ipscriptables 0.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +15 -0
- data/.gitignore +17 -0
- data/.rubocop.yml +15 -0
- data/.travis.yml +10 -0
- data/CHANGELOG.md +6 -0
- data/CONTRIBUTING.md +43 -0
- data/Gemfile +13 -0
- data/LICENSE +20 -0
- data/README.md +54 -0
- data/Rakefile +22 -0
- data/bin/ipscriptables +6 -0
- data/cookbook/.gitignore +2 -0
- data/cookbook/.kitchen.yml +28 -0
- data/cookbook/Berksfile +6 -0
- data/cookbook/README.md +53 -0
- data/cookbook/attributes/default.rb +3 -0
- data/cookbook/chefignore +96 -0
- data/cookbook/libraries/default.rb +35 -0
- data/cookbook/metadata.rb +9 -0
- data/cookbook/providers/rules.rb +21 -0
- data/cookbook/recipes/default.rb +10 -0
- data/cookbook/recipes/load.rb +8 -0
- data/cookbook/resources/rules.rb +17 -0
- data/cookbook/test/cookbooks/ipscriptables-test/#metadata.rb# +8 -0
- data/cookbook/test/cookbooks/ipscriptables-test/metadata.rb +11 -0
- data/cookbook/test/cookbooks/ipscriptables-test/recipes/default.rb +23 -0
- data/cookbook/test/cookbooks/ipscriptables-test/recipes/prepare.rb +5 -0
- data/cookbook/test/data/.gitignore +1 -0
- data/cookbook/test/integration/default/bats/default.bats +9 -0
- data/doc/iptables-switches.txt +342 -0
- data/ipscriptables.gemspec +38 -0
- data/lib/ipscriptables.rb +14 -0
- data/lib/ipscriptables/chain.rb +83 -0
- data/lib/ipscriptables/cli.rb +19 -0
- data/lib/ipscriptables/helpers.rb +39 -0
- data/lib/ipscriptables/pretty_print.rb +58 -0
- data/lib/ipscriptables/rule.rb +95 -0
- data/lib/ipscriptables/ruleset.rb +103 -0
- data/lib/ipscriptables/ruleset/class_methods.rb +67 -0
- data/lib/ipscriptables/runtime.rb +97 -0
- data/lib/ipscriptables/table.rb +77 -0
- data/lib/ipscriptables/version.rb +5 -0
- data/spec/fixtures/clyhq.txt +40 -0
- data/spec/fixtures/docker-plus.txt +31 -0
- data/spec/fixtures/drumknott.txt +67 -0
- data/spec/fixtures/falcor.txt +39 -0
- data/spec/fixtures/ghq.txt +102 -0
- data/spec/fixtures/ip6tables-empty.txt +7 -0
- data/spec/fixtures/only-docker-c.txt +23 -0
- data/spec/fixtures/only-docker.txt +23 -0
- data/spec/fixtures/only_docker.rb +22 -0
- data/spec/fixtures/runtime.rb +7 -0
- data/spec/fixtures/runtime2.rb +16 -0
- data/spec/ipscriptables/dsl_spec.rb +74 -0
- data/spec/ipscriptables/helpers_spec.rb +58 -0
- data/spec/ipscriptables/rule_spec.rb +41 -0
- data/spec/ipscriptables/ruleset/class_methods_spec.rb +52 -0
- data/spec/ipscriptables/ruleset_spec.rb +199 -0
- data/spec/ipscriptables/runtime_spec.rb +227 -0
- data/spec/ipscriptables/table_spec.rb +32 -0
- data/spec/ipscriptables/version_spec.rb +12 -0
- data/spec/spec_helper.rb +60 -0
- metadata +350 -0
@@ -0,0 +1,67 @@
|
|
1
|
+
# -*- coding: utf-8 -*-
|
2
|
+
|
3
|
+
module IPScriptables
|
4
|
+
class Ruleset
|
5
|
+
include Helpers
|
6
|
+
|
7
|
+
class << self
|
8
|
+
def from_file(path, opts = {})
|
9
|
+
f = File.open(path)
|
10
|
+
from_io(f, opts)
|
11
|
+
ensure
|
12
|
+
f.close if f
|
13
|
+
end
|
14
|
+
|
15
|
+
def from_io(io, opts = {}) # rubocop:disable CyclomaticComplexity, MethodLength, LineLength
|
16
|
+
rs = new(opts.merge(skip_builtin_chains: true))
|
17
|
+
table = nil
|
18
|
+
io.each_line do |ln|
|
19
|
+
ln.strip!
|
20
|
+
case ln
|
21
|
+
when /^#/
|
22
|
+
# comment, skip it
|
23
|
+
when /^\*(.*)/
|
24
|
+
fail RuntimeError unless table.nil?
|
25
|
+
table = rs.table($1)
|
26
|
+
when /^:(\w+) (\w+|-) \[(\d+):(\d+)\]$/
|
27
|
+
table.chain $1, $2, [$3.to_i, $4.to_i]
|
28
|
+
when /^(\[(\d+):(\d+)\] )?-A (\w+) (.*)/
|
29
|
+
ch = table[$4]
|
30
|
+
rule = $5
|
31
|
+
counters = [$2.to_i, $3.to_i] if $1
|
32
|
+
ch.rule(Rule.new(ch, rule, counters))
|
33
|
+
when /^COMMIT$/
|
34
|
+
fail 'COMMIT without table' if table.nil?
|
35
|
+
table = nil
|
36
|
+
else
|
37
|
+
fail "Cannot parse iptables-save line: #{ln}"
|
38
|
+
end
|
39
|
+
end
|
40
|
+
rs
|
41
|
+
end
|
42
|
+
alias_method :from_s, :from_io # string also has `#each_line` method
|
43
|
+
|
44
|
+
def from_command(*args)
|
45
|
+
opts = args.last.is_a?(Hash) ? args.pop : {}
|
46
|
+
from_s(Helpers.run_command(*args), opts.merge(command: args))
|
47
|
+
end
|
48
|
+
|
49
|
+
def from_system(opts = {})
|
50
|
+
opts[:family] ||= :inet
|
51
|
+
case opts[:family]
|
52
|
+
when :inet then from_command 'iptables-save', '-c', opts
|
53
|
+
when :inet6 then from_command 'ip6tables-save', '-c', opts
|
54
|
+
else fail NotImplementedError, "Unknonwn family #{opts[:family]}"
|
55
|
+
end
|
56
|
+
end
|
57
|
+
|
58
|
+
def from_iptables(opts = {})
|
59
|
+
from_system(opts.merge(family: :inet))
|
60
|
+
end
|
61
|
+
|
62
|
+
def from_ip6tables(opts = {})
|
63
|
+
from_system(opts.merge(family: :inet6))
|
64
|
+
end
|
65
|
+
end
|
66
|
+
end
|
67
|
+
end
|
@@ -0,0 +1,97 @@
|
|
1
|
+
# -*- coding: utf-8 -*-
|
2
|
+
# rubocop:disable BlockNesting
|
3
|
+
|
4
|
+
require 'English'
|
5
|
+
require 'logger'
|
6
|
+
|
7
|
+
module IPScriptables
|
8
|
+
class Runtime
|
9
|
+
DEFAULT_OPTS = { counters: true }
|
10
|
+
attr_reader :log, :opts
|
11
|
+
|
12
|
+
def initialize(opts = {}, logger = nil)
|
13
|
+
@opts = DEFAULT_OPTS.merge(opts)
|
14
|
+
@log = logger || Logger.new($stderr)
|
15
|
+
@evaluating = 0
|
16
|
+
@rulesets = {}
|
17
|
+
end
|
18
|
+
|
19
|
+
def ruleset(family)
|
20
|
+
family = family.to_sym
|
21
|
+
@rulesets[family] ||=
|
22
|
+
IPScriptables::Ruleset.from_system(family: family).bud(opts)
|
23
|
+
end
|
24
|
+
|
25
|
+
def family(*families, &block)
|
26
|
+
families.each do |family|
|
27
|
+
begin
|
28
|
+
@evaluating += 1
|
29
|
+
ruleset(family).dsl_eval(&block)
|
30
|
+
ensure
|
31
|
+
@evaluating -= 1
|
32
|
+
end
|
33
|
+
end
|
34
|
+
end
|
35
|
+
|
36
|
+
def iptables(&block)
|
37
|
+
family(:inet, &block)
|
38
|
+
end
|
39
|
+
|
40
|
+
def ip6tables(&block)
|
41
|
+
family(:inet6, &block)
|
42
|
+
end
|
43
|
+
|
44
|
+
def load_file(path)
|
45
|
+
@evaluating += 1
|
46
|
+
log.info "Loading configuration from #{path}"
|
47
|
+
instance_eval(File.read(path), path)
|
48
|
+
ensure
|
49
|
+
@evaluating -= 1
|
50
|
+
end
|
51
|
+
|
52
|
+
def dsl_eval(&block)
|
53
|
+
@evaluating += 1
|
54
|
+
instance_eval(&block)
|
55
|
+
ensure
|
56
|
+
@evaluating -= 1
|
57
|
+
end
|
58
|
+
|
59
|
+
def execute! # rubocop:disable CyclomaticComplexity, MethodLength
|
60
|
+
if @evaluating != 0
|
61
|
+
fail "I can't let you do that (DSL eval depth #{@evaluating})"
|
62
|
+
end
|
63
|
+
|
64
|
+
ok = true
|
65
|
+
@rulesets.sort.each do |family, ruleset|
|
66
|
+
if !opts.fetch(family, true)
|
67
|
+
log.info "Skipping #{family} as requested"
|
68
|
+
else
|
69
|
+
diff = ruleset.diff
|
70
|
+
if diff.to_s.empty?
|
71
|
+
log.info "No changes for #{family}, moving along."
|
72
|
+
else
|
73
|
+
log.info "Changes found for #{family}"
|
74
|
+
format = opts.fetch(:color, $stdout.tty?) ? :color : :text
|
75
|
+
puts diff.to_s(format) unless opts[:quiet]
|
76
|
+
if opts[:apply]
|
77
|
+
log.info "Restoring #{family}"
|
78
|
+
begin
|
79
|
+
ruleset.restore!
|
80
|
+
rescue => e
|
81
|
+
log.error "Failure restoring #{family}: #{e}"
|
82
|
+
ok = false
|
83
|
+
return ok if opts[:fail_fast]
|
84
|
+
end
|
85
|
+
else
|
86
|
+
log.info "Would restore #{family}"
|
87
|
+
end
|
88
|
+
end
|
89
|
+
end
|
90
|
+
end
|
91
|
+
|
92
|
+
log.warn 'There were errors' unless ok
|
93
|
+
|
94
|
+
ok
|
95
|
+
end
|
96
|
+
end
|
97
|
+
end
|
@@ -0,0 +1,77 @@
|
|
1
|
+
# -*- coding: utf-8 -*-
|
2
|
+
|
3
|
+
module IPScriptables
|
4
|
+
class Table
|
5
|
+
extend Forwardable
|
6
|
+
def_delegators :@chains, :[]=, :[], :keys
|
7
|
+
def_delegators :to_ary, :each, :empty?
|
8
|
+
def_delegators :ruleset, :opts
|
9
|
+
include Enumerable
|
10
|
+
|
11
|
+
attr_reader :name, :ruleset
|
12
|
+
def initialize(name, ruleset, &block)
|
13
|
+
@name = name.to_sym
|
14
|
+
@chains = Hashie::Mash.new
|
15
|
+
@ruleset = ruleset
|
16
|
+
|
17
|
+
create_builtin_chains unless ruleset.opts[:skip_builtin_chains]
|
18
|
+
|
19
|
+
Docile.dsl_eval(self, &block) if block_given?
|
20
|
+
end
|
21
|
+
|
22
|
+
def original
|
23
|
+
ruleset.original[name] if ruleset.original
|
24
|
+
end
|
25
|
+
|
26
|
+
BUILTIN_CHAINS = {
|
27
|
+
filter: [:INPUT, :FORWARD, :OUTPUT],
|
28
|
+
nat: [:PREROUTING, :INPUT, :OUTPUT, :POSTROUTING],
|
29
|
+
mangle: [:PREROUTING, :INPUT, :OUTPUT, :FORWARD, :POSTROUTING],
|
30
|
+
raw: [:PREROUTING, :OUTPUT],
|
31
|
+
security: [:INPUT, :OUTPUT, :FORWARD]
|
32
|
+
}
|
33
|
+
|
34
|
+
def create_builtin_chains
|
35
|
+
if BUILTIN_CHAINS.key? @name
|
36
|
+
BUILTIN_CHAINS[@name].each do |builtin|
|
37
|
+
chain builtin, :ACCEPT
|
38
|
+
end
|
39
|
+
else
|
40
|
+
warn "Unrecognized table #{@name}, not creating builtin chains"
|
41
|
+
end
|
42
|
+
end
|
43
|
+
|
44
|
+
def inherit(*names, &block) # rubocop:disable MethodLength
|
45
|
+
fail 'Need original to inherit' unless ruleset.original
|
46
|
+
original_table = ruleset.original[name]
|
47
|
+
names = original_table.keys if names.empty?
|
48
|
+
names.each do |name|
|
49
|
+
original_chain = original_table[name]
|
50
|
+
original_rules = original_chain.rules
|
51
|
+
original_rules = original_rules.select(&block) if block_given?
|
52
|
+
chain name, original_chain.policy, original_chain.counters do
|
53
|
+
rules.concat(original_rules)
|
54
|
+
end
|
55
|
+
end
|
56
|
+
end
|
57
|
+
|
58
|
+
def to_ary
|
59
|
+
@chains.values
|
60
|
+
end
|
61
|
+
|
62
|
+
def chain(name, *args, &block)
|
63
|
+
if @chains.key?(name)
|
64
|
+
@chains[name].alter(*args, &block)
|
65
|
+
else
|
66
|
+
@chains[name] = Chain.new(name, self, *args, &block)
|
67
|
+
end
|
68
|
+
end
|
69
|
+
|
70
|
+
def render
|
71
|
+
["*#{name}",
|
72
|
+
map(&:render_header).join("\n"),
|
73
|
+
map(&:render_rules).compact.join("\n"),
|
74
|
+
'COMMIT'].reject { |piece| piece == '' }.join("\n")
|
75
|
+
end
|
76
|
+
end
|
77
|
+
end
|
@@ -0,0 +1,40 @@
|
|
1
|
+
# Generated by iptables-save v1.4.12 on Tue Feb 18 15:14:18 2014
|
2
|
+
*filter
|
3
|
+
:INPUT ACCEPT [0:0]
|
4
|
+
:FORWARD ACCEPT [0:0]
|
5
|
+
:OUTPUT ACCEPT [5012201:449061115]
|
6
|
+
-A INPUT -p tcp -m tcp --dport 17443 -j ACCEPT
|
7
|
+
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
8
|
+
-A INPUT -p icmp -j ACCEPT
|
9
|
+
-A INPUT -i docker+ -j ACCEPT
|
10
|
+
-A INPUT -i lo -j ACCEPT
|
11
|
+
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
|
12
|
+
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
|
13
|
+
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
|
14
|
+
-A INPUT -j REJECT --reject-with icmp-port-unreachable
|
15
|
+
-A FORWARD -s 172.17.1.8/32 -d 172.17.1.86/32 -i docker0 -o docker0 -p tcp -m tcp --sport 6379 -j ACCEPT
|
16
|
+
-A FORWARD -s 172.17.1.86/32 -d 172.17.1.8/32 -i docker0 -o docker0 -p tcp -m tcp --dport 6379 -j ACCEPT
|
17
|
+
-A FORWARD -s 172.17.1.8/32 -d 172.17.1.85/32 -i docker0 -o docker0 -p tcp -m tcp --sport 6379 -j ACCEPT
|
18
|
+
-A FORWARD -s 172.17.1.85/32 -d 172.17.1.8/32 -i docker0 -o docker0 -p tcp -m tcp --dport 6379 -j ACCEPT
|
19
|
+
-A FORWARD -i docker0 -o docker0 -j ACCEPT
|
20
|
+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
|
21
|
+
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
22
|
+
COMMIT
|
23
|
+
# Completed on Tue Feb 18 15:14:18 2014
|
24
|
+
# Generated by iptables-save v1.4.12 on Tue Feb 18 15:14:18 2014
|
25
|
+
*nat
|
26
|
+
:PREROUTING ACCEPT [1039:60550]
|
27
|
+
:INPUT ACCEPT [929:53219]
|
28
|
+
:OUTPUT ACCEPT [814:53755]
|
29
|
+
:POSTROUTING ACCEPT [822:54235]
|
30
|
+
:DOCKER - [0:0]
|
31
|
+
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
|
32
|
+
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
|
33
|
+
-A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
|
34
|
+
-A POSTROUTING -s 172.17.0.0/16 ! -d 172.17.0.0/16 -j MASQUERADE
|
35
|
+
-A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 8511 -j DNAT --to-destination 172.17.1.6:8080
|
36
|
+
-A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 8510 -j DNAT --to-destination 172.17.1.7:8080
|
37
|
+
-A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 8501 -j DNAT --to-destination 172.17.1.84:8080
|
38
|
+
-A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 8500 -j DNAT --to-destination 172.17.1.85:8080
|
39
|
+
COMMIT
|
40
|
+
# Completed on Tue Feb 18 15:14:18 2014
|
@@ -0,0 +1,31 @@
|
|
1
|
+
# Generated by iptables-save v1.4.12 on Wed Feb 19 13:37:35 2014
|
2
|
+
*filter
|
3
|
+
:INPUT ACCEPT [211:14626]
|
4
|
+
:FORWARD ACCEPT [0:0]
|
5
|
+
:OUTPUT ACCEPT [122:11280]
|
6
|
+
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
7
|
+
-A INPUT -p icmp -j ACCEPT
|
8
|
+
-A INPUT -i docker0 -j ACCEPT
|
9
|
+
-A INPUT -i lo -j ACCEPT
|
10
|
+
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
|
11
|
+
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
|
12
|
+
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
|
13
|
+
-A INPUT -j REJECT --reject-with icmp-port-unreachable
|
14
|
+
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
15
|
+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
|
16
|
+
-A FORWARD -i docker0 -o docker0 -j ACCEPT
|
17
|
+
COMMIT
|
18
|
+
# Completed on Wed Feb 19 13:37:35 2014
|
19
|
+
# Generated by iptables-save v1.4.12 on Wed Feb 19 13:37:35 2014
|
20
|
+
*nat
|
21
|
+
:PREROUTING ACCEPT [5:1208]
|
22
|
+
:INPUT ACCEPT [5:1208]
|
23
|
+
:OUTPUT ACCEPT [42:3215]
|
24
|
+
:POSTROUTING ACCEPT [42:3215]
|
25
|
+
:DOCKER - [0:0]
|
26
|
+
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
|
27
|
+
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
|
28
|
+
-A POSTROUTING -s 172.17.0.0/16 ! -d 172.17.0.0/16 -j MASQUERADE
|
29
|
+
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
|
30
|
+
COMMIT
|
31
|
+
# Completed on Wed Feb 19 13:37:35 2014
|
@@ -0,0 +1,67 @@
|
|
1
|
+
# Generated by iptables-save v1.4.12 on Tue Feb 18 13:47:34 2014
|
2
|
+
*mangle
|
3
|
+
:PREROUTING ACCEPT [9070264:2761485141]
|
4
|
+
:INPUT ACCEPT [5794:541194]
|
5
|
+
:FORWARD ACCEPT [9064470:2760943947]
|
6
|
+
:OUTPUT ACCEPT [4447:1027385]
|
7
|
+
:POSTROUTING ACCEPT [9068917:2761971332]
|
8
|
+
COMMIT
|
9
|
+
# Completed on Tue Feb 18 13:47:34 2014
|
10
|
+
# Generated by iptables-save v1.4.12 on Tue Feb 18 13:47:34 2014
|
11
|
+
*nat
|
12
|
+
:PREROUTING ACCEPT [936831:58138468]
|
13
|
+
:INPUT ACCEPT [383149:28442596]
|
14
|
+
:OUTPUT ACCEPT [188115:19311882]
|
15
|
+
:POSTROUTING ACCEPT [88176135:5298607741]
|
16
|
+
:DOCKER - [0:0]
|
17
|
+
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
|
18
|
+
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
|
19
|
+
-A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
|
20
|
+
-A POSTROUTING -s 172.17.0.0/16 ! -d 172.17.0.0/16 -j MASQUERADE
|
21
|
+
-A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
|
22
|
+
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
|
23
|
+
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 6379 -j DNAT --to-destination 172.17.0.2:6379
|
24
|
+
COMMIT
|
25
|
+
# Completed on Tue Feb 18 13:47:34 2014
|
26
|
+
# Generated by iptables-save v1.4.12 on Tue Feb 18 13:47:34 2014
|
27
|
+
*filter
|
28
|
+
:INPUT ACCEPT [419:18560]
|
29
|
+
:FORWARD ACCEPT [5802508472:1613710597740]
|
30
|
+
:OUTPUT ACCEPT [2072879:485657573]
|
31
|
+
:FWR - [0:0]
|
32
|
+
-A INPUT -j FWR
|
33
|
+
-A FWR -i lo -j ACCEPT
|
34
|
+
-A FWR -m state --state RELATED,ESTABLISHED -j ACCEPT
|
35
|
+
-A FWR -p icmp -j ACCEPT
|
36
|
+
-A FWR -i docker+ -j ACCEPT
|
37
|
+
-A FWR -s 1.1.1.1/32 -p tcp -m tcp --dport 9102 -j ACCEPT
|
38
|
+
-A FWR -s 1.1.1.1/32 -p tcp -m tcp -m multiport --dports 4949,5666 -j ACCEPT
|
39
|
+
-A FWR -s 10.0.3.55/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
40
|
+
-A FWR -s 1.1.2.2/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
41
|
+
-A FWR -s 1.1.2.3/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
42
|
+
-A FWR -s 1.1.2.12/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
43
|
+
-A FWR -s 1.1.2.13/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
44
|
+
-A FWR -s 1.1.2.4/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
45
|
+
-A FWR -s 1.1.2.15/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
46
|
+
-A FWR -s 1.1.2.16/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
47
|
+
-A FWR -s 1.1.2.5/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
48
|
+
-A FWR -s 1.1.2.6/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
49
|
+
-A FWR -s 1.1.2.7/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
50
|
+
-A FWR -s 1.1.2.8/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
51
|
+
-A FWR -s 1.1.2.9/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
52
|
+
-A FWR -s 1.1.2.10/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
53
|
+
-A FWR -s 1.1.2.11/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
54
|
+
-A FWR -s 1.1.2.14/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
55
|
+
-A FWR -s 1.1.2.15/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
56
|
+
-A FWR -s 1.1.2.15/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
57
|
+
-A FWR -s 1.1.2.17/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
58
|
+
-A FWR -s 1.1.2.18/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
59
|
+
-A FWR -s 1.1.2.19/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
60
|
+
-A FWR -s 1.1.2.20/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
61
|
+
-A FWR -s 1.1.2.21/32 -p tcp -m tcp --dport 6379 -j ACCEPT
|
62
|
+
-A FWR -s 10.0.3.0/24 -p tcp -m tcp --dport 6379 -j ACCEPT
|
63
|
+
-A FWR -p tcp -m tcp --dport 22 -j ACCEPT
|
64
|
+
-A FWR -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
|
65
|
+
-A FWR -p udp -j REJECT --reject-with icmp-port-unreachable
|
66
|
+
COMMIT
|
67
|
+
# Completed on Tue Feb 18 13:47:34 2014
|
@@ -0,0 +1,39 @@
|
|
1
|
+
# Generated by iptables-save v1.4.12 on Tue Feb 18 15:24:18 2014
|
2
|
+
*nat
|
3
|
+
:PREROUTING ACCEPT [110285:6967475]
|
4
|
+
:INPUT ACCEPT [61845:3770509]
|
5
|
+
:OUTPUT ACCEPT [138431:9598104]
|
6
|
+
:POSTROUTING ACCEPT [137629:9513158]
|
7
|
+
:DOCKER - [0:0]
|
8
|
+
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
|
9
|
+
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
|
10
|
+
-A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
|
11
|
+
-A POSTROUTING -s 172.17.0.0/16 ! -d 172.17.0.0/16 -j MASQUERADE
|
12
|
+
-A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 5000 -j DNAT --to-destination 172.17.0.60:5000
|
13
|
+
COMMIT
|
14
|
+
# Completed on Tue Feb 18 15:24:18 2014
|
15
|
+
# Generated by iptables-save v1.4.12 on Tue Feb 18 15:24:18 2014
|
16
|
+
*filter
|
17
|
+
:INPUT ACCEPT [333:14408]
|
18
|
+
:FORWARD ACCEPT [0:0]
|
19
|
+
:OUTPUT ACCEPT [182095162:19602137698]
|
20
|
+
:FWR - [0:0]
|
21
|
+
:LXC - [0:0]
|
22
|
+
-A INPUT -i lxcbr0 -j LXC
|
23
|
+
-A INPUT -j FWR
|
24
|
+
-A FORWARD -i docker0 -o docker0 -j ACCEPT
|
25
|
+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
|
26
|
+
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
27
|
+
-A FWR -i lo -j ACCEPT
|
28
|
+
-A FWR -m state --state RELATED,ESTABLISHED -j ACCEPT
|
29
|
+
-A FWR -p icmp -j ACCEPT
|
30
|
+
-A FWR -i docker+ -j ACCEPT
|
31
|
+
-A FWR -p tcp -m tcp --dport 22 -j ACCEPT
|
32
|
+
-A FWR -p tcp -m tcp --dport 80 -j ACCEPT
|
33
|
+
-A FWR -p tcp -m tcp --dport 443 -j ACCEPT
|
34
|
+
-A FWR -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
|
35
|
+
-A FWR -p udp -j REJECT --reject-with icmp-port-unreachable
|
36
|
+
-A LXC -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT
|
37
|
+
-A LXC -j RETURN
|
38
|
+
COMMIT
|
39
|
+
# Completed on Tue Feb 18 15:24:18 2014
|
@@ -0,0 +1,102 @@
|
|
1
|
+
# Generated by iptables-save v1.4.12 on Wed Feb 19 19:28:22 2014
|
2
|
+
*nat
|
3
|
+
:PREROUTING ACCEPT [732601:44001989]
|
4
|
+
:INPUT ACCEPT [376018:22538408]
|
5
|
+
:OUTPUT ACCEPT [3131507:229597576]
|
6
|
+
:POSTROUTING ACCEPT [20476198:1943580383]
|
7
|
+
:DOCKER - [0:0]
|
8
|
+
[17617331:1738357444] -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
|
9
|
+
[138372:9654576] -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
|
10
|
+
[0:0] -A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
|
11
|
+
[12:912] -A POSTROUTING -s 172.17.0.0/16 ! -d 172.17.0.0/16 -j MASQUERADE
|
12
|
+
[2:120] -A DOCKER ! -i docker0 -p tcp -m tcp --dport 2003 -j DNAT --to-destination 172.17.0.4:2003
|
13
|
+
[0:0] -A DOCKER ! -i docker0 -p tcp -m tcp --dport 2004 -j DNAT --to-destination 172.17.0.4:2004
|
14
|
+
[0:0] -A DOCKER ! -i docker0 -p tcp -m tcp --dport 49153 -j DNAT --to-destination 172.17.0.8:9000
|
15
|
+
[95:5580] -A DOCKER ! -i docker0 -p tcp -m tcp --dport 5000 -j DNAT --to-destination 172.17.0.5:5000
|
16
|
+
[0:0] -A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 49154 -j DNAT --to-destination 172.17.0.9:8080
|
17
|
+
[17011603:1693997647] -A DOCKER ! -i docker0 -p udp -m udp --dport 8125 -j DNAT --to-destination 172.17.0.10:8125
|
18
|
+
[0:0] -A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 49155 -j DNAT --to-destination 172.17.0.10:8126
|
19
|
+
COMMIT
|
20
|
+
# Completed on Wed Feb 19 19:28:22 2014
|
21
|
+
# Generated by iptables-save v1.4.12 on Wed Feb 19 19:28:22 2014
|
22
|
+
*filter
|
23
|
+
:INPUT ACCEPT [1602:65593]
|
24
|
+
:FORWARD ACCEPT [79892700:14079015733]
|
25
|
+
:OUTPUT ACCEPT [173177551:46244981637]
|
26
|
+
:FWR - [0:0]
|
27
|
+
[162824485:36484450187] -A INPUT -j FWR
|
28
|
+
[104747465:21902005069] -A FWR -i lo -j ACCEPT
|
29
|
+
[57784384:14565443254] -A FWR -m state --state RELATED,ESTABLISHED -j ACCEPT
|
30
|
+
[1137:85820] -A FWR -p icmp -j ACCEPT
|
31
|
+
[141056:8463360] -A FWR -i docker+ -j ACCEPT
|
32
|
+
[0:0] -A FWR -s 1.1.1.13/32 -p tcp -m tcp --dport 9101 -j ACCEPT
|
33
|
+
[0:0] -A FWR -s 1.1.1.20/32 -p tcp -m tcp --dport 9102 -j ACCEPT
|
34
|
+
[0:0] -A FWR -s 1.1.1.19/32 -p tcp -m tcp --dport 9103 -j ACCEPT
|
35
|
+
[14230:850872] -A FWR -p tcp -m tcp --dport 80 -j ACCEPT
|
36
|
+
[107014:5849940] -A FWR -p tcp -m tcp --dport 443 -j ACCEPT
|
37
|
+
[0:0] -A FWR -s 1.1.1.20/32 -p tcp -m tcp -m multiport --dports 4949,5666 -j ACCEPT
|
38
|
+
[0:0] -A FWR -s 10.0.3.0/24 -p tcp -m tcp --dport 6379 -j ACCEPT
|
39
|
+
[11024:635312] -A FWR -p tcp -m tcp --dport 22 -j ACCEPT
|
40
|
+
[4:240] -A FWR -s 1.1.1.22/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
41
|
+
[0:0] -A FWR -s 1.1.1.22/32 -p udp -m udp --dport 8125 -j ACCEPT
|
42
|
+
[0:0] -A FWR -s 1.1.1.27/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
43
|
+
[0:0] -A FWR -s 1.1.1.27/32 -p udp -m udp --dport 8125 -j ACCEPT
|
44
|
+
[3:180] -A FWR -s 1.1.1.21/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
45
|
+
[0:0] -A FWR -s 1.1.1.21/32 -p udp -m udp --dport 8125 -j ACCEPT
|
46
|
+
[0:0] -A FWR -s 1.1.1.18/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
47
|
+
[0:0] -A FWR -s 1.1.1.18/32 -p udp -m udp --dport 8125 -j ACCEPT
|
48
|
+
[0:0] -A FWR -s 1.1.1.10/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
49
|
+
[0:0] -A FWR -s 1.1.1.10/32 -p udp -m udp --dport 8125 -j ACCEPT
|
50
|
+
[2:120] -A FWR -s 1.1.1.9/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
51
|
+
[0:0] -A FWR -s 1.1.1.9/32 -p udp -m udp --dport 8125 -j ACCEPT
|
52
|
+
[13:780] -A FWR -s 1.1.1.7/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
53
|
+
[0:0] -A FWR -s 1.1.1.7/32 -p udp -m udp --dport 8125 -j ACCEPT
|
54
|
+
[1:60] -A FWR -s 1.1.1.4/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
55
|
+
[0:0] -A FWR -s 1.1.1.4/32 -p udp -m udp --dport 8125 -j ACCEPT
|
56
|
+
[0:0] -A FWR -s 1.1.1.25/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
57
|
+
[0:0] -A FWR -s 1.1.1.25/32 -p udp -m udp --dport 8125 -j ACCEPT
|
58
|
+
[0:0] -A FWR -s 1.1.1.16/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
59
|
+
[0:0] -A FWR -s 1.1.1.16/32 -p udp -m udp --dport 8125 -j ACCEPT
|
60
|
+
[1:60] -A FWR -s 1.1.1.3/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
61
|
+
[0:0] -A FWR -s 1.1.1.3/32 -p udp -m udp --dport 8125 -j ACCEPT
|
62
|
+
[1:60] -A FWR -s 1.1.1.13/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
63
|
+
[0:0] -A FWR -s 1.1.1.13/32 -p udp -m udp --dport 8125 -j ACCEPT
|
64
|
+
[0:0] -A FWR -s 1.1.1.6/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
65
|
+
[0:0] -A FWR -s 1.1.1.6/32 -p udp -m udp --dport 8125 -j ACCEPT
|
66
|
+
[1:60] -A FWR -s 1.1.1.23/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
67
|
+
[0:0] -A FWR -s 1.1.1.23/32 -p udp -m udp --dport 8125 -j ACCEPT
|
68
|
+
[10:600] -A FWR -s 1.1.1.8/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
69
|
+
[0:0] -A FWR -s 1.1.1.8/32 -p udp -m udp --dport 8125 -j ACCEPT
|
70
|
+
[0:0] -A FWR -s 1.1.1.20/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
71
|
+
[0:0] -A FWR -s 1.1.1.20/32 -p udp -m udp --dport 8125 -j ACCEPT
|
72
|
+
[0:0] -A FWR -s 1.1.1.2/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
73
|
+
[0:0] -A FWR -s 1.1.1.2/32 -p udp -m udp --dport 8125 -j ACCEPT
|
74
|
+
[0:0] -A FWR -s 1.1.1.12/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
75
|
+
[0:0] -A FWR -s 1.1.1.12/32 -p udp -m udp --dport 8125 -j ACCEPT
|
76
|
+
[10:600] -A FWR -s 1.1.1.28/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
77
|
+
[0:0] -A FWR -s 1.1.1.28/32 -p udp -m udp --dport 8125 -j ACCEPT
|
78
|
+
[2:120] -A FWR -s 1.1.1.14/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
79
|
+
[0:0] -A FWR -s 1.1.1.14/32 -p udp -m udp --dport 8125 -j ACCEPT
|
80
|
+
[0:0] -A FWR -s 10.0.3.115/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
81
|
+
[0:0] -A FWR -s 10.0.3.115/32 -p udp -m udp --dport 8125 -j ACCEPT
|
82
|
+
[13:780] -A FWR -s 1.1.1.17/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
83
|
+
[0:0] -A FWR -s 1.1.1.17/32 -p udp -m udp --dport 8125 -j ACCEPT
|
84
|
+
[1:60] -A FWR -s 1.1.1.5/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
85
|
+
[0:0] -A FWR -s 1.1.1.5/32 -p udp -m udp --dport 8125 -j ACCEPT
|
86
|
+
[0:0] -A FWR -s 1.1.1.26/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
87
|
+
[0:0] -A FWR -s 1.1.1.26/32 -p udp -m udp --dport 8125 -j ACCEPT
|
88
|
+
[0:0] -A FWR -s 1.1.1.24/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
89
|
+
[0:0] -A FWR -s 1.1.1.24/32 -p udp -m udp --dport 8125 -j ACCEPT
|
90
|
+
[0:0] -A FWR -s 10.0.3.55/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
91
|
+
[0:0] -A FWR -s 10.0.3.55/32 -p udp -m udp --dport 8125 -j ACCEPT
|
92
|
+
[0:0] -A FWR -s 1.1.1.11/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
93
|
+
[0:0] -A FWR -s 1.1.1.11/32 -p udp -m udp --dport 8125 -j ACCEPT
|
94
|
+
[0:0] -A FWR -s 1.1.1.15/32 -p tcp -m tcp --dport 4514 -j ACCEPT
|
95
|
+
[0:0] -A FWR -s 1.1.1.15/32 -p udp -m udp --dport 8125 -j ACCEPT
|
96
|
+
[0:0] -A FWR -p tcp -m tcp --dport 22 -j ACCEPT
|
97
|
+
[0:0] -A FWR -p tcp -m tcp --dport 443 -j ACCEPT
|
98
|
+
[0:0] -A FWR -p tcp -m tcp --dport 80 -j ACCEPT
|
99
|
+
[15158:889352] -A FWR -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
|
100
|
+
[1353:157895] -A FWR -p udp -j REJECT --reject-with icmp-port-unreachable
|
101
|
+
COMMIT
|
102
|
+
# Completed on Wed Feb 19 19:28:22 2014
|