Firewall

Motivation

Primarily a iptables based firewall script, packaged with the required binaries for environments where iptables-restore is not present.

Inspirations

Articles that inspired this solution

• Docker meet firewall - finally an answer
• Set iptables rules at startup

Usage

Command Line

Assuming the desired file with the output from iptables-restore is located at /etc/iptables/state

docker run \
  --rm \
  --cap-add=NET_ADMIN \
  --net=host \
  -v /etc/iptables:/host/etc/iptables:ro \
  capybara1/firewall:1.0

Cloud-Init (RancherOS)

write_files:
- path: /etc/iptables/state
  permissions: "0400"
  owner: "root:root"
  content: |
    #insert output of iptables-save here
rancher:
  services:
    firewall:
      image: capybara1/firewall:latest
      net: host
      cap_add:
      - NET_ADMIN
      volumes:
      - /etc/iptables:/host/etc/iptables:ro
      labels:
        io.rancher.os.after: wait-for-network, console
        io.rancher.os.detach: "false"
        io.rancher.os.remove: "true"