Skip to content

Update iptables-setup-docker-swarm.md #192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
schmidt-scaled wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update iptables-setup-docker-swarm.md #192

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 12 additions & 69 deletions snippets/iptables-setup-docker-swarm.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,78 +1,21 @@

Simplyblock requires a number of TCP and UDP ports to be opened from certain networks. Additionally, it requires IPv6
to be disabled on management nodes.
Simplyblock requires a number of TCP and UDP ports to be opened from certain networks.

Following is a list of all ports (TCP and UDP) required for operation as a storage node. Attention is required, as this
list is for storage nodes only. Management nodes have a different port configuration.
Following is a list of all ports (TCP and UDP) required for operation as a storage node.

{% include 'network-port-table.md' %}
!!! Important
The identical nvmf ports are TCP for NVMe-oF/TCP and UDP for NVMe-oF/RDMA.

With the previously defined subnets, the following snippet disables IPv6 and configures the iptables automatically.
{% include 'network-port-table-sn.md' %}

!!! danger
The example assumes an external firewall between the _admin_ network and the public internet!<br/>
If this is not the case, ensure the correct source access for port _22_.

```bash title="Disable IPv6"
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
```

Docker Swarm, by default, creates iptables entries open to the world. If no external firewall is available, the created
iptables configuration needs to be restricted.

The following script will create additional iptables rules prepended to Docker's forwarding rules and only enabling
access from internal networks. This script should be stored in _/usr/local/sbin/simplyblock-iptables.sh_.
Script to apply firewall rules using iptables:

```bash title="Configuration script for iptables"
#!/usr/bin/env bash

# Clean up
sudo iptables -F SIMPLYBLOCK
sudo iptables -D DOCKER-FORWARD -j SIMPLYBLOCK
sudo iptables -X SIMPLYBLOCK

# Setup
sudo iptables -N SIMPLYBLOCK
sudo iptables -I DOCKER-FORWARD 1 -j SIMPLYBLOCK
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A SIMPLYBLOCK -p tcp --dport 2375 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN
sudo iptables -A SIMPLYBLOCK -p tcp --dport 2377 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN
sudo iptables -A SIMPLYBLOCK -p tcp --dport 4420 -s 10.10.10.0/24 -j RETURN
sudo iptables -A SIMPLYBLOCK -p udp --dport 4789 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN
sudo iptables -A SIMPLYBLOCK -p tcp --dport 5000 -s 192.168.10.0/24 -j RETURN
sudo iptables -A SIMPLYBLOCK -p tcp --dport 7946 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN
sudo iptables -A SIMPLYBLOCK -p udp --dport 7946 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN
sudo iptables -A SIMPLYBLOCK -p tcp --dport 8080:8890 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN
sudo iptables -A SIMPLYBLOCK -p tcp --dport 9090-9900 -s 192.168.10.0/24,10.10.10.0/24 -j RETURN
sudo iptables -A SIMPLYBLOCK -s 0.0.0.0/0 -j DROP
```

To automatically run this script whenever Docker is started or restarted, it must be attached to a systemd service,
stored as _/etc/systemd/system/simplyblock-iptables.service_.

```plain title="systemd script to set up iptables"
[Unit]
Description=Simplyblock Iptables Restrictions for Docker
After=docker.service
BindsTo=docker.service
ReloadPropagatedFrom=docker.service

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/simplyblock-iptables.sh
ExecReload=/usr/local/sbin/simplyblock-iptables.sh
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
```

After both files are stored in their respective locations, the bash script needs to be made executable, and the systemd
service needs to be enabled to start automatically.
#!/bin/bash

```bash title="Enabling service file"
chmod +x /usr/local/sbin/simplyblock-iptables.sh
systemctl enable simplyblock-iptables.service
systemctl start simplyblock-iptables.service
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j ACCEPT
iptables -A INPUT -p tcp --dport 4420:4499 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 4420:4499 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080:9044 -j ACCEPT
```
Loading