45 lines
2.0 KiB
Bash
45 lines
2.0 KiB
Bash
#!/bin/bash
|
|
|
|
DOCKER_INT="docker0"
|
|
DOCKER_NETWORK="172.17.0.0/16"
|
|
|
|
iptables -N DOCKER
|
|
iptables -t nat -N DOCKER
|
|
|
|
iptables -A FORWARD -o ${DOCKER_INT} -j DOCKER
|
|
iptables -A FORWARD -o ${DOCKER_INT} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
iptables -A FORWARD -i ${DOCKER_INT} ! -o ${DOCKER_INT} -j ACCEPT
|
|
iptables -A FORWARD -i ${DOCKER_INT} -o ${DOCKER_INT} -j ACCEPT
|
|
|
|
iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
|
|
iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
|
|
iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUERADE
|
|
|
|
containers=`docker ps -q`
|
|
|
|
if [ `echo ${containers} | wc -c` -gt "1" ] ; then
|
|
for container in ${containers} ; do
|
|
rules=`docker port ${container} | sed 's/ //g'`
|
|
|
|
if [ `echo ${rules} | wc -c` -gt "1" ] ; then
|
|
ipaddr=`docker inspect -f "{{.NetworkSettings.IPAddress}}" ${container}`
|
|
|
|
for rule in ${rules} ; do
|
|
src=`echo ${rule} | awk -F'->' '{ print $2 }'`
|
|
dst=`echo ${rule} | awk -F'->' '{ print $1 }'`
|
|
|
|
src_ip=`echo ${src} | awk -F':' '{ print $1 }'`
|
|
src_port=`echo ${src} | awk -F':' '{ print $2 }'`
|
|
|
|
dst_port=`echo ${dst} | awk -F'/' '{ print $1 }'`
|
|
dst_proto=`echo ${dst} | awk -F'/' '{ print $2 }'`
|
|
|
|
iptables -A DOCKER -d ${ipaddr}/32 ! -i ${DOCKER_INT} -o ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j ACCEPT
|
|
|
|
iptables -t nat -A POSTROUTING -s ${ipaddr}/32 -d ${ipaddr}/32 -p ${dst_proto} -m ${dst_proto} --dport ${dst_port} -j MASQUERADE
|
|
iptables -t nat -A DOCKER ! -i ${DOCKER_INT} -p ${dst_proto} -m ${dst_proto} --dport ${src_port} -j DNAT --to-destination ${ipaddr}:${dst_port}
|
|
done
|
|
fi
|
|
done
|
|
fi
|