Re-create docker iptables rules

evalmyoutput.sh

#!/bin/bash

echo "Recreating docker iptables rules and chains"

echo "iptables -N DOCKER"
echo "iptables -N DOCKER-ISOLATION"
echo "iptables -t nat -N DOCKER"
echo "iptables -A DOCKER-ISOLATION -j RETURN"
echo "iptables -A FORWARD -j DOCKER-ISOLATION"
echo "iptables -t nat -A PREROUTING -m addrtype -dst-type LOCAL -j DOCKER"
echo "iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype -dst-type LOCAL -j DOCKER"

for network in $(docker network ls -f 'driver=bridge' --format '{{.Name}}'); do
	iface=$(docker network inspect "${network}" -f '{{range $n, $iface := .Options}}{{if eq $n "com.docker.network.bridge.name"}}{{$iface}}{{end}}{{end}}')
	echo "iptables -A INPUT -i ${iface} -j ACCEPT"
	echo "iptables -A FORWARD -o ${iface} -j DOCKER"
	echo "iptables -A FORWARD -o ${iface} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
	echo "iptables -A FORWARD -i ${iface} ! -o ${iface} -j ACCEPT"
	echo "iptables -A FORWARD -i ${iface} -o ${iface} -j ACCEPT"
	echo "iptables -t nat -A DOCKER -i ${iface} -j RETURN"

	for container in $(docker network inspect bridge -f '{{range $name,$trash := .Containers}}{{$name}}{{"\x0a"}}{{end}}'); do
		if [ -z "$container" ]; then
			continue
		fi
		echo  -ne "# $container"
		docker inspect "${container}" -f '{{$addr:=.NetworkSettings.Networks.'"$network"'.IPAddress}}{{range $dport, $maps := .NetworkSettings.Ports}}{{$ddport := split $dport "/"}}{{range $index,$map := $maps}}{{"\x0a"}}iptables -A DOCKER -p {{index $ddport 1}} ! -i '"$iface"' -o '"$iface"' -d {{$addr}} --dport {{index $ddport 0}} -j ACCEPT {{"\x0a"}}iptables -t nat -A DOCKER ! -i '"$iface"' -p {{index $ddport 1}} --dport {{$map.HostPort}} -d {{$map.HostIp}} -j DNAT --to-destination {{$addr}}:{{index $ddport 0}}{{end}}{{end}}'
	done

	docker network inspect "${network}" -f  '{{$f:=.}}{{range $n, $iface := .Options}}{{if eq $n "com.docker.network.bridge.name"}}{{range $i, $cfg := $f.IPAM.Config}}iptables -t nat -A POSTROUTING ! -o {{$iface}} -s {{$cfg.Subnet}} -j MASQUERADE{{"\x0A"}}{{end}}{{end}}{{end}}'


done

some networks in my docker host has no "iface" based on your script!!

Ummm, you realise this is 4 years old and docker has changed a lot in that time? I'm amazed it works at all.

@freman no longer works

I made my fork
https://gist.github.com/lokha/8fa5cdf2b27c46f9fdcb79b9578ba795

in which I made two fixes

1. made ignoring networks that are empty and have the value <no value>
2. made ignore ipv6 rules for port forwarding

both of these things caused an error

this script saved my day. thanks)