85 lines
4.6 KiB
Plaintext
85 lines
4.6 KiB
Plaintext
# Generated by iptables-save v1.8.7 on Wed Dec 1 13:07:13 2021
|
|
*filter
|
|
:INPUT ACCEPT [32082:6319098]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT ACCEPT [30915:5968786]
|
|
:DOCKER - [0:0]
|
|
:DOCKER-INGRESS - [0:0]
|
|
:DOCKER-ISOLATION-STAGE-1 - [0:0]
|
|
:DOCKER-ISOLATION-STAGE-2 - [0:0]
|
|
:DOCKER-USER - [0:0]
|
|
-A FORWARD -j DOCKER-USER
|
|
-A FORWARD -j DOCKER-INGRESS
|
|
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
|
|
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
-A FORWARD -o docker0 -j DOCKER
|
|
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
|
|
-A FORWARD -i docker0 -o docker0 -j ACCEPT
|
|
-A FORWARD -d 10.6.0.0/24 -i eth0 -o wg0 -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment wireguard-forward-rule -j ACCEPT
|
|
-A FORWARD -s 10.6.0.0/24 -i wg0 -o eth0 -m comment --comment wireguard-forward-rule -j ACCEPT
|
|
-A FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
-A FORWARD -o docker_gwbridge -j DOCKER
|
|
-A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT
|
|
-A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8443 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8443 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8080 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8080 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 3001 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 3001 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8090 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8090 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8086 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8086 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8083 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8083 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 2342 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 2342 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 9443 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 9443 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 9000 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 9000 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8000 -j ACCEPT
|
|
-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8000 -j ACCEPT
|
|
-A DOCKER-INGRESS -j RETURN
|
|
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
|
|
-A DOCKER-ISOLATION-STAGE-1 -i docker_gwbridge ! -o docker_gwbridge -j DOCKER-ISOLATION-STAGE-2
|
|
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
|
|
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
|
|
-A DOCKER-ISOLATION-STAGE-2 -o docker_gwbridge -j DROP
|
|
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
|
|
-A DOCKER-USER -j RETURN
|
|
COMMIT
|
|
# Completed on Wed Dec 1 13:07:13 2021
|
|
# Generated by iptables-save v1.8.7 on Wed Dec 1 13:07:13 2021
|
|
*nat
|
|
:PREROUTING ACCEPT [3899:308123]
|
|
:INPUT ACCEPT [2234:207735]
|
|
:OUTPUT ACCEPT [1069:90142]
|
|
:POSTROUTING ACCEPT [1067:89970]
|
|
:DOCKER - [0:0]
|
|
:DOCKER-INGRESS - [0:0]
|
|
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER-INGRESS
|
|
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
|
|
-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER-INGRESS
|
|
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
|
|
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
|
|
-A POSTROUTING -s 10.6.0.0/24 -o eth0 -m comment --comment wireguard-nat-rule -j MASQUERADE
|
|
-A POSTROUTING -o docker_gwbridge -m addrtype --src-type LOCAL -j MASQUERADE
|
|
-A POSTROUTING -s 172.18.0.0/16 ! -o docker_gwbridge -j MASQUERADE
|
|
-A DOCKER -i docker0 -j RETURN
|
|
-A DOCKER -i docker_gwbridge -j RETURN
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8443 -j DNAT --to-destination 172.18.0.2:8443
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.18.0.2:8080
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 3001 -j DNAT --to-destination 172.18.0.2:3001
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8090 -j DNAT --to-destination 172.18.0.2:8090
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8086 -j DNAT --to-destination 172.18.0.2:8086
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8083 -j DNAT --to-destination 172.18.0.2:8083
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 2342 -j DNAT --to-destination 172.18.0.2:2342
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 9443 -j DNAT --to-destination 172.18.0.2:9443
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 9000 -j DNAT --to-destination 172.18.0.2:9000
|
|
-A DOCKER-INGRESS -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.18.0.2:8000
|
|
-A DOCKER-INGRESS -j RETURN
|
|
COMMIT
|
|
# Completed on Wed Dec 1 13:07:13 2021
|