a DROP long before you reach any of the Docker-specific iptables chains.
Here are my modifications to _prepend_ the rules instead:
Here are `/etc/shorewall/{init,stop}`:
```plaintext
rules=/etc/shorewall/.docker_rules
if iptables -t nat -L DOCKER >/dev/null 2>&1; then
echo '*nat' > $rules
iptables -t nat -S | grep -i docker > $rules.nat
grep '^-N' $rules.nat >> $rules
tac $rules.nat | sed -n 's/^-A \([^]\+\) /-I \1 1 /p' >> $rules
rm -f $rules.nat
echo 'COMMIT' >> $rules
echo '*filter' >> $rules
iptables -t filter -S | grep -i docker > $rules.filter
grep '^-N' $rules.filter >> $rules
tac $rules.filter | sed -n 's/^-A \([^]\+\) /-I \1 1 /p' >> $rules
rm -f $rules.filter
echo 'COMMIT' >> $rules
fi
```
And here is `/etc/shorewall/start`:
```plaintext
rules=/etc/shorewall/.docker_rules
if [-f $rules]; then
iptables-restore -n < $rules
rm -f $rules
fi
```
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 12, 2025, 3:06pm UTC](https://meta.discourse.org/t/shorewall-docker-two-great-tastes-that-taste-great-together/35966/5 "2025-05-12T15:06:33Z")