diff --git a/docs/Docker.xml b/docs/Docker.xml
new file mode 100644
index 000000000..ea892ae3c
--- /dev/null
+++ b/docs/Docker.xml
@@ -0,0 +1,94 @@
+
+
+
+
+
+
+ Docker Support
+
+
+
+ Tom
+
+ Eastep
+
+
+
+
+
+
+ 2016
+
+ Thomas M. Eastep
+
+
+
+ Permission is granted to copy, distribute and/or modify this
+ document under the terms of the GNU Free Documentation License, Version
+ 1.2 or any later version published by the Free Software Foundation; with
+ no Invariant Sections, with no Front-Cover, and with no Back-Cover
+ Texts. A copy of the license is included in the section entitled
+ GNU Free Documentation
+ License.
+
+
+
+
+ Shorewall 5.0.5 and Earlier
+
+ Both Docker and Shorewall assume that they 'own' the iptables
+ configuration. This leads to problems when Shorewall is restarted or
+ reloaded, because it drops all of the rules added by Docker. Fortunately,
+ the extensibility features in Shorewall allow users to create
+ their own solution for saving the Docker-generated rules before
+ these operations and restoring them afterwards.
+
+
+
+ Shorewall 5.0.6 and Later
+
+ Beginning with Shorewall 5.0.6, Shorewall has native support for
+ Docker. This support is enabled by setting DOCKER=Yes in shorewall.conf.
+ With this setting, the generated script saves the Docker-created ruleset
+ before executing a stop, start,
+ restart or reload operation and
+ restores those rules along with the Shorewall-generated ruleset.
+
+ This support assumes that the default Docker bridge (docker0) is
+ being used. It is recommended that this bridge be defined to Shorewall in
+ shorewall-interfaces(8).
+ As shown below, you can control inter-container communication using the
+ and options. If docker0
+ is not defined to Shorewall, then Shorewall will generate rules similar to
+ those that Docker creates when --icc=true (Inter-container Communication)
+ is specified on the Docker daemon runline.
+
+ /etc/shorewall/shorewall.conf:
+
+ DOCKER=Yes
+
+ /etc/shorewall/zones:
+
+ #ZONE TYPE OPTIONS
+dock ipv4 #'dock' is just an example -- call it anything you like
+
+ /etc/shorewall/policy:
+
+ #SOURCE DEST POLICY LEVEL
+dock $FW REJECT
+dock all ACCEPT
+
+ /etc/shorewall/interfaces:
+
+ #ZONE INTERFACE OPTIONS
+dock docker0 bridge #Allow ICC (bridge implies routeback=1)
+
+ or
+
+ #ZONE INTERFACE OPTIONS
+dock docker0 bridge,routeback=0 #Disallow ICC
+
+
diff --git a/docs/Documentation_Index.xml b/docs/Documentation_Index.xml
index 6d585fbe3..c064fc918 100644
--- a/docs/Documentation_Index.xml
+++ b/docs/Documentation_Index.xml
@@ -265,7 +265,7 @@
- Dynamic Zones
+ DockerOperating
Shorewall
@@ -275,8 +275,7 @@
- ECN Disabling by host or
- subnet
+ Dynamic ZonesPacket
Marking
@@ -285,7 +284,8 @@
- Events
+ ECN Disabling by host or
+ subnetPacket Processing in a
Shorewall-based Firewall
@@ -294,8 +294,7 @@
- Extension
- Scripts (User Exits)
+ Events'Ping' Management
@@ -304,8 +303,8 @@
- Fallback/Uninstall
+ Extension
+ Scripts (User Exits)Port
Forwarding
@@ -315,7 +314,8 @@
- FAQs
+ Fallback/UninstallPort Information
@@ -324,8 +324,7 @@
- Features
+ FAQsPort Knocking
(deprecated)
@@ -334,8 +333,8 @@
- Forwarding Traffic on the
- Same Interface
+ FeaturesPort Knocking, Auto Blacklisting
and Other Uses of the 'Recent Match'
@@ -344,18 +343,28 @@
- FTP and Shorewall
+ Forwarding Traffic on the
+ Same InterfacePPTP
+
+ FTP and Shorewall
+
+ Proxy ARP
+
+
+
+
Fool's
Firewall
- Proxy ARP
+ QuickStart
+ Guides
@@ -364,8 +373,7 @@
Helpers/Helper
Modules
- QuickStart
- Guides
+ Release Model
@@ -374,14 +382,6 @@
Installation/Upgrade
- Release Model
-
-
-
-
-
- IPP2P
-
Requirements
@@ -389,7 +389,7 @@
- IPSEC
+ IPP2PRouting and
Shorewall
@@ -398,7 +398,7 @@
- Ipsets
+ IPSECRouting on One
Interface
@@ -407,18 +407,27 @@
- IPv6 Support
+ IpsetsSamba
+
+ IPv6 Support
+
+ Shorewall Events
+
+
+
+
ISO 3661 Country
Codes
- Shorewall Events
+ Shorewall
+ Init
@@ -427,8 +436,8 @@
Kazaa
Filtering
- Shorewall
- Init
+ Shorewall
+ Lite
@@ -437,8 +446,7 @@
Kernel
Configuration
- Shorewall
- Lite
+
diff --git a/docs/shorewall_features.xml b/docs/shorewall_features.xml
index 7441d390e..fa038b632 100644
--- a/docs/shorewall_features.xml
+++ b/docs/shorewall_features.xml
@@ -5,7 +5,7 @@
- Shorewall 4.4/4.5/4.6 Features
+ Shorewall 5.0 FeaturesTom
@@ -16,7 +16,7 @@
- 2001-2014
+ 2001-2016Thomas M Eastep
@@ -32,13 +32,6 @@
-
- This article applies to Shorewall 4.3 and
- later. If you are running a version of Shorewall earlier than Shorewall
- 4.3.5 then please see the documentation for that
- release.
-
-
Features
@@ -278,6 +271,10 @@
LXC
+
+
+ Docker (Shorewall 5.0.6 and later)
+