ipscriptables 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (63) hide show
  1. checksums.yaml +15 -0
  2. data/.gitignore +17 -0
  3. data/.rubocop.yml +15 -0
  4. data/.travis.yml +10 -0
  5. data/CHANGELOG.md +6 -0
  6. data/CONTRIBUTING.md +43 -0
  7. data/Gemfile +13 -0
  8. data/LICENSE +20 -0
  9. data/README.md +54 -0
  10. data/Rakefile +22 -0
  11. data/bin/ipscriptables +6 -0
  12. data/cookbook/.gitignore +2 -0
  13. data/cookbook/.kitchen.yml +28 -0
  14. data/cookbook/Berksfile +6 -0
  15. data/cookbook/README.md +53 -0
  16. data/cookbook/attributes/default.rb +3 -0
  17. data/cookbook/chefignore +96 -0
  18. data/cookbook/libraries/default.rb +35 -0
  19. data/cookbook/metadata.rb +9 -0
  20. data/cookbook/providers/rules.rb +21 -0
  21. data/cookbook/recipes/default.rb +10 -0
  22. data/cookbook/recipes/load.rb +8 -0
  23. data/cookbook/resources/rules.rb +17 -0
  24. data/cookbook/test/cookbooks/ipscriptables-test/#metadata.rb# +8 -0
  25. data/cookbook/test/cookbooks/ipscriptables-test/metadata.rb +11 -0
  26. data/cookbook/test/cookbooks/ipscriptables-test/recipes/default.rb +23 -0
  27. data/cookbook/test/cookbooks/ipscriptables-test/recipes/prepare.rb +5 -0
  28. data/cookbook/test/data/.gitignore +1 -0
  29. data/cookbook/test/integration/default/bats/default.bats +9 -0
  30. data/doc/iptables-switches.txt +342 -0
  31. data/ipscriptables.gemspec +38 -0
  32. data/lib/ipscriptables.rb +14 -0
  33. data/lib/ipscriptables/chain.rb +83 -0
  34. data/lib/ipscriptables/cli.rb +19 -0
  35. data/lib/ipscriptables/helpers.rb +39 -0
  36. data/lib/ipscriptables/pretty_print.rb +58 -0
  37. data/lib/ipscriptables/rule.rb +95 -0
  38. data/lib/ipscriptables/ruleset.rb +103 -0
  39. data/lib/ipscriptables/ruleset/class_methods.rb +67 -0
  40. data/lib/ipscriptables/runtime.rb +97 -0
  41. data/lib/ipscriptables/table.rb +77 -0
  42. data/lib/ipscriptables/version.rb +5 -0
  43. data/spec/fixtures/clyhq.txt +40 -0
  44. data/spec/fixtures/docker-plus.txt +31 -0
  45. data/spec/fixtures/drumknott.txt +67 -0
  46. data/spec/fixtures/falcor.txt +39 -0
  47. data/spec/fixtures/ghq.txt +102 -0
  48. data/spec/fixtures/ip6tables-empty.txt +7 -0
  49. data/spec/fixtures/only-docker-c.txt +23 -0
  50. data/spec/fixtures/only-docker.txt +23 -0
  51. data/spec/fixtures/only_docker.rb +22 -0
  52. data/spec/fixtures/runtime.rb +7 -0
  53. data/spec/fixtures/runtime2.rb +16 -0
  54. data/spec/ipscriptables/dsl_spec.rb +74 -0
  55. data/spec/ipscriptables/helpers_spec.rb +58 -0
  56. data/spec/ipscriptables/rule_spec.rb +41 -0
  57. data/spec/ipscriptables/ruleset/class_methods_spec.rb +52 -0
  58. data/spec/ipscriptables/ruleset_spec.rb +199 -0
  59. data/spec/ipscriptables/runtime_spec.rb +227 -0
  60. data/spec/ipscriptables/table_spec.rb +32 -0
  61. data/spec/ipscriptables/version_spec.rb +12 -0
  62. data/spec/spec_helper.rb +60 -0
  63. metadata +350 -0
@@ -0,0 +1,67 @@
1
+ # -*- coding: utf-8 -*-
2
+
3
+ module IPScriptables
4
+ class Ruleset
5
+ include Helpers
6
+
7
+ class << self
8
+ def from_file(path, opts = {})
9
+ f = File.open(path)
10
+ from_io(f, opts)
11
+ ensure
12
+ f.close if f
13
+ end
14
+
15
+ def from_io(io, opts = {}) # rubocop:disable CyclomaticComplexity, MethodLength, LineLength
16
+ rs = new(opts.merge(skip_builtin_chains: true))
17
+ table = nil
18
+ io.each_line do |ln|
19
+ ln.strip!
20
+ case ln
21
+ when /^#/
22
+ # comment, skip it
23
+ when /^\*(.*)/
24
+ fail RuntimeError unless table.nil?
25
+ table = rs.table($1)
26
+ when /^:(\w+) (\w+|-) \[(\d+):(\d+)\]$/
27
+ table.chain $1, $2, [$3.to_i, $4.to_i]
28
+ when /^(\[(\d+):(\d+)\] )?-A (\w+) (.*)/
29
+ ch = table[$4]
30
+ rule = $5
31
+ counters = [$2.to_i, $3.to_i] if $1
32
+ ch.rule(Rule.new(ch, rule, counters))
33
+ when /^COMMIT$/
34
+ fail 'COMMIT without table' if table.nil?
35
+ table = nil
36
+ else
37
+ fail "Cannot parse iptables-save line: #{ln}"
38
+ end
39
+ end
40
+ rs
41
+ end
42
+ alias_method :from_s, :from_io # string also has `#each_line` method
43
+
44
+ def from_command(*args)
45
+ opts = args.last.is_a?(Hash) ? args.pop : {}
46
+ from_s(Helpers.run_command(*args), opts.merge(command: args))
47
+ end
48
+
49
+ def from_system(opts = {})
50
+ opts[:family] ||= :inet
51
+ case opts[:family]
52
+ when :inet then from_command 'iptables-save', '-c', opts
53
+ when :inet6 then from_command 'ip6tables-save', '-c', opts
54
+ else fail NotImplementedError, "Unknonwn family #{opts[:family]}"
55
+ end
56
+ end
57
+
58
+ def from_iptables(opts = {})
59
+ from_system(opts.merge(family: :inet))
60
+ end
61
+
62
+ def from_ip6tables(opts = {})
63
+ from_system(opts.merge(family: :inet6))
64
+ end
65
+ end
66
+ end
67
+ end
@@ -0,0 +1,97 @@
1
+ # -*- coding: utf-8 -*-
2
+ # rubocop:disable BlockNesting
3
+
4
+ require 'English'
5
+ require 'logger'
6
+
7
+ module IPScriptables
8
+ class Runtime
9
+ DEFAULT_OPTS = { counters: true }
10
+ attr_reader :log, :opts
11
+
12
+ def initialize(opts = {}, logger = nil)
13
+ @opts = DEFAULT_OPTS.merge(opts)
14
+ @log = logger || Logger.new($stderr)
15
+ @evaluating = 0
16
+ @rulesets = {}
17
+ end
18
+
19
+ def ruleset(family)
20
+ family = family.to_sym
21
+ @rulesets[family] ||=
22
+ IPScriptables::Ruleset.from_system(family: family).bud(opts)
23
+ end
24
+
25
+ def family(*families, &block)
26
+ families.each do |family|
27
+ begin
28
+ @evaluating += 1
29
+ ruleset(family).dsl_eval(&block)
30
+ ensure
31
+ @evaluating -= 1
32
+ end
33
+ end
34
+ end
35
+
36
+ def iptables(&block)
37
+ family(:inet, &block)
38
+ end
39
+
40
+ def ip6tables(&block)
41
+ family(:inet6, &block)
42
+ end
43
+
44
+ def load_file(path)
45
+ @evaluating += 1
46
+ log.info "Loading configuration from #{path}"
47
+ instance_eval(File.read(path), path)
48
+ ensure
49
+ @evaluating -= 1
50
+ end
51
+
52
+ def dsl_eval(&block)
53
+ @evaluating += 1
54
+ instance_eval(&block)
55
+ ensure
56
+ @evaluating -= 1
57
+ end
58
+
59
+ def execute! # rubocop:disable CyclomaticComplexity, MethodLength
60
+ if @evaluating != 0
61
+ fail "I can't let you do that (DSL eval depth #{@evaluating})"
62
+ end
63
+
64
+ ok = true
65
+ @rulesets.sort.each do |family, ruleset|
66
+ if !opts.fetch(family, true)
67
+ log.info "Skipping #{family} as requested"
68
+ else
69
+ diff = ruleset.diff
70
+ if diff.to_s.empty?
71
+ log.info "No changes for #{family}, moving along."
72
+ else
73
+ log.info "Changes found for #{family}"
74
+ format = opts.fetch(:color, $stdout.tty?) ? :color : :text
75
+ puts diff.to_s(format) unless opts[:quiet]
76
+ if opts[:apply]
77
+ log.info "Restoring #{family}"
78
+ begin
79
+ ruleset.restore!
80
+ rescue => e
81
+ log.error "Failure restoring #{family}: #{e}"
82
+ ok = false
83
+ return ok if opts[:fail_fast]
84
+ end
85
+ else
86
+ log.info "Would restore #{family}"
87
+ end
88
+ end
89
+ end
90
+ end
91
+
92
+ log.warn 'There were errors' unless ok
93
+
94
+ ok
95
+ end
96
+ end
97
+ end
@@ -0,0 +1,77 @@
1
+ # -*- coding: utf-8 -*-
2
+
3
+ module IPScriptables
4
+ class Table
5
+ extend Forwardable
6
+ def_delegators :@chains, :[]=, :[], :keys
7
+ def_delegators :to_ary, :each, :empty?
8
+ def_delegators :ruleset, :opts
9
+ include Enumerable
10
+
11
+ attr_reader :name, :ruleset
12
+ def initialize(name, ruleset, &block)
13
+ @name = name.to_sym
14
+ @chains = Hashie::Mash.new
15
+ @ruleset = ruleset
16
+
17
+ create_builtin_chains unless ruleset.opts[:skip_builtin_chains]
18
+
19
+ Docile.dsl_eval(self, &block) if block_given?
20
+ end
21
+
22
+ def original
23
+ ruleset.original[name] if ruleset.original
24
+ end
25
+
26
+ BUILTIN_CHAINS = {
27
+ filter: [:INPUT, :FORWARD, :OUTPUT],
28
+ nat: [:PREROUTING, :INPUT, :OUTPUT, :POSTROUTING],
29
+ mangle: [:PREROUTING, :INPUT, :OUTPUT, :FORWARD, :POSTROUTING],
30
+ raw: [:PREROUTING, :OUTPUT],
31
+ security: [:INPUT, :OUTPUT, :FORWARD]
32
+ }
33
+
34
+ def create_builtin_chains
35
+ if BUILTIN_CHAINS.key? @name
36
+ BUILTIN_CHAINS[@name].each do |builtin|
37
+ chain builtin, :ACCEPT
38
+ end
39
+ else
40
+ warn "Unrecognized table #{@name}, not creating builtin chains"
41
+ end
42
+ end
43
+
44
+ def inherit(*names, &block) # rubocop:disable MethodLength
45
+ fail 'Need original to inherit' unless ruleset.original
46
+ original_table = ruleset.original[name]
47
+ names = original_table.keys if names.empty?
48
+ names.each do |name|
49
+ original_chain = original_table[name]
50
+ original_rules = original_chain.rules
51
+ original_rules = original_rules.select(&block) if block_given?
52
+ chain name, original_chain.policy, original_chain.counters do
53
+ rules.concat(original_rules)
54
+ end
55
+ end
56
+ end
57
+
58
+ def to_ary
59
+ @chains.values
60
+ end
61
+
62
+ def chain(name, *args, &block)
63
+ if @chains.key?(name)
64
+ @chains[name].alter(*args, &block)
65
+ else
66
+ @chains[name] = Chain.new(name, self, *args, &block)
67
+ end
68
+ end
69
+
70
+ def render
71
+ ["*#{name}",
72
+ map(&:render_header).join("\n"),
73
+ map(&:render_rules).compact.join("\n"),
74
+ 'COMMIT'].reject { |piece| piece == '' }.join("\n")
75
+ end
76
+ end
77
+ end
@@ -0,0 +1,5 @@
1
+ # -*- coding: utf-8 -*-
2
+
3
+ module IPScriptables
4
+ VERSION = '0.0.1'
5
+ end
@@ -0,0 +1,40 @@
1
+ # Generated by iptables-save v1.4.12 on Tue Feb 18 15:14:18 2014
2
+ *filter
3
+ :INPUT ACCEPT [0:0]
4
+ :FORWARD ACCEPT [0:0]
5
+ :OUTPUT ACCEPT [5012201:449061115]
6
+ -A INPUT -p tcp -m tcp --dport 17443 -j ACCEPT
7
+ -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
8
+ -A INPUT -p icmp -j ACCEPT
9
+ -A INPUT -i docker+ -j ACCEPT
10
+ -A INPUT -i lo -j ACCEPT
11
+ -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
12
+ -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
13
+ -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
14
+ -A INPUT -j REJECT --reject-with icmp-port-unreachable
15
+ -A FORWARD -s 172.17.1.8/32 -d 172.17.1.86/32 -i docker0 -o docker0 -p tcp -m tcp --sport 6379 -j ACCEPT
16
+ -A FORWARD -s 172.17.1.86/32 -d 172.17.1.8/32 -i docker0 -o docker0 -p tcp -m tcp --dport 6379 -j ACCEPT
17
+ -A FORWARD -s 172.17.1.8/32 -d 172.17.1.85/32 -i docker0 -o docker0 -p tcp -m tcp --sport 6379 -j ACCEPT
18
+ -A FORWARD -s 172.17.1.85/32 -d 172.17.1.8/32 -i docker0 -o docker0 -p tcp -m tcp --dport 6379 -j ACCEPT
19
+ -A FORWARD -i docker0 -o docker0 -j ACCEPT
20
+ -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
21
+ -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
22
+ COMMIT
23
+ # Completed on Tue Feb 18 15:14:18 2014
24
+ # Generated by iptables-save v1.4.12 on Tue Feb 18 15:14:18 2014
25
+ *nat
26
+ :PREROUTING ACCEPT [1039:60550]
27
+ :INPUT ACCEPT [929:53219]
28
+ :OUTPUT ACCEPT [814:53755]
29
+ :POSTROUTING ACCEPT [822:54235]
30
+ :DOCKER - [0:0]
31
+ -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
32
+ -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
33
+ -A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
34
+ -A POSTROUTING -s 172.17.0.0/16 ! -d 172.17.0.0/16 -j MASQUERADE
35
+ -A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 8511 -j DNAT --to-destination 172.17.1.6:8080
36
+ -A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 8510 -j DNAT --to-destination 172.17.1.7:8080
37
+ -A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 8501 -j DNAT --to-destination 172.17.1.84:8080
38
+ -A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 8500 -j DNAT --to-destination 172.17.1.85:8080
39
+ COMMIT
40
+ # Completed on Tue Feb 18 15:14:18 2014
@@ -0,0 +1,31 @@
1
+ # Generated by iptables-save v1.4.12 on Wed Feb 19 13:37:35 2014
2
+ *filter
3
+ :INPUT ACCEPT [211:14626]
4
+ :FORWARD ACCEPT [0:0]
5
+ :OUTPUT ACCEPT [122:11280]
6
+ -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
7
+ -A INPUT -p icmp -j ACCEPT
8
+ -A INPUT -i docker0 -j ACCEPT
9
+ -A INPUT -i lo -j ACCEPT
10
+ -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
11
+ -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
12
+ -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
13
+ -A INPUT -j REJECT --reject-with icmp-port-unreachable
14
+ -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
15
+ -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
16
+ -A FORWARD -i docker0 -o docker0 -j ACCEPT
17
+ COMMIT
18
+ # Completed on Wed Feb 19 13:37:35 2014
19
+ # Generated by iptables-save v1.4.12 on Wed Feb 19 13:37:35 2014
20
+ *nat
21
+ :PREROUTING ACCEPT [5:1208]
22
+ :INPUT ACCEPT [5:1208]
23
+ :OUTPUT ACCEPT [42:3215]
24
+ :POSTROUTING ACCEPT [42:3215]
25
+ :DOCKER - [0:0]
26
+ -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
27
+ -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
28
+ -A POSTROUTING -s 172.17.0.0/16 ! -d 172.17.0.0/16 -j MASQUERADE
29
+ -A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
30
+ COMMIT
31
+ # Completed on Wed Feb 19 13:37:35 2014
@@ -0,0 +1,67 @@
1
+ # Generated by iptables-save v1.4.12 on Tue Feb 18 13:47:34 2014
2
+ *mangle
3
+ :PREROUTING ACCEPT [9070264:2761485141]
4
+ :INPUT ACCEPT [5794:541194]
5
+ :FORWARD ACCEPT [9064470:2760943947]
6
+ :OUTPUT ACCEPT [4447:1027385]
7
+ :POSTROUTING ACCEPT [9068917:2761971332]
8
+ COMMIT
9
+ # Completed on Tue Feb 18 13:47:34 2014
10
+ # Generated by iptables-save v1.4.12 on Tue Feb 18 13:47:34 2014
11
+ *nat
12
+ :PREROUTING ACCEPT [936831:58138468]
13
+ :INPUT ACCEPT [383149:28442596]
14
+ :OUTPUT ACCEPT [188115:19311882]
15
+ :POSTROUTING ACCEPT [88176135:5298607741]
16
+ :DOCKER - [0:0]
17
+ -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
18
+ -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
19
+ -A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
20
+ -A POSTROUTING -s 172.17.0.0/16 ! -d 172.17.0.0/16 -j MASQUERADE
21
+ -A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
22
+ -A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
23
+ -A DOCKER ! -i docker0 -p tcp -m tcp --dport 6379 -j DNAT --to-destination 172.17.0.2:6379
24
+ COMMIT
25
+ # Completed on Tue Feb 18 13:47:34 2014
26
+ # Generated by iptables-save v1.4.12 on Tue Feb 18 13:47:34 2014
27
+ *filter
28
+ :INPUT ACCEPT [419:18560]
29
+ :FORWARD ACCEPT [5802508472:1613710597740]
30
+ :OUTPUT ACCEPT [2072879:485657573]
31
+ :FWR - [0:0]
32
+ -A INPUT -j FWR
33
+ -A FWR -i lo -j ACCEPT
34
+ -A FWR -m state --state RELATED,ESTABLISHED -j ACCEPT
35
+ -A FWR -p icmp -j ACCEPT
36
+ -A FWR -i docker+ -j ACCEPT
37
+ -A FWR -s 1.1.1.1/32 -p tcp -m tcp --dport 9102 -j ACCEPT
38
+ -A FWR -s 1.1.1.1/32 -p tcp -m tcp -m multiport --dports 4949,5666 -j ACCEPT
39
+ -A FWR -s 10.0.3.55/32 -p tcp -m tcp --dport 6379 -j ACCEPT
40
+ -A FWR -s 1.1.2.2/32 -p tcp -m tcp --dport 6379 -j ACCEPT
41
+ -A FWR -s 1.1.2.3/32 -p tcp -m tcp --dport 6379 -j ACCEPT
42
+ -A FWR -s 1.1.2.12/32 -p tcp -m tcp --dport 6379 -j ACCEPT
43
+ -A FWR -s 1.1.2.13/32 -p tcp -m tcp --dport 6379 -j ACCEPT
44
+ -A FWR -s 1.1.2.4/32 -p tcp -m tcp --dport 6379 -j ACCEPT
45
+ -A FWR -s 1.1.2.15/32 -p tcp -m tcp --dport 6379 -j ACCEPT
46
+ -A FWR -s 1.1.2.16/32 -p tcp -m tcp --dport 6379 -j ACCEPT
47
+ -A FWR -s 1.1.2.5/32 -p tcp -m tcp --dport 6379 -j ACCEPT
48
+ -A FWR -s 1.1.2.6/32 -p tcp -m tcp --dport 6379 -j ACCEPT
49
+ -A FWR -s 1.1.2.7/32 -p tcp -m tcp --dport 6379 -j ACCEPT
50
+ -A FWR -s 1.1.2.8/32 -p tcp -m tcp --dport 6379 -j ACCEPT
51
+ -A FWR -s 1.1.2.9/32 -p tcp -m tcp --dport 6379 -j ACCEPT
52
+ -A FWR -s 1.1.2.10/32 -p tcp -m tcp --dport 6379 -j ACCEPT
53
+ -A FWR -s 1.1.2.11/32 -p tcp -m tcp --dport 6379 -j ACCEPT
54
+ -A FWR -s 1.1.2.14/32 -p tcp -m tcp --dport 6379 -j ACCEPT
55
+ -A FWR -s 1.1.2.15/32 -p tcp -m tcp --dport 6379 -j ACCEPT
56
+ -A FWR -s 1.1.2.15/32 -p tcp -m tcp --dport 6379 -j ACCEPT
57
+ -A FWR -s 1.1.2.17/32 -p tcp -m tcp --dport 6379 -j ACCEPT
58
+ -A FWR -s 1.1.2.18/32 -p tcp -m tcp --dport 6379 -j ACCEPT
59
+ -A FWR -s 1.1.2.19/32 -p tcp -m tcp --dport 6379 -j ACCEPT
60
+ -A FWR -s 1.1.2.20/32 -p tcp -m tcp --dport 6379 -j ACCEPT
61
+ -A FWR -s 1.1.2.21/32 -p tcp -m tcp --dport 6379 -j ACCEPT
62
+ -A FWR -s 10.0.3.0/24 -p tcp -m tcp --dport 6379 -j ACCEPT
63
+ -A FWR -p tcp -m tcp --dport 22 -j ACCEPT
64
+ -A FWR -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
65
+ -A FWR -p udp -j REJECT --reject-with icmp-port-unreachable
66
+ COMMIT
67
+ # Completed on Tue Feb 18 13:47:34 2014
@@ -0,0 +1,39 @@
1
+ # Generated by iptables-save v1.4.12 on Tue Feb 18 15:24:18 2014
2
+ *nat
3
+ :PREROUTING ACCEPT [110285:6967475]
4
+ :INPUT ACCEPT [61845:3770509]
5
+ :OUTPUT ACCEPT [138431:9598104]
6
+ :POSTROUTING ACCEPT [137629:9513158]
7
+ :DOCKER - [0:0]
8
+ -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
9
+ -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
10
+ -A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
11
+ -A POSTROUTING -s 172.17.0.0/16 ! -d 172.17.0.0/16 -j MASQUERADE
12
+ -A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 5000 -j DNAT --to-destination 172.17.0.60:5000
13
+ COMMIT
14
+ # Completed on Tue Feb 18 15:24:18 2014
15
+ # Generated by iptables-save v1.4.12 on Tue Feb 18 15:24:18 2014
16
+ *filter
17
+ :INPUT ACCEPT [333:14408]
18
+ :FORWARD ACCEPT [0:0]
19
+ :OUTPUT ACCEPT [182095162:19602137698]
20
+ :FWR - [0:0]
21
+ :LXC - [0:0]
22
+ -A INPUT -i lxcbr0 -j LXC
23
+ -A INPUT -j FWR
24
+ -A FORWARD -i docker0 -o docker0 -j ACCEPT
25
+ -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
26
+ -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
27
+ -A FWR -i lo -j ACCEPT
28
+ -A FWR -m state --state RELATED,ESTABLISHED -j ACCEPT
29
+ -A FWR -p icmp -j ACCEPT
30
+ -A FWR -i docker+ -j ACCEPT
31
+ -A FWR -p tcp -m tcp --dport 22 -j ACCEPT
32
+ -A FWR -p tcp -m tcp --dport 80 -j ACCEPT
33
+ -A FWR -p tcp -m tcp --dport 443 -j ACCEPT
34
+ -A FWR -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
35
+ -A FWR -p udp -j REJECT --reject-with icmp-port-unreachable
36
+ -A LXC -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT
37
+ -A LXC -j RETURN
38
+ COMMIT
39
+ # Completed on Tue Feb 18 15:24:18 2014
@@ -0,0 +1,102 @@
1
+ # Generated by iptables-save v1.4.12 on Wed Feb 19 19:28:22 2014
2
+ *nat
3
+ :PREROUTING ACCEPT [732601:44001989]
4
+ :INPUT ACCEPT [376018:22538408]
5
+ :OUTPUT ACCEPT [3131507:229597576]
6
+ :POSTROUTING ACCEPT [20476198:1943580383]
7
+ :DOCKER - [0:0]
8
+ [17617331:1738357444] -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
9
+ [138372:9654576] -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
10
+ [0:0] -A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
11
+ [12:912] -A POSTROUTING -s 172.17.0.0/16 ! -d 172.17.0.0/16 -j MASQUERADE
12
+ [2:120] -A DOCKER ! -i docker0 -p tcp -m tcp --dport 2003 -j DNAT --to-destination 172.17.0.4:2003
13
+ [0:0] -A DOCKER ! -i docker0 -p tcp -m tcp --dport 2004 -j DNAT --to-destination 172.17.0.4:2004
14
+ [0:0] -A DOCKER ! -i docker0 -p tcp -m tcp --dport 49153 -j DNAT --to-destination 172.17.0.8:9000
15
+ [95:5580] -A DOCKER ! -i docker0 -p tcp -m tcp --dport 5000 -j DNAT --to-destination 172.17.0.5:5000
16
+ [0:0] -A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 49154 -j DNAT --to-destination 172.17.0.9:8080
17
+ [17011603:1693997647] -A DOCKER ! -i docker0 -p udp -m udp --dport 8125 -j DNAT --to-destination 172.17.0.10:8125
18
+ [0:0] -A DOCKER -d 127.0.0.1/32 ! -i docker0 -p tcp -m tcp --dport 49155 -j DNAT --to-destination 172.17.0.10:8126
19
+ COMMIT
20
+ # Completed on Wed Feb 19 19:28:22 2014
21
+ # Generated by iptables-save v1.4.12 on Wed Feb 19 19:28:22 2014
22
+ *filter
23
+ :INPUT ACCEPT [1602:65593]
24
+ :FORWARD ACCEPT [79892700:14079015733]
25
+ :OUTPUT ACCEPT [173177551:46244981637]
26
+ :FWR - [0:0]
27
+ [162824485:36484450187] -A INPUT -j FWR
28
+ [104747465:21902005069] -A FWR -i lo -j ACCEPT
29
+ [57784384:14565443254] -A FWR -m state --state RELATED,ESTABLISHED -j ACCEPT
30
+ [1137:85820] -A FWR -p icmp -j ACCEPT
31
+ [141056:8463360] -A FWR -i docker+ -j ACCEPT
32
+ [0:0] -A FWR -s 1.1.1.13/32 -p tcp -m tcp --dport 9101 -j ACCEPT
33
+ [0:0] -A FWR -s 1.1.1.20/32 -p tcp -m tcp --dport 9102 -j ACCEPT
34
+ [0:0] -A FWR -s 1.1.1.19/32 -p tcp -m tcp --dport 9103 -j ACCEPT
35
+ [14230:850872] -A FWR -p tcp -m tcp --dport 80 -j ACCEPT
36
+ [107014:5849940] -A FWR -p tcp -m tcp --dport 443 -j ACCEPT
37
+ [0:0] -A FWR -s 1.1.1.20/32 -p tcp -m tcp -m multiport --dports 4949,5666 -j ACCEPT
38
+ [0:0] -A FWR -s 10.0.3.0/24 -p tcp -m tcp --dport 6379 -j ACCEPT
39
+ [11024:635312] -A FWR -p tcp -m tcp --dport 22 -j ACCEPT
40
+ [4:240] -A FWR -s 1.1.1.22/32 -p tcp -m tcp --dport 4514 -j ACCEPT
41
+ [0:0] -A FWR -s 1.1.1.22/32 -p udp -m udp --dport 8125 -j ACCEPT
42
+ [0:0] -A FWR -s 1.1.1.27/32 -p tcp -m tcp --dport 4514 -j ACCEPT
43
+ [0:0] -A FWR -s 1.1.1.27/32 -p udp -m udp --dport 8125 -j ACCEPT
44
+ [3:180] -A FWR -s 1.1.1.21/32 -p tcp -m tcp --dport 4514 -j ACCEPT
45
+ [0:0] -A FWR -s 1.1.1.21/32 -p udp -m udp --dport 8125 -j ACCEPT
46
+ [0:0] -A FWR -s 1.1.1.18/32 -p tcp -m tcp --dport 4514 -j ACCEPT
47
+ [0:0] -A FWR -s 1.1.1.18/32 -p udp -m udp --dport 8125 -j ACCEPT
48
+ [0:0] -A FWR -s 1.1.1.10/32 -p tcp -m tcp --dport 4514 -j ACCEPT
49
+ [0:0] -A FWR -s 1.1.1.10/32 -p udp -m udp --dport 8125 -j ACCEPT
50
+ [2:120] -A FWR -s 1.1.1.9/32 -p tcp -m tcp --dport 4514 -j ACCEPT
51
+ [0:0] -A FWR -s 1.1.1.9/32 -p udp -m udp --dport 8125 -j ACCEPT
52
+ [13:780] -A FWR -s 1.1.1.7/32 -p tcp -m tcp --dport 4514 -j ACCEPT
53
+ [0:0] -A FWR -s 1.1.1.7/32 -p udp -m udp --dport 8125 -j ACCEPT
54
+ [1:60] -A FWR -s 1.1.1.4/32 -p tcp -m tcp --dport 4514 -j ACCEPT
55
+ [0:0] -A FWR -s 1.1.1.4/32 -p udp -m udp --dport 8125 -j ACCEPT
56
+ [0:0] -A FWR -s 1.1.1.25/32 -p tcp -m tcp --dport 4514 -j ACCEPT
57
+ [0:0] -A FWR -s 1.1.1.25/32 -p udp -m udp --dport 8125 -j ACCEPT
58
+ [0:0] -A FWR -s 1.1.1.16/32 -p tcp -m tcp --dport 4514 -j ACCEPT
59
+ [0:0] -A FWR -s 1.1.1.16/32 -p udp -m udp --dport 8125 -j ACCEPT
60
+ [1:60] -A FWR -s 1.1.1.3/32 -p tcp -m tcp --dport 4514 -j ACCEPT
61
+ [0:0] -A FWR -s 1.1.1.3/32 -p udp -m udp --dport 8125 -j ACCEPT
62
+ [1:60] -A FWR -s 1.1.1.13/32 -p tcp -m tcp --dport 4514 -j ACCEPT
63
+ [0:0] -A FWR -s 1.1.1.13/32 -p udp -m udp --dport 8125 -j ACCEPT
64
+ [0:0] -A FWR -s 1.1.1.6/32 -p tcp -m tcp --dport 4514 -j ACCEPT
65
+ [0:0] -A FWR -s 1.1.1.6/32 -p udp -m udp --dport 8125 -j ACCEPT
66
+ [1:60] -A FWR -s 1.1.1.23/32 -p tcp -m tcp --dport 4514 -j ACCEPT
67
+ [0:0] -A FWR -s 1.1.1.23/32 -p udp -m udp --dport 8125 -j ACCEPT
68
+ [10:600] -A FWR -s 1.1.1.8/32 -p tcp -m tcp --dport 4514 -j ACCEPT
69
+ [0:0] -A FWR -s 1.1.1.8/32 -p udp -m udp --dport 8125 -j ACCEPT
70
+ [0:0] -A FWR -s 1.1.1.20/32 -p tcp -m tcp --dport 4514 -j ACCEPT
71
+ [0:0] -A FWR -s 1.1.1.20/32 -p udp -m udp --dport 8125 -j ACCEPT
72
+ [0:0] -A FWR -s 1.1.1.2/32 -p tcp -m tcp --dport 4514 -j ACCEPT
73
+ [0:0] -A FWR -s 1.1.1.2/32 -p udp -m udp --dport 8125 -j ACCEPT
74
+ [0:0] -A FWR -s 1.1.1.12/32 -p tcp -m tcp --dport 4514 -j ACCEPT
75
+ [0:0] -A FWR -s 1.1.1.12/32 -p udp -m udp --dport 8125 -j ACCEPT
76
+ [10:600] -A FWR -s 1.1.1.28/32 -p tcp -m tcp --dport 4514 -j ACCEPT
77
+ [0:0] -A FWR -s 1.1.1.28/32 -p udp -m udp --dport 8125 -j ACCEPT
78
+ [2:120] -A FWR -s 1.1.1.14/32 -p tcp -m tcp --dport 4514 -j ACCEPT
79
+ [0:0] -A FWR -s 1.1.1.14/32 -p udp -m udp --dport 8125 -j ACCEPT
80
+ [0:0] -A FWR -s 10.0.3.115/32 -p tcp -m tcp --dport 4514 -j ACCEPT
81
+ [0:0] -A FWR -s 10.0.3.115/32 -p udp -m udp --dport 8125 -j ACCEPT
82
+ [13:780] -A FWR -s 1.1.1.17/32 -p tcp -m tcp --dport 4514 -j ACCEPT
83
+ [0:0] -A FWR -s 1.1.1.17/32 -p udp -m udp --dport 8125 -j ACCEPT
84
+ [1:60] -A FWR -s 1.1.1.5/32 -p tcp -m tcp --dport 4514 -j ACCEPT
85
+ [0:0] -A FWR -s 1.1.1.5/32 -p udp -m udp --dport 8125 -j ACCEPT
86
+ [0:0] -A FWR -s 1.1.1.26/32 -p tcp -m tcp --dport 4514 -j ACCEPT
87
+ [0:0] -A FWR -s 1.1.1.26/32 -p udp -m udp --dport 8125 -j ACCEPT
88
+ [0:0] -A FWR -s 1.1.1.24/32 -p tcp -m tcp --dport 4514 -j ACCEPT
89
+ [0:0] -A FWR -s 1.1.1.24/32 -p udp -m udp --dport 8125 -j ACCEPT
90
+ [0:0] -A FWR -s 10.0.3.55/32 -p tcp -m tcp --dport 4514 -j ACCEPT
91
+ [0:0] -A FWR -s 10.0.3.55/32 -p udp -m udp --dport 8125 -j ACCEPT
92
+ [0:0] -A FWR -s 1.1.1.11/32 -p tcp -m tcp --dport 4514 -j ACCEPT
93
+ [0:0] -A FWR -s 1.1.1.11/32 -p udp -m udp --dport 8125 -j ACCEPT
94
+ [0:0] -A FWR -s 1.1.1.15/32 -p tcp -m tcp --dport 4514 -j ACCEPT
95
+ [0:0] -A FWR -s 1.1.1.15/32 -p udp -m udp --dport 8125 -j ACCEPT
96
+ [0:0] -A FWR -p tcp -m tcp --dport 22 -j ACCEPT
97
+ [0:0] -A FWR -p tcp -m tcp --dport 443 -j ACCEPT
98
+ [0:0] -A FWR -p tcp -m tcp --dport 80 -j ACCEPT
99
+ [15158:889352] -A FWR -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
100
+ [1353:157895] -A FWR -p udp -j REJECT --reject-with icmp-port-unreachable
101
+ COMMIT
102
+ # Completed on Wed Feb 19 19:28:22 2014