-
Notifications
You must be signed in to change notification settings - Fork 6
/
docker-nft.conf
executable file
·47 lines (41 loc) · 974 Bytes
/
docker-nft.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
table inet docker {
chain forward {
type filter hook forward priority 0; policy drop;
jump docker-user
jump docker-isolation-stage-1
oif docker0 ct state {established, related} counter accept
oif docker0 jump docker
oif docker0 iif != docker0 accept
oif docker0 iif docker0 accept
}
chain docker {
}
chain docker-isolation-stage-1 {
iif docker0 oif != docker0 jump docker-isolation-stage-2
return
}
chain docker-isolation-stage-2 {
oif docker0 drop
return
}
chain docker-user {
return
}
}
table ip dockernat {
chain prerouting {
type nat hook prerouting priority 0;
fib daddr type local jump docker
}
chain output {
type nat hook output priority 0;
ip daddr != 127.0.0.0/8 fib daddr type local jump docker
}
chain postrouting {
type nat hook postrouting priority 0;
oif != docker0 ip saddr 172.16.0.0/16 masquerade
}
chain docker {
iif docker0 return
}
}