Detect REJECT rule in FORWARD chain

weaveworks · Aug 21, 2015 · e186410 · e186410
1 parent 396df6b
commit e186410
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/weave b/weave
@@ -155,6 +155,13 @@ enforce_docker_bridge_addr_assign_type() {
     fi
 }
 
+check_forwarding_rules() {
+    if run_iptables -C FORWARD -j REJECT --reject-with icmp-host-prohibited > /dev/null 2>&1; then
+        echo "Found REJECT rule in iptables FORWARD chain; reconfigure your firewall" >&2
+        exit 1
+    fi
+}
+
 is_cidr() {
     echo "$1" | grep -E "^$CIDR_REGEXP$" >/dev/null
 }
@@ -1080,6 +1087,7 @@ common_launch_args() {
 }
 
 launch_router() {
+    check_forwarding_rules
     enforce_docker_bridge_addr_assign_type
     create_bridge
     docker_bridge_ip