diff --git a/snippets/iptables-setup-docker-swarm.md b/snippets/iptables-setup-docker-swarm.md index de237abd..d65dfaee 100644 --- a/snippets/iptables-setup-docker-swarm.md +++ b/snippets/iptables-setup-docker-swarm.md @@ -1,78 +1,21 @@ -Simplyblock requires a number of TCP and UDP ports to be opened from certain networks. Additionally, it requires IPv6 -to be disabled on management nodes. +Simplyblock requires a number of TCP and UDP ports to be opened from certain networks. -Following is a list of all ports (TCP and UDP) required for operation as a storage node. Attention is required, as this -list is for storage nodes only. Management nodes have a different port configuration. +Following is a list of all ports (TCP and UDP) required for operation as a storage node. -{% include 'network-port-table.md' %} +!!! Important + The identical nvmf ports are TCP for NVMe-oF/TCP and UDP for NVMe-oF/RDMA. -With the previously defined subnets, the following snippet disables IPv6 and configures the iptables automatically. +{% include 'network-port-table-sn.md' %} -!!! danger - The example assumes an external firewall between the _admin_ network and the public internet!
- If this is not the case, ensure the correct source access for port _22_. - -```bash title="Disable IPv6" -sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1 -sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1 -``` - -Docker Swarm, by default, creates iptables entries open to the world. If no external firewall is available, the created -iptables configuration needs to be restricted. - -The following script will create additional iptables rules prepended to Docker's forwarding rules and only enabling -access from internal networks. This script should be stored in _/usr/local/sbin/simplyblock-iptables.sh_. +Script to apply firewall rules using iptables: ```bash title="Configuration script for iptables" -#!/usr/bin/env bash - -# Clean up -sudo iptables -F SIMPLYBLOCK -sudo iptables -D DOCKER-FORWARD -j SIMPLYBLOCK -sudo iptables -X SIMPLYBLOCK - -# Setup -sudo iptables -N SIMPLYBLOCK -sudo iptables -I DOCKER-FORWARD 1 -j SIMPLYBLOCK -sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT -sudo iptables -A SIMPLYBLOCK -p tcp --dport 2375 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN -sudo iptables -A SIMPLYBLOCK -p tcp --dport 2377 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN -sudo iptables -A SIMPLYBLOCK -p tcp --dport 4420 -s 10.10.10.0/24 -j RETURN -sudo iptables -A SIMPLYBLOCK -p udp --dport 4789 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN -sudo iptables -A SIMPLYBLOCK -p tcp --dport 5000 -s 192.168.10.0/24 -j RETURN -sudo iptables -A SIMPLYBLOCK -p tcp --dport 7946 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN -sudo iptables -A SIMPLYBLOCK -p udp --dport 7946 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN -sudo iptables -A SIMPLYBLOCK -p tcp --dport 8080:8890 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN -sudo iptables -A SIMPLYBLOCK -p tcp --dport 9090-9900 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN -sudo iptables -A SIMPLYBLOCK -s 0.0.0.0/0 -j DROP -``` - -To automatically run this script whenever Docker is started or restarted, it must be attached to a systemd service, -stored as _/etc/systemd/system/simplyblock-iptables.service_. - -```plain title="systemd script to set up iptables" -[Unit] -Description=Simplyblock Iptables Restrictions for Docker -After=docker.service -BindsTo=docker.service -ReloadPropagatedFrom=docker.service - -[Service] -Type=oneshot -ExecStart=/usr/local/sbin/simplyblock-iptables.sh -ExecReload=/usr/local/sbin/simplyblock-iptables.sh -RemainAfterExit=yes - -[Install] -WantedBy=multi-user.target -``` - -After both files are stored in their respective locations, the bash script needs to be made executable, and the systemd -service needs to be enabled to start automatically. +#!/bin/bash -```bash title="Enabling service file" -chmod +x /usr/local/sbin/simplyblock-iptables.sh -systemctl enable simplyblock-iptables.service -systemctl start simplyblock-iptables.service +iptables -A INPUT -p icmp -j ACCEPT +iptables -A INPUT -p tcp --dport 5000 -j ACCEPT +iptables -A INPUT -p tcp --dport 4420:4499 -j ACCEPT +iptables -A OUTPUT -p tcp --dport 4420:4499 -j ACCEPT +iptables -A INPUT -p tcp --dport 8080:9044 -j ACCEPT ```