frodovdr/csf-post-docker
1
0
Fork 0
mirror of https://github.com/juliengk/csf-post-docker.git synced 2023-10-10 13:37:41 +02:00
Code Issues Releases Wiki Activity

Add paths, fixes error while csf is upgrading

Browse Source
This commit is contained in:
ddrager 2016-04-12 10:12:04 -04:00
parent bfb06300d5
commit a1370a2013
1 changed files with 19 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
docker.sh
View File

@ -7,36 +7,36 @@ chain_exists() {
} }
local chain_name="$1" ; shift local chain_name="$1" ; shift
[ $# -eq 1 ] && local table="--table $1" [ $# -eq 1 ] && local table="--table $1"
iptables $table -n --list "$chain_name" >/dev/null 2>&1 /sbin/iptables $table -n --list "$chain_name" >/dev/null 2>&1
} }
DOCKER_INT="docker0" DOCKER_INT="docker0"
DOCKER_NETWORK="172.17.0.0/16" DOCKER_NETWORK="172.17.0.0/16"
iptables-save | grep -v -- '-j DOCKER' | iptables-restore /sbin/iptables-save | grep -v -- '-j DOCKER' | /sbin/iptables-restore
chain_exists DOCKER && iptables -X DOCKER chain_exists DOCKER && /sbin/iptables -X DOCKER
chain_exists DOCKER nat && iptables -t nat -X DOCKER chain_exists DOCKER nat && /sbin/iptables -t nat -X DOCKER
iptables -N DOCKER /sbin/iptables -N DOCKER
iptables -t nat -N DOCKER /sbin/iptables -t nat -N DOCKER
iptables -A FORWARD -o ${DOCKER_INT} -j DOCKER /sbin/iptables -A FORWARD -o ${DOCKER_INT} -j DOCKER
iptables -A FORWARD -o ${DOCKER_INT} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT /sbin/iptables -A FORWARD -o ${DOCKER_INT} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i ${DOCKER_INT} ! -o ${DOCKER_INT} -j ACCEPT /sbin/iptables -A FORWARD -i ${DOCKER_INT} ! -o ${DOCKER_INT} -j ACCEPT
iptables -A FORWARD -i ${DOCKER_INT} -o ${DOCKER_INT} -j ACCEPT /sbin/iptables -A FORWARD -i ${DOCKER_INT} -o ${DOCKER_INT} -j ACCEPT
iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER /sbin/iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER /sbin/iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUERADE /sbin/iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUERADE
containers=`docker ps -q` containers=`/bin/docker ps -q`
if [ `echo ${containers} | wc -c` -gt "1" ] ; then if [ `echo ${containers} | wc -c` -gt "1" ] ; then
for container in ${containers} ; do for container in ${containers} ; do
rules=`docker port ${container} | sed 's/ //g'` rules=`/bin/docker port ${container} | sed 's/ //g'`
if [ `echo ${rules} | wc -c` -gt "1" ] ; then if [ `echo ${rules} | wc -c` -gt "1" ] ; then
ipaddr=`docker inspect -f "{{.NetworkSettings.IPAddress}}" ${container}` ipaddr=`/bin/docker inspect -f "{{.NetworkSettings.IPAddress}}" ${container}`
for rule in ${rules} ; do for rule in ${rules} ; do
src=`echo ${rule} | awk -F'->' '{ print $2 }'` src=`echo ${rule} | awk -F'->' '{ print $2 }'`
@ -48,10 +48,10 @@ if [ `echo ${containers} | wc -c` -gt "1" ] ; then
dst_port=`echo ${dst} | awk -F'/' '{ print $1 }'` dst_port=`echo ${dst} | awk -F'/' '{ print $1 }'`
dst_proto=`echo ${dst} | awk -F'/' '{ print $2 }'` dst_proto=`echo ${dst} | awk -F'/' '{ print $2 }'`
iptables -A DOCKER -d ${ipaddr}/32 ! -i ${DOCKER_INT} -o ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j ACCEPT /sbin/iptables -A DOCKER -d ${ipaddr}/32 ! -i ${DOCKER_INT} -o ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j ACCEPT
iptables -t nat -A POSTROUTING -s ${ipaddr}/32 -d ${ipaddr}/32 -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j MASQUERADE /sbin/iptables -t nat -A POSTROUTING -s ${ipaddr}/32 -d ${ipaddr}/32 -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j MASQUERADE
iptables -t nat -A DOCKER ! -i ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${src_port} -j DNAT --to-destination ${ipaddr}:${dst_port} /sbin/iptables -t nat -A DOCKER ! -i ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${src_port} -j DNAT --to-destination ${ipaddr}:${dst_port}
done done
fi fi
done done