Skip to content

Instantly share code, notes, and snippets.

@hdoverobinson

hdoverobinson/iptables-docker.rules

Created May 9, 2017 02:16
Download ZIP

Revisions

  1. hdoverobinson created this gist May 9, 2017.
    40 changes: 40 additions & 0 deletions iptables-docker.rules
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,40 @@
    *mangle
    :PREROUTING ACCEPT [0:0]
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    :POSTROUTING ACCEPT [0:0]
    COMMIT

    *nat
    :PREROUTING ACCEPT [3530:581109]
    :INPUT ACCEPT [278:45315]
    :OUTPUT ACCEPT [528:37460]
    :POSTROUTING ACCEPT [528:37460]
    :DOCKER - [0:0]
    -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
    -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
    -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
    -A DOCKER -i docker0 -j RETURN
    COMMIT

    *filter
    :INPUT DROP [0:0]
    :FORWARD DROP [0:0]
    :OUTPUT DROP [0:0]
    :DOCKER - [0:0]
    :DOCKER-ISOLATION - [0:0]
    -A FORWARD -j DOCKER-ISOLATION
    -A FORWARD -o docker0 -j DOCKER
    -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
    -A FORWARD -i docker0 -o docker0 -j ACCEPT
    -A INPUT -i docker0 -j ACCEPT
    -A FORWARD -i eth0 -o docker0 -j ACCEPT
    -A FORWARD -i docker0 -o eth0 -j ACCEPT
    -A OUTPUT -o docker0 -j ACCEPT
    -A INPUT -i veth+ -j ACCEPT
    -A FORWARD -i veth+ -o docker0 -j ACCEPT
    -A FORWARD -i docker0 -o veth+ -j ACCEPT
    -A OUTPUT -o veth+ -j ACCEPT
    -A DOCKER-ISOLATION -j RETURN