irsl / dfwfw Goto Github PK

View Code? Open in Web Editor NEW

130.0 130.0 21.0 110 KB

Docker Firewall Framework

Perl 95.71% Shell 0.28% Perl 6 3.94% Dockerfile 0.06%

dfwfw's People

Contributors

Stargazers

Watchers

Forkers

systemmonkey42 maboern toha cedcannes afr1983 scottk212 mberner-ch ccjon frjaraur arcanez ydrybin 5up3rc kaisle reptilehaus macduff23 dizhaung derekhjray

dfwfw's Issues

dfwfw startup fails with err

Could not start the dfwfw container when i try

docker run
--name=dfwfw -d
-v /var/run/docker.sock:/var/run/docker.sock
-v /path/to/your/dfwfw.conf:/etc/dfwfw/dfwfw.conf
--net=host
--cap-add=NET_ADMIN
dfwfw

Can't locate WebService/Docker/API.pm in @inc (you may need to install the WebService::Docker::API module) (@inc contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.20.2 /usr/local/share/perl/5.20.2 /usr/lib/x86_64-linux-gnu/perl5/5.20 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.20 /usr/share/perl/5.20 /usr/local/lib/site_perl . /opt/dfwfw /opt/dfwfw/WebServiceDocker /opt/dfwfw/ConfigHostsFile /opt/dfwfw/PreJSON) at /opt/dfwfw/dfwfw.pl line 14.
BEGIN failed--compilation aborted at /opt/dfwfw/dfwfw.pl line 14.

Not working correctly starting with Docker 17.04.0-ce

Docker 17.04.0-ce introduced a breaking change in that the /networks endpoint no longer returns the containers attached to the networks but rather an empty dict ({}). You now have to request the containers for every network specifically on the /networks/<network-name> endpoint.

See:

this related issue: moby/moby#32686
this code-comment: network_routes.go#L66-L69

I am fairly certain that this change is hitting DFWFW, since I had no success of getting container-related rules generated under 17.04.0-ce, but experienced no isssues under 17.03.1-ce.

Two solutions (rather one solution and one work-around) I can think of:

Request the containers for every network specifically, conforming to the new expected behaviour.
Specify the API-version to use as 1.27 or below in dfwfw.pl#L118 similar to what is already done in WebService::Docker::Info.

This might have a change of breaking in the future, I am not sure how the Docker developers handle a deprecation like this.

I have not tried either of the possibilities, especially since I'm not really firm with Perl.

Enabling port forwarding between two containers

I want to forward a port from one container to another. I did something like this:

   "container_dnat": {
       "rules": [
          { 
             "filter": "-p tcp --dport 5001",
             "src_network":   "bridge",
             "src_container": "src",
             "dst_network":   "bridge",
             "dst_container": "dst",
             "expose_port": "5001/tcp" 
          }
       ]
   }

I have a server listening on dst:5001 and I want to connect at src:5001 from inside src. The above does not work. What changes should I do to get it working?

Moreover, I see these rules generated by dfwfw:
-A DFWFW_PREROUTING -i docker0 -p tcp -m tcp --dport 5001 -j DNAT --to-destination 172.17.0.3:5001
-A DFWFW_FORWARD -s 172.17.0.2/32 -d 172.17.0.3/32 -i docker0 -o docker0 -p tcp -m tcp --dport 5001 -j ACCEPT

What am I missing?

Unable to initialize table 'filter'. Same for nat

Hi, I wonder if you could point me in the right direction here. I'm unable to get any of my config files applied to ipables, even the most simple examples all seem to give me the same errors relating to initializing "Error occurred at line: 2".

My server is running openvpn and I basically want to lock down external access basically making this an intranet group of contaners. But docker wants things public which brings me here. Its worth mentioning that all this worked fine before I turned off iptable support for docker, which is a prerequisite for this I gather. My openvpn server is also confirmed to be working.

Here's an extract of the errors...

docker_firewall    | COMMIT
docker_firewall    |
docker_firewall    |
docker_firewall    | [Wed Jan  9 17:53:23 2019] ERROR: iptables-restore v1.4.21: iptables-restore: unable to initialize table 'filter'
docker_firewall    |
docker_firewall    | Error occurred at line: 2
docker_firewall    | Try `iptables-restore -h' or 'iptables-restore --help' for more information.
docker_firewall    |
docker_firewall    | [Wed Jan  9 17:53:23 2019] commiting to nat table:
docker_firewall    |
docker_firewall    | *nat
docker_firewall    | ################ DFWFW_PREROUTING head:
docker_firewall    | -F DFWFW_PREROUTING
docker_firewall    |
docker_firewall    | ################ wider_world_to_container:
docker_firewall    | # #1: host:80 -> nginx:80 / tcp
docker_firewall    | -A DFWFW_PREROUTING -i eth0 -p tcp --dport 80 -s 91.234.214.2 -j DNAT --to-destination 172.18.0.3:80
docker_firewall    | # #2: host:443 -> nginx:443 / tcp
docker_firewall    | -A DFWFW_PREROUTING -i eth0 -p tcp --dport 443 -s 91.234.214.2 -j DNAT --to-destination 172.18.0.3:443
docker_firewall    | # #3: host:80 -> nginx:80 / tcp
docker_firewall    | -A DFWFW_PREROUTING -i eth0 -p tcp --dport 80 -s 81.140.34.59 -j DNAT --to-destination 172.18.0.3:80
docker_firewall    | # #4: host:443 -> nginx:443 / tcp
docker_firewall    | -A DFWFW_PREROUTING -i eth0 -p tcp --dport 443 -s 81.140.34.59 -j DNAT --to-destination 172.18.0.3:443
docker_firewall    |
docker_firewall    |
docker_firewall    |
docker_firewall    | COMMIT
docker_firewall    |
docker_firewall    |
docker_firewall    | [Wed Jan  9 17:53:23 2019] ERROR: iptables-restore v1.4.21: iptables-restore: unable to initialize table 'nat'

Docker version 18.09.0, build 4d60db4
Debian GNU/Linux 9 \n \l
docker-compose version 1.23.2, build 1110ad01

dfwfw.conf: -

{ "wider_world_to_container": { "rules": [ { "network": "sd_services", "dst_container": "nginx", "filter": "-s 81.140.34.52", "expose_port": 80 }, { "network": "sd_services", "dst_container": "nginx", "filter": "-s 81.140.34.52", "expose_port": 443 } ] }, "container_to_wider_world": { "default_policy": "ACCEPT" }, "container_to_container": { "rules": [ { "network": "sd_services", "src_container": "nginx", "dst_container": "somecontainer", "filter": "-p tcp --dport 80 -m state --state NEW", "action": "ACCEPT" }, { "network": "sd_services", "src_container": "somecontainer", "dst_container": "mariadb", "filter": "-p tcp --dport 3306 -m state --state NEW", "action": "ACCEPT" } ] } }

I've disabled iptables on docker without issue by editing /etc/docker/daemon.json and restarting the server. Something of note is that I'm using ufw firewall and have one post routing entry for my before route which allows me to use myopen vpn server

`# START OPENVPN RULES

NAT table rules

*nat
:POSTROUTING ACCEPT [0:0]

Allow traffic from OpenVPN client to eth0 (change to the interface you discovered!)

-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT

END OPENVPN RULES

I can't say I know a great deal about iptables, which is why I was hoping to get your nice container to do this for me. I don't suppose you have any suggestions?

I used the pull request to get your container 'docker pull irsl/dfwfw' but it shows it was updated 20 months ago. Is that right?

Many thanks for any advice you might have!

Initialization not locking down host inbound/outbound rules

Hopefully this is another error/oversight on my end..

I'm using the basic example initialization block, just added a line for inbound NTP:

   "initialization": {
      "filter": [
         ":DFWFW_INPUT - [0:0]",
         ":HOST_OUTBOUND - [0:0]",
         ":HOST_INCOMING - [0:0]",

         "-P INPUT DROP",
         "-F INPUT",
         "-A INPUT -m state --state INVALID -j DROP",
         "-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT",
         "-A INPUT -j DFWFW_INPUT",
         "-A INPUT -m state --state NEW -j HOST_INCOMING",

         "-F HOST_INCOMING",
         "-A HOST_INCOMING -p tcp --dport 22 -j ACCEPT",
         "-A HOST_INCOMING -p icmp -j ACCEPT",

         "-P OUTPUT DROP",
         "-F OUTPUT",
         "-A OUTPUT -m state --state INVALID -j DROP",
         "-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT",
         "-A OUTPUT -m state --state NEW -j HOST_OUTBOUND",

         "-F HOST_OUTBOUND",
         "-A HOST_OUTBOUND -p udp --dport 53 -j ACCEPT",
         "-A HOST_OUTBOUND -p tcp --dport 80 -j ACCEPT",
         "-A HOST_OUTBOUND -p udp --dport 123 -j ACCEPT",
         "-A HOST_OUTBOUND -p tcp --dport 443 -j ACCEPT",
         "-A HOST_OUTBOUND -p icmp -j ACCEPT",

         "-P FORWARD DROP"
      ]
   },

None of the HOST_INCOMING or HOST_OUTBOUND port specific rules end up in iptables, and the default policy for INPUT and OUTPUT stay as ACCEPT instead of DROP. I also don't see the HOST_INCOMING or HOST_OUTBOUND chains at all. I'll paste my iptables-save output at the bottom of the ticket. My config at this point is just the initialization block, container_to_wider_world and container_to_host with a default policy of ACCEPT, and the two container port forwards from my previous issue.

# Generated by iptables-save v1.4.21 on Wed Dec 30 19:51:26 2015
*nat
:PREROUTING ACCEPT [57:3644]
:INPUT ACCEPT [22:1069]
:OUTPUT ACCEPT [34:2417]
:POSTROUTING ACCEPT [14:692]
:DFWFW_POSTROUTING - [0:0]
:DFWFW_PREROUTING - [0:0]
-A PREROUTING -j DFWFW_PREROUTING
-A POSTROUTING -j DFWFW_POSTROUTING
-A DFWFW_POSTROUTING -o eth0 -j MASQUERADE
-A DFWFW_PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 172.17.0.2:25
-A DFWFW_PREROUTING -i eth0 -p tcp -m tcp --dport 2500 -j DNAT --to-destination 172.17.0.2:25
COMMIT
# Completed on Wed Dec 30 19:51:26 2015
# Generated by iptables-save v1.4.21 on Wed Dec 30 19:51:26 2015
*filter
:INPUT ACCEPT [690:199320]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [528:200092]
:DFWFW_FORWARD - [0:0]
:DFWFW_INPUT - [0:0]
-A INPUT -j DFWFW_INPUT
-A FORWARD -j DFWFW_FORWARD
-A DFWFW_FORWARD -m state --state INVALID -j DROP
-A DFWFW_FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A DFWFW_FORWARD -i docker0 -o eth0 -j ACCEPT
-A DFWFW_FORWARD -d 172.17.0.2/32 -i eth0 -o docker0 -p tcp -m tcp --dport 25 -j ACCEPT
-A DFWFW_FORWARD -d 172.17.0.2/32 -i eth0 -o docker0 -p tcp -m tcp --dport 25 -j ACCEPT
-A DFWFW_FORWARD -j DROP
-A DFWFW_INPUT -i docker0 -j ACCEPT
COMMIT
# Completed on Wed Dec 30 19:51:26 2015

Document git submodules

Write in readme that this repo use submodule.

and git clone is not sufficient

git clone --recursive git://github.com/foo/bar.git

Problem with matching rule "dst_container": "Name =~ .*"

I'm trying to create rule that matches any container.
It looks like:
{
"dst_container": "Name =~ .*",
"network": "cadnet"
},
But it shoots only after at least two containers in network cadnet was created.
I.e. it does not work if there is only one container in target network.

two wan intefaces

Hello !

I've 2 wan ports (eth0 and eth1) on host, requests to containers comes from both, but in "external_network_interface" I can setup only one. Can I remove info about int at all ?

was:

#1: host:80 -> nginx_1:80 / tcp
-A DFWFW_PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 172.18.0.2:80

will:

#1: host:80 -> nginx_1:80 / tcp
-A DFWFW_PREROUTING -p tcp --dport 80 -j DNAT --to-destination 172.18.0.2:80

Expose container from vpn hosts olny

How to expose a container to my vpn only?

My current configuration:
This confiugration exposes the container to the public, while from the vpn it seems irrangiungible.

{
   "initialization": {
      "filter": [
         ":DFWFW_INPUT - [0:0]",
         ":HOST_OUTBOUND - [0:0]",
         ":HOST_INCOMING - [0:0]",

         "-P INPUT DROP",
         "-F INPUT",
         "-A INPUT -m state --state INVALID -j DROP",
         "-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT",
         "-A INPUT -j DFWFW_INPUT",
         "-A INPUT -m state --state NEW -j HOST_INCOMING",

         "-F HOST_INCOMING",
         "-A HOST_INCOMING -p tcp -s 10.8.3.0/24 -dport 22 -j ACCEPT",
         "-A HOST_INCOMING -p icmp -j ACCEPT",

         "-P OUTPUT DROP",
         "-F OUTPUT",
         "-A OUTPUT -m state --state INVALID -j DROP",
         "-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT",
         "-A OUTPUT -m state --state NEW -j HOST_OUTBOUND",

         "-F HOST_OUTBOUND",
         "-A HOST_OUTBOUND -p icmp -j ACCEPT",

         "-P FORWARD DROP"
      ]
   },

   "container_to_container": {
       "default_policy": "ACCEPT"
   },
   "container_to_wider_world": {
       "default_policy": "ACCEPT"
   },

   "container_to_host": {
       "default_policy": "ACCEPT"
   },

   "wider_world_to_container": {
       "rules": [
          {
             "network": "bridge",
             "dst_container": "nginx",
             "filter": "-s 10.8.0.205",
             "expose_port": 8080
          }
       ]
   }
}

The file "filter": "-s 10.8.0.205" seems not working.

ERROR: Invalid expose_port node at /opt/dfwfw/DFWFW/Config.pm line 92.
 in:
$VAR1 = {
          'expose_port' => {
                             'family' => 'tcp',
                             'container_port' => '25',
                             'host_port' => '2500'
                           },
          'network-ref' => {
                             'value' => 'bridge',
                             'op' => '==',
                             'field' => 'Name',
                             'opcb' => sub { "DUMMY" }
                           },
          'dst_container' => 'postfix',
          'node' => {
                      'no' => 1
                    },
          'network' => 'bridge',
          'filter' => ''
        };

This is the config block:

          {
             "network": "bridge",
             "dst_container": "postfix",
             "expose_port": { "host_port": "2500", "container_port": "25", "family": "tcp" }
          }

I've tried it with and without the family key.

Don't mount file for dfwfw.conf

when you use some tool like 'vi' to update the file. Inode is changed and container don't show modification

Mount directory instead