diff --git a/docs/Docker.xml b/docs/Docker.xml new file mode 100644 index 000000000..ea892ae3c --- /dev/null +++ b/docs/Docker.xml @@ -0,0 +1,94 @@ + + +
+ + + + Docker Support + + + + Tom + + Eastep + + + + + + + 2016 + + Thomas M. Eastep + + + + Permission is granted to copy, distribute and/or modify this + document under the terms of the GNU Free Documentation License, Version + 1.2 or any later version published by the Free Software Foundation; with + no Invariant Sections, with no Front-Cover, and with no Back-Cover + Texts. A copy of the license is included in the section entitled + GNU Free Documentation + License. + + + +
+ Shorewall 5.0.5 and Earlier + + Both Docker and Shorewall assume that they 'own' the iptables + configuration. This leads to problems when Shorewall is restarted or + reloaded, because it drops all of the rules added by Docker. Fortunately, + the extensibility features in Shorewall allow users to create + their own solution for saving the Docker-generated rules before + these operations and restoring them afterwards. +
+ +
+ Shorewall 5.0.6 and Later + + Beginning with Shorewall 5.0.6, Shorewall has native support for + Docker. This support is enabled by setting DOCKER=Yes in shorewall.conf. + With this setting, the generated script saves the Docker-created ruleset + before executing a stop, start, + restart or reload operation and + restores those rules along with the Shorewall-generated ruleset. + + This support assumes that the default Docker bridge (docker0) is + being used. It is recommended that this bridge be defined to Shorewall in + shorewall-interfaces(8). + As shown below, you can control inter-container communication using the + and options. If docker0 + is not defined to Shorewall, then Shorewall will generate rules similar to + those that Docker creates when --icc=true (Inter-container Communication) + is specified on the Docker daemon runline. + + /etc/shorewall/shorewall.conf: + + DOCKER=Yes + + /etc/shorewall/zones: + + #ZONE TYPE OPTIONS +dock ipv4 #'dock' is just an example -- call it anything you like + + /etc/shorewall/policy: + + #SOURCE DEST POLICY LEVEL +dock $FW REJECT +dock all ACCEPT + + /etc/shorewall/interfaces: + + #ZONE INTERFACE OPTIONS +dock docker0 bridge #Allow ICC (bridge implies routeback=1) + + or + + #ZONE INTERFACE OPTIONS +dock docker0 bridge,routeback=0 #Disallow ICC +
+
diff --git a/docs/Documentation_Index.xml b/docs/Documentation_Index.xml index 6d585fbe3..c064fc918 100644 --- a/docs/Documentation_Index.xml +++ b/docs/Documentation_Index.xml @@ -265,7 +265,7 @@ - Dynamic Zones + Docker Operating Shorewall @@ -275,8 +275,7 @@ - ECN Disabling by host or - subnet + Dynamic Zones Packet Marking @@ -285,7 +284,8 @@ - Events + ECN Disabling by host or + subnet Packet Processing in a Shorewall-based Firewall @@ -294,8 +294,7 @@ - Extension - Scripts (User Exits) + Events 'Ping' Management @@ -304,8 +303,8 @@ - Fallback/Uninstall + Extension + Scripts (User Exits) Port Forwarding @@ -315,7 +314,8 @@ - FAQs + Fallback/Uninstall Port Information @@ -324,8 +324,7 @@ - Features + FAQs Port Knocking (deprecated) @@ -334,8 +333,8 @@ - Forwarding Traffic on the - Same Interface + Features Port Knocking, Auto Blacklisting and Other Uses of the 'Recent Match' @@ -344,18 +343,28 @@ - FTP and Shorewall + Forwarding Traffic on the + Same Interface PPTP + + FTP and Shorewall + + Proxy ARP + + + + Fool's Firewall - Proxy ARP + QuickStart + Guides @@ -364,8 +373,7 @@ Helpers/Helper Modules - QuickStart - Guides + Release Model @@ -374,14 +382,6 @@ Installation/Upgrade - Release Model - - - - - - IPP2P - Requirements @@ -389,7 +389,7 @@ - IPSEC + IPP2P Routing and Shorewall @@ -398,7 +398,7 @@ - Ipsets + IPSEC Routing on One Interface @@ -407,18 +407,27 @@ - IPv6 Support + Ipsets Samba + + IPv6 Support + + Shorewall Events + + + + ISO 3661 Country Codes - Shorewall Events + Shorewall + Init @@ -427,8 +436,8 @@ Kazaa Filtering - Shorewall - Init + Shorewall + Lite @@ -437,8 +446,7 @@ Kernel Configuration - Shorewall - Lite + diff --git a/docs/shorewall_features.xml b/docs/shorewall_features.xml index 7441d390e..fa038b632 100644 --- a/docs/shorewall_features.xml +++ b/docs/shorewall_features.xml @@ -5,7 +5,7 @@ - Shorewall 4.4/4.5/4.6 Features + Shorewall 5.0 Features Tom @@ -16,7 +16,7 @@ - 2001-2014 + 2001-2016 Thomas M Eastep @@ -32,13 +32,6 @@ - - This article applies to Shorewall 4.3 and - later. If you are running a version of Shorewall earlier than Shorewall - 4.3.5 then please see the documentation for that - release. - -
Features @@ -278,6 +271,10 @@ LXC + + + Docker (Shorewall 5.0.6 and later) +