Editing Setting up an iptables firewall
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone.
Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
− | This document consists of two parts. The first is setting up a firewall (using iptables) on the | + | This document consists of two parts. The first is setting up a firewall (using iptables) on the HN, which will restrict traffic to the containers. The effect would emulate, as far as the containers and their customers are concerned, an external hardware firewall controlled by the sysadmin. The second is setting up a firewall that protects the HN itself but still allows traffic to the containers, thus allowing individual containers to define their own iptables. |
While the firewalls shown here can be accomplished using iptables manually (or using Fedora core's iptables service), the methods presented here are especially modular and easy to modify. This is important when you have 20+ containers and a lot of other things to be doing... | While the firewalls shown here can be accomplished using iptables manually (or using Fedora core's iptables service), the methods presented here are especially modular and easy to modify. This is important when you have 20+ containers and a lot of other things to be doing... | ||
Line 10: | Line 10: | ||
The exception to this is the nameserver, which we want open to the world. We use it as a caching nameserver for our containers and also to host DNS for a few customer domain. | The exception to this is the nameserver, which we want open to the world. We use it as a caching nameserver for our containers and also to host DNS for a few customer domain. | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
== Setting up a HN-based firewall == | == Setting up a HN-based firewall == | ||
Line 59: | Line 25: | ||
#!/bin/sh | #!/bin/sh | ||
# firewall Start iptables firewall | # firewall Start iptables firewall | ||
− | # chkconfig: 2345 | + | # chkconfig: 2345 08 92 |
# description: Starts, stops and saves iptables firewall | # description: Starts, stops and saves iptables firewall | ||
# This script sets up the firewall for the INPUT chain (which is for | # This script sets up the firewall for the INPUT chain (which is for | ||
Line 65: | Line 31: | ||
# /etc/firewall.d to set up additional rules in the FORWARD chain | # /etc/firewall.d to set up additional rules in the FORWARD chain | ||
# to allow access to containers' services. | # to allow access to containers' services. | ||
− | |||
. /etc/init.d/functions | . /etc/init.d/functions | ||
Line 157: | Line 122: | ||
;; | ;; | ||
esac | esac | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
</pre> | </pre> | ||
Line 191: | Line 149: | ||
</pre> | </pre> | ||
− | And there you go. | + | And there you go. Go ahead and start the firewall and check its status: |
− | |||
− | |||
− | |||
− | Go ahead and start the firewall and check its status: | ||
<pre> | <pre> | ||
service firewall restart | service firewall restart | ||
Line 203: | Line 157: | ||
As you can see, you can now add and edit the configurations for individual containers very easily. This method proves a lot easier to manage than Fedora's iptables-config mechamism! | As you can see, you can now add and edit the configurations for individual containers very easily. This method proves a lot easier to manage than Fedora's iptables-config mechamism! | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
== Setting up a firewall that allows per-container configuration == | == Setting up a firewall that allows per-container configuration == | ||
Line 225: | Line 162: | ||
This setup configures iptables on the HN to disallow access to all hosts, including the containers. However, it allows all traffic into the containers so they may define their own iptables rules and therefore manage their own firewall. | This setup configures iptables on the HN to disallow access to all hosts, including the containers. However, it allows all traffic into the containers so they may define their own iptables rules and therefore manage their own firewall. | ||
− | < | + | <code>This content is missing. You are invited to fill it in, if you get to it before I do. :)</code> |
− | |||
− | |||
− | |||
− | |||
− | This | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | </ | ||
− | |||
− | |||
== See also == | == See also == | ||
* [[Traffic accounting with iptables]] | * [[Traffic accounting with iptables]] | ||
− | |||
[[Category: Networking]] | [[Category: Networking]] |