mirror of
https://github.com/novatiq/packages.git
synced 2026-07-29 23:03:06 +01:00
Florian Eckert
1af5593568
Openwrt has a own firewall service called fw3, that supports firewall zones. Docker can bypass the handling of the zone rules in openwrt via custom tables. These are "always" processed before the openwrt firewall. Which is prone to errors! Since not everyone is aware that the firewall of openwrt will not be passed. And this is a security problem because a mapped port is visible on all interfaces and so also on the WAN side. If the firewall handling in docker is switched off, then the port in fw3 must be explicitly released and it cannot happen that the port is accidentally exported to the outside world via the interfaces on the WAN zone. So all rules for the containers should and so must be made in fw3. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
20 lines
701 B
Plaintext
20 lines
701 B
Plaintext
# The following settings require a restart to take full effect, A reload will
|
|
# only have partial or no effect:
|
|
# option bip
|
|
# list blocked_interfaces
|
|
|
|
config globals 'globals'
|
|
# option alt_config_file "/etc/docker/daemon.json"
|
|
option data_root "/opt/docker/"
|
|
option log_level "warn"
|
|
list hosts "unix:///var/run/docker.sock"
|
|
option bip "172.18.0.1/24"
|
|
# option iptables "0"
|
|
# list registry_mirrors "https://<my-docker-mirror-host>"
|
|
# list registry_mirrors "https://hub.docker.com"
|
|
|
|
# Docker ignores fw3 rules and by default all external source IPs are allowed
|
|
# to connect to the Docker host. See https://docs.docker.com/network/iptables/
|
|
config firewall 'firewall'
|
|
list blocked_interfaces 'wan'
|