This repository has been archived by the owner on Oct 11, 2023. It is now read-only.
Set iptables rules at startup #446
Milestone
Comments
|
I think there's a way: a privileged service container that runs on boot which executes a script applying the iptables rules. iptables-rules:
image: yourname/iptables-rules
command: ./set-rules.sh # can be omitted if set in Dockerfile with ENTRYPOINT or CMD
net: host
privileged: true
labels:
io.rancher.os.scope: system
io.rancher.os.detach: false
io.rancher.os.remove: true
links:
- networkThis is a compose template for such a container. You can put it under under |
|
@imikushin do you guys have documentation on all the labels and their meanings you guys are using? |
|
thanks @deniseschannon ! |
|
@moimael here below is an example where i used busybox run an init script at bootstrap: #cloud-config
hostname: rancher-x
ssh_authorized_keys:
- ssh-rsa ...[your ssh key]
write_files:
- path: /opt/rancher/init/start.sh
permissions: 0755
content: |
#!/bin/sh
iptables-restore < /opt/rancher/init/rules-save
- path: /opt/rancher/init/rules-save
permissions: 0644
owner: "root:root"
content: |
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -i docker0 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate NEW -m multiport -p tcp --dports 22,80,443 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A FORWARD -i docker0 -o eth1 -j ACCEPT
-A FORWARD -i eth1 -o docker0 -j ACCEPT
-A FORWARD -i eth0 -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o eth0 -j ACCEPT
COMMIT
- path: /etc/ssh/sshd_config
permissions: 0600
owner: "root:root"
content: |
UsePrivilegeSeparation sandbox
Subsystem sftp internal-sftp
PermitRootLogin no
AllowUsers rancher
PasswordAuthentication no
ChallengeResponseAuthentication no
rancher:
debug: true
cloud_init:
datasources:
- ec2
network:
dns:
nameserver:
- 8.8.4.4
- 4.2.2.3
state:
fstype: auto
dev: LABEL=RANCHER_STATE
autoformat:
- /dev/vda
services:
init_script:
image: busybox
volumes:
- /opt/rancher/init:/opt/rancher/init
working_dir: /opt/rancher/init
links:
- network
labels:
- io.rancher.os.scope=system
command: ./start.sh
net: host
privileged: true
|
|
Hi @imikushin your example at issuecomment-127362076 could be based on a RancherOS / os-service image? So existing image could be reused with correct file permissions and the same filesystem (base). Regards |
|
@gregory tried your solution, but I have failed miserably
#cloud-config
hostname: rancher-os
ssh_authorized_keys:
- ssh-rsa xxx
write_files:
- path: /opt/rancher/init/iptables.sh
permissions: "0755"
owner: "root:root"
content: |
#!/bin/bash
iptables -F
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -i docker0 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --dports 2222 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i docker0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o docker0 -j ACCEPT
iptables -A FORWARD -i eth0 -o docker0 -j ACCEPT
iptables -A FORWARD -i docker0 -o eth0 -j ACCEPT
iptables -I INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -I INPUT -p icmp --icmp-type source-quench -j ACCEPT
iptables -I INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -I INPUT -p icmp --icmp-type echo-request -j ACCEPT
- path: /home/rancher/.docker/config.json
permissions: "0660"
encoding: b64
content: xxx
- path: /etc/ssh/sshd_config
permissions: "0644"
owner: root:root
content: |
Port 2222
AuthorizedKeysFile .ssh/authorized_keys
UsePrivilegeSeparation sandbox
ClientAliveInterval 180
Subsystem sftp /usr/libexec/sftp-server
UseDNS no
PermitRootLogin no
AllowGroups docker
rancher:
cloud_init:
datasources:
- ec2
network:
dns:
nameserver:
- 8.8.4.4
- 4.2.2.3
interfaces:
eth0:
dhcp: true
eth1:
address: $V4_PRIVATE_IP/16
mtu: 1450
state:
fstype: auto
dev: LABEL=RANCHER_STATE
autoformat:
- /dev/vda
services:
init_script:
image: busybox
net: host
uts: host
pid: host
ipc: host
privileged: true
volumes_from:
- user-volumes
volumes:
- /sbin/iptables:/usr/bin/iptables:ro
labels:
io.rancher.os.scope: system
io.rancher.os.after: wait-for-network, cloud-init
command: /opt/rancher/init/iptables.sh |
|
Well at the end I just setup iptables rules in |
|
A cloud config solution should be available after RancherOS 0.4.3 release. |
|
This should be working in v0.4.4. |
|
How do we do this in v0.4.4.? The following doesn't work #cloud-config
write_files:
- path: /var/lib/iptables/rules.sh
permissions: "0755"
owner: root:root
content: |
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
# the last line of the file needs to be a blank line or a comment
rancher:
network:
interfaces:
eth0:
dhcp: true
post_up:
- bash /var/lib/iptables/rules.sh |
|
@sschueller The problem is that the file needs to be written in the network container so that the post_up can access it. We fixed this in v0.6.0 where you should be able to do this, where I added the |
|
Hi, I have tried the above solution however it seems the network container do not comes with iptables. what would be the best way to fix this issue? Thanks! |
|
@camrossi True, iptables is currently only available in the console. Can you file a separate issue for this? |
|
So I see this issue is closed, does that mean it's resolved? Or is this still not possible in rancher? |
|
Okay, so that's a no. Thanks. |
|
So ... it's impossible to use iptables right now? |
|
Does not work in 1.0.0: My network config: write_files:
- container: network
path: /var/lib/iptables/rules.sh
permissions: "0755"
owner: root:root
content: |
#!/bin/bash
iptables -F
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -i docker0 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
... some rules for eth0
iptables -A FORWARD -i docker0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o docker0 -j ACCEPT
iptables -A FORWARD -i eth0 -o docker0 -j ACCEPT
iptables -A FORWARD -i docker0 -o eth0 -j ACCEPT
iptables -I INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -I INPUT -p icmp --icmp-type source-quench -j ACCEPT
iptables -I INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -I INPUT -p icmp --icmp-type echo-request -j ACCEPT
# the last line of the file needs to be a blank line or a comment
rancher:
cloud_init:
datasources:
- ec2
network:
dns:
nameservers:
- 8.8.4.4
- 4.2.2.3
interfaces:
eth0:
dhcp: true
post_up:
- /var/lib/iptables/rules.sh
eth1:
address: $V4_PRIVATE_IP/16
mtu: 1450
state:
fstype: auto
dev: LABEL=RANCHER_STATE
autoformat:
- /dev/vda |
|
so basically, this has never worked? reopening and I'll see what I can do for v1.0.2 |
|
so reading the code, it looks like the pre_up and post_up never worked for dhcp adresses - and there's no tests for any of it :( I feel you should really be using Still hoping to fix it today tho. |
|
ok, looks like the proper fix is too complicated to 1.0.2 - it'll come out with 1.1.0 however - @felixsanz @quantverse @deoxxa can you please have a go and tell me if it does/not? |
3 tasks
|
@SvenDowideit can't test it - gave up on Rancher months ago. Sorry! |
|
How can I allow access to specific port (which is forwarded to container) only for specific ip? I tried cloud-config like this: After system starts 'iptables -L FORWARD -nv' shows: So my rule is useless (because it's at the bottom). Docker will release a solution soon moby/libnetwork#1675, but will it work with Rancher os? |
|
After rereading the documentation I managed to solve my problem with config like this (just an example, not an actual config): I also tested the following config in VirtualBox (with dhcp enabled, Rancher os v1.0.2-rc2): And after booting 'iptables -L INPUT -nv' showed So it seems that post_cmds works with dhcp at least in my case. I hope this helps. |
|
this should me more reliable in v1.1.0 due to #1869 |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Hi,
I use a direct routing load balancer to balance load against my rancher servers (https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Load_Balancer_Administration/s2-lvs-directrouting-VSA.html). One of them is under RancherOS and the only way (except using arptables, which isn't available on RancherOS) to make direct routing work is editing iptables rules. Is there a way to make them persistent across restart ?
Thanks !
The text was updated successfully, but these errors were encountered: