Skip to content

Commit b53bdce

Browse files
robmryrobmry
committed
Add static filter-FORWARD rules during bridge driver init
Rules no longer need to be rearranged when creating a network. Per-network rules are always appended to the FORWARD chain so, after adding them, there's no need to delete the per-driver rules to re-insert them at the top of the chain. Signed-off-by: Rob Murray <[email protected]>
1 parent 17a635c commit b53bdce

21 files changed

Lines changed: 146 additions & 88 deletions

‎integration/network/bridge/iptablesdoc/generated/new-daemon.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ Table `filter`:
1414
2 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED
1515
3 0 0 DOCKER-ISOLATION-STAGE-1 0 -- * * 0.0.0.0/0 0.0.0.0/0
1616
4 0 0 DOCKER 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst
17-
5 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
18-
6 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
17+
5 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
18+
6 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
1919

2020
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
2121
num pkts bytes target prot opt in out source destination
@@ -51,8 +51,8 @@ Table `filter`:
5151
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
5252
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
5353
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER
54-
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
5554
-A FORWARD -i docker0 -o docker0 -j ACCEPT
55+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
5656
-A DOCKER ! -i docker0 -o docker0 -j DROP
5757
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
5858
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
@@ -86,11 +86,12 @@ The FORWARD chain rules are numbered in the output above, they are:
8686
matching against the `docker-ext-bridge-v[46]` set. Added when the network is
8787
created, in [setupIPTables][13].
8888
The DOCKER chain implements per-port/protocol filtering for each container.
89-
5. ACCEPT any packet leaving a network, also set up when the network is created, in
90-
[setupIPTablesInternal][14].
91-
6. ACCEPT packets flowing between containers within a network, because by default
89+
5. ACCEPT packets flowing between containers within a network, because by default
9290
container isolation is disabled. Also set up when the network is created, in
9391
[setIcc][15].
92+
6. ACCEPT any packet leaving a network, also set up when the network is created, in
93+
[setupIPTablesInternal][14].
94+
9495

9596
[10]: https://github.com/moby/moby/blob/e05848c0025b67a16aaafa8cdff95d5e2c064105/libnetwork/firewall_linux.go#L50
9697
[11]: https://github.com/robmry/moby/blob/52c89d467fc5326149e4bbb8903d23589b66ff0d/libnetwork/drivers/bridge/setup_ip_tables_linux.go#L230-L232

‎integration/network/bridge/iptablesdoc/generated/usernet-internal.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@ The filter table is updated as follows:
1919
2 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED
2020
3 0 0 DOCKER-ISOLATION-STAGE-1 0 -- * * 0.0.0.0/0 0.0.0.0/0
2121
4 0 0 DOCKER 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst
22-
5 0 0 ACCEPT 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
22+
5 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
2323
6 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
24-
7 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
24+
7 0 0 ACCEPT 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
2525

2626
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
2727
num pkts bytes target prot opt in out source destination
@@ -59,9 +59,9 @@ The filter table is updated as follows:
5959
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6060
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
6161
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER
62-
-A FORWARD -i bridge1 -o bridge1 -j ACCEPT
63-
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
6462
-A FORWARD -i docker0 -o docker0 -j ACCEPT
63+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
64+
-A FORWARD -i bridge1 -o bridge1 -j ACCEPT
6565
-A DOCKER ! -i docker0 -o docker0 -j DROP
6666
-A DOCKER-ISOLATION-STAGE-1 ! -s 192.0.2.0/24 -o bridge1 -j DROP
6767
-A DOCKER-ISOLATION-STAGE-1 ! -d 192.0.2.0/24 -i bridge1 -j DROP

‎integration/network/bridge/iptablesdoc/generated/usernet-portmap-natunprot.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ The filter table is:
1919
2 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED
2020
3 0 0 DOCKER-ISOLATION-STAGE-1 0 -- * * 0.0.0.0/0 0.0.0.0/0
2121
4 0 0 DOCKER 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst
22-
5 0 0 ACCEPT 0 -- bridge1 !bridge1 0.0.0.0/0 0.0.0.0/0
23-
6 0 0 ACCEPT 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
24-
7 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
25-
8 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
22+
5 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
23+
6 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
24+
7 0 0 ACCEPT 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
25+
8 0 0 ACCEPT 0 -- bridge1 !bridge1 0.0.0.0/0 0.0.0.0/0
2626

2727
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
2828
num pkts bytes target prot opt in out source destination
@@ -61,10 +61,10 @@ The filter table is:
6161
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6262
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
6363
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER
64-
-A FORWARD -i bridge1 ! -o bridge1 -j ACCEPT
65-
-A FORWARD -i bridge1 -o bridge1 -j ACCEPT
66-
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
6764
-A FORWARD -i docker0 -o docker0 -j ACCEPT
65+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
66+
-A FORWARD -i bridge1 -o bridge1 -j ACCEPT
67+
-A FORWARD -i bridge1 ! -o bridge1 -j ACCEPT
6868
-A DOCKER ! -i docker0 -o docker0 -j DROP
6969
-A DOCKER ! -i bridge1 -o bridge1 -j ACCEPT
7070
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2

‎integration/network/bridge/iptablesdoc/generated/usernet-portmap-noicc.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ The filter table is:
1919
2 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED
2020
3 0 0 DOCKER-ISOLATION-STAGE-1 0 -- * * 0.0.0.0/0 0.0.0.0/0
2121
4 0 0 DOCKER 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst
22-
5 0 0 ACCEPT 0 -- bridge1 !bridge1 0.0.0.0/0 0.0.0.0/0
22+
5 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
2323
6 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
24-
7 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
25-
8 0 0 DROP 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
24+
7 0 0 DROP 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
25+
8 0 0 ACCEPT 0 -- bridge1 !bridge1 0.0.0.0/0 0.0.0.0/0
2626

2727
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
2828
num pkts bytes target prot opt in out source destination
@@ -62,10 +62,10 @@ The filter table is:
6262
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6363
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
6464
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER
65-
-A FORWARD -i bridge1 ! -o bridge1 -j ACCEPT
66-
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
6765
-A FORWARD -i docker0 -o docker0 -j ACCEPT
66+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
6867
-A FORWARD -i bridge1 -o bridge1 -j DROP
68+
-A FORWARD -i bridge1 ! -o bridge1 -j ACCEPT
6969
-A DOCKER -d 192.0.2.2/32 ! -i bridge1 -o bridge1 -p tcp -m tcp --dport 80 -j ACCEPT
7070
-A DOCKER ! -i docker0 -o docker0 -j DROP
7171
-A DOCKER ! -i bridge1 -o bridge1 -j DROP
@@ -80,7 +80,7 @@ The filter table is:
8080

8181
By comparison with [ICC=true][1]:
8282

83-
- Rule 8 in the FORWARD chain replaces an ACCEPT rule that would have followed rule 5, matching the same packets.
83+
- Rule 7 in the FORWARD chain replaces an ACCEPT rule that would have followed rule 5, matching the same packets.
8484
- Added in [setIcc][2]
8585

8686
[1]: usernet-portmap.md

‎integration/network/bridge/iptablesdoc/generated/usernet-portmap-noproxy.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ The filter table is the same as with the userland proxy enabled.
2222
2 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED
2323
3 0 0 DOCKER-ISOLATION-STAGE-1 0 -- * * 0.0.0.0/0 0.0.0.0/0
2424
4 0 0 DOCKER 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst
25-
5 0 0 ACCEPT 0 -- bridge1 !bridge1 0.0.0.0/0 0.0.0.0/0
26-
6 0 0 ACCEPT 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
27-
7 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
28-
8 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
25+
5 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
26+
6 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
27+
7 0 0 ACCEPT 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
28+
8 0 0 ACCEPT 0 -- bridge1 !bridge1 0.0.0.0/0 0.0.0.0/0
2929

3030
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
3131
num pkts bytes target prot opt in out source destination
@@ -62,10 +62,10 @@ The filter table is the same as with the userland proxy enabled.
6262
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6363
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
6464
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER
65-
-A FORWARD -i bridge1 ! -o bridge1 -j ACCEPT
66-
-A FORWARD -i bridge1 -o bridge1 -j ACCEPT
67-
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
6865
-A FORWARD -i docker0 -o docker0 -j ACCEPT
66+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
67+
-A FORWARD -i bridge1 -o bridge1 -j ACCEPT
68+
-A FORWARD -i bridge1 ! -o bridge1 -j ACCEPT
6969
-A DOCKER -d 192.0.2.2/32 ! -i bridge1 -o bridge1 -p tcp -m tcp --dport 80 -j ACCEPT
7070
-A DOCKER ! -i docker0 -o docker0 -j DROP
7171
-A DOCKER ! -i bridge1 -o bridge1 -j DROP

‎integration/network/bridge/iptablesdoc/generated/usernet-portmap-routed.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ The filter table is:
1919
2 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED
2020
3 0 0 DOCKER-ISOLATION-STAGE-1 0 -- * * 0.0.0.0/0 0.0.0.0/0
2121
4 0 0 DOCKER 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst
22-
5 0 0 ACCEPT 0 -- bridge1 !bridge1 0.0.0.0/0 0.0.0.0/0
23-
6 0 0 ACCEPT 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
24-
7 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
25-
8 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
22+
5 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
23+
6 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
24+
7 0 0 ACCEPT 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
25+
8 0 0 ACCEPT 0 -- bridge1 !bridge1 0.0.0.0/0 0.0.0.0/0
2626

2727
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
2828
num pkts bytes target prot opt in out source destination
@@ -65,10 +65,10 @@ The filter table is:
6565
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6666
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
6767
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER
68-
-A FORWARD -i bridge1 ! -o bridge1 -j ACCEPT
69-
-A FORWARD -i bridge1 -o bridge1 -j ACCEPT
70-
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
7168
-A FORWARD -i docker0 -o docker0 -j ACCEPT
69+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
70+
-A FORWARD -i bridge1 -o bridge1 -j ACCEPT
71+
-A FORWARD -i bridge1 ! -o bridge1 -j ACCEPT
7272
-A DOCKER -d 192.0.2.2/32 ! -i bridge1 -o bridge1 -p tcp -m tcp --dport 80 -j ACCEPT
7373
-A DOCKER ! -i docker0 -o docker0 -j DROP
7474
-A DOCKER -o bridge1 -p icmp -j ACCEPT

‎integration/network/bridge/iptablesdoc/generated/usernet-portmap.md‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@ The filter table is updated as follows:
1818
2 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED
1919
3 0 0 DOCKER-ISOLATION-STAGE-1 0 -- * * 0.0.0.0/0 0.0.0.0/0
2020
4 0 0 DOCKER 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst
21-
5 0 0 ACCEPT 0 -- bridge1 !bridge1 0.0.0.0/0 0.0.0.0/0
22-
6 0 0 ACCEPT 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
23-
7 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
24-
8 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
21+
5 0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
22+
6 0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
23+
7 0 0 ACCEPT 0 -- bridge1 bridge1 0.0.0.0/0 0.0.0.0/0
24+
8 0 0 ACCEPT 0 -- bridge1 !bridge1 0.0.0.0/0 0.0.0.0/0
2525

2626
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
2727
num pkts bytes target prot opt in out source destination
@@ -61,10 +61,10 @@ The filter table is updated as follows:
6161
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6262
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
6363
-A FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER
64-
-A FORWARD -i bridge1 ! -o bridge1 -j ACCEPT
65-
-A FORWARD -i bridge1 -o bridge1 -j ACCEPT
66-
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
6764
-A FORWARD -i docker0 -o docker0 -j ACCEPT
65+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
66+
-A FORWARD -i bridge1 -o bridge1 -j ACCEPT
67+
-A FORWARD -i bridge1 ! -o bridge1 -j ACCEPT
6868
-A DOCKER -d 192.0.2.2/32 ! -i bridge1 -o bridge1 -p tcp -m tcp --dport 80 -j ACCEPT
6969
-A DOCKER ! -i docker0 -o docker0 -j DROP
7070
-A DOCKER ! -i bridge1 -o bridge1 -j DROP
@@ -79,10 +79,8 @@ The filter table is updated as follows:
7979

8080
Note that:
8181

82-
- In the FORWARD chain, rules 5-6 for the new network have been inserted at
83-
the top of the chain, pushing the equivalent docker0 rules down to positions
84-
7-8. (Rules 5-6 were inserted at the top of the chain, then rules 1-4 were
85-
shuffled back to the top by deleting/recreating, as described above.)
82+
- In the FORWARD chain, rules 6-7 for the new network have been appended to
83+
the end of the chain.
8684
- In the DOCKER-ISOLATION chains, rules equivalent to the docker0 rules have
8785
also been inserted for the new bridge.
8886
- In the DOCKER chain, there is an ACCEPT rule for TCP port 80 packets routed

‎integration/network/bridge/iptablesdoc/templates/new-daemon.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,12 @@ The FORWARD chain rules are numbered in the output above, they are:
3939
matching against the `docker-ext-bridge-v[46]` set. Added when the network is
4040
created, in [setupIPTables][13].
4141
The DOCKER chain implements per-port/protocol filtering for each container.
42-
5. ACCEPT any packet leaving a network, also set up when the network is created, in
43-
[setupIPTablesInternal][14].
44-
6. ACCEPT packets flowing between containers within a network, because by default
42+
5. ACCEPT packets flowing between containers within a network, because by default
4543
container isolation is disabled. Also set up when the network is created, in
4644
[setIcc][15].
45+
6. ACCEPT any packet leaving a network, also set up when the network is created, in
46+
[setupIPTablesInternal][14].
47+
4748

4849
[10]: https://github.com/moby/moby/blob/e05848c0025b67a16aaafa8cdff95d5e2c064105/libnetwork/firewall_linux.go#L50
4950
[11]: https://github.com/robmry/moby/blob/52c89d467fc5326149e4bbb8903d23589b66ff0d/libnetwork/drivers/bridge/setup_ip_tables_linux.go#L230-L232

‎integration/network/bridge/iptablesdoc/templates/usernet-portmap-noicc.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ The filter table is:
2121

2222
By comparison with [ICC=true][1]:
2323

24-
- Rule 8 in the FORWARD chain replaces an ACCEPT rule that would have followed rule 5, matching the same packets.
24+
- Rule 7 in the FORWARD chain replaces an ACCEPT rule that would have followed rule 5, matching the same packets.
2525
- Added in [setIcc][2]
2626

2727
[1]: usernet-portmap.md

‎integration/network/bridge/iptablesdoc/templates/usernet-portmap.md‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,8 @@ The filter table is updated as follows:
2020

2121
Note that:
2222

23-
- In the FORWARD chain, rules 5-6 for the new network have been inserted at
24-
the top of the chain, pushing the equivalent docker0 rules down to positions
25-
7-8. (Rules 5-6 were inserted at the top of the chain, then rules 1-4 were
26-
shuffled back to the top by deleting/recreating, as described above.)
23+
- In the FORWARD chain, rules 6-7 for the new network have been appended to
24+
the end of the chain.
2725
- In the DOCKER-ISOLATION chains, rules equivalent to the docker0 rules have
2826
also been inserted for the new bridge.
2927
- In the DOCKER chain, there is an ACCEPT rule for TCP port 80 packets routed

0 commit comments

Comments
 (0)