lukasnellen/00-docker-shorewall.md

## 00-docker-shorewall.md

      
    Raw
  

              00-docker-shorewall.md
            
          
    Docker(-compose) with shorewall

The shorewall documentation explains in http://shorewall.org/Docker.html how to configure shorewall for use with docker. The problem with the configuration is that it only allows connections from the host to the main bridge docker0. Connections to other networks on dynamically created bridges, with names starting by default with br-, is blocked. Instead of the recommended contents of /etc/shorewall/interfaces, use wild-card interface names as follows:
#ZONE	INTERFACE	OPTIONS
#dock	docker0		bridge     # disabled default recommendation
dock 	docker0		physical=docker+,routeback=1
dock 	br		physical=br-+,routeback=1

This declares interfaces with names starting with docker, including the default docker0, and starting with br- to be in the dock zone.
For the rest of the configuration, follow the shorewall documentation as is.
This setup fixes problems running composite apps set up manually or using docker-compose.

  
## interfaces
###############################################################################
?FORMAT 2
###############################################################################
#ZONE   INTERFACE       OPTIONS
net     eth0            dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0
#dock   docker0         bridge
dock    docker0         physical=docker+,routeback=1
dock    br              physical=br-+,routeback=1
# and others ...

## policy
###############################################################################
#SOURCE         DEST            POLICY          LOG LEVEL       LIMIT:BURST

$FW             net             ACCEPT

dock            $FW             REJECT
dock            all             ACCEPT
# Some applications or use case require uncommenting the next line
$FW             dock            ACCEPT

# THE FOLLOWING POLICY MUST BE LAST
all             all             REJECT          info

## shorewall.conf
# apply the change below, as

# ...

# LN:
#DOCKER=No
DOCKER=Yes

# ...

## zones
###############################################################################
#ZONE   TYPE    OPTIONS                 IN                      OUT
#                                       OPTIONS                 OPTIONS
fw      firewall
dock    ipv4
# and others ...
	###############################################################################
	?FORMAT 2
	###############################################################################
	#ZONE INTERFACE OPTIONS
	net eth0 dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0
	#dock docker0 bridge
	dock docker0 physical=docker+,routeback=1
	dock br physical=br-+,routeback=1
	# and others ...
	###############################################################################
	#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST

	$FW net ACCEPT

	dock $FW REJECT
	dock all ACCEPT
	# Some applications or use case require uncommenting the next line
	$FW dock ACCEPT

	# THE FOLLOWING POLICY MUST BE LAST
	all all REJECT info
	# apply the change below, as

	# ...

	# LN:
	#DOCKER=No
	DOCKER=Yes

	# ...
	###############################################################################
	#ZONE TYPE OPTIONS IN OUT
	# OPTIONS OPTIONS
	fw firewall
	dock ipv4
	# and others ...