The shorewall documentation explains in http://shorewall.org/Docker.html how to configure shorewall for use with docker. The problem with the configuration is that it only allows connections from the host to the main bridge docker0
. Connections to other networks on dynamically created bridges, with names starting by default with br-
, is blocked. Instead of the recommended contents of /etc/shorewall/interfaces
, use wild-card interface names as follows:
#ZONE INTERFACE OPTIONS
#dock docker0 bridge # disabled default recommendation
dock docker0 physical=docker+,routeback=1
dock br physical=br-+,routeback=1
This declares interfaces with names starting with docker
, including the default docker0
, and starting with br-
to be in the dock
zone.
For the rest of the configuration, follow the shorewall documentation as is.
This setup fixes problems running composite apps set up manually or using docker-compose
.
In practice, the problem is that restarting docker restarts all running containers. This makes frequent changes (or trying changes) on a production machine difficult. This is not a problem for my setup here, where changes are limited (and I have a non-production machine for trying out things). This meant I never had to look into the use of
shorewall open
andshorewall close
as means of run-time modification of shorewall's configuration (more in a comment higher up).