Commit graph

9 commits

Author SHA1 Message Date
Florian Eckert
19fc933330 docker-ce: add device option to expand interface blocking
If docker-ce handles the firewall and fw3 is not envolved because the
rules get not proceed, then not only docker0 should be handled but also
other interfaces and therefore other docker networks.

This commit extends the handling and introduces a new uci option
`device` in the docker config firewall section. This can be used to specify
which device is allowed to access the container. Up to now only docker0
is covert.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2020-11-19 14:20:09 +01:00
Florian Eckert
1af5593568 docker-ce: make docker-ce firewall handling configurable
Openwrt has a own firewall service called fw3, that supports firewall zones.
Docker can bypass the handling of the zone rules in openwrt via custom
tables. These are "always" processed before the openwrt firewall.
Which is prone to errors!

Since not everyone is aware that the firewall of openwrt will
not be passed. And this is a security problem because a mapped port is
visible on all interfaces and so also on the WAN side.
If the firewall handling in docker is switched off, then the port in
fw3 must be explicitly released and it cannot happen that the
port is accidentally exported to the outside world via the interfaces on
the WAN zone.

So all rules for the containers should and so must be made in fw3.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2020-11-19 14:20:02 +01:00
Gerard Ryan
6be2d43e68 docker-ce: Added blocked_interfaces config option
* blocked_interfaces blocks all packets to docker0 from the given
  interface. This is needed because all the iptables commands dockerd
  adds operate before any of the fw3 generated rules.

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>
2020-11-11 18:28:15 +10:00
Florian Eckert
7034020c13 docker-ce: fix hosts type to list
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2020-08-11 09:25:34 +02:00
Florian Eckert
1bf0bd4590 docker-ce: fix bip default config value
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2020-07-31 15:48:27 +02:00
Florian Eckert
86dacca843 docker-ce: fix typo for registry_mirrors uci option
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2020-07-29 13:09:08 +02:00
Florian Eckert
f622644211 docker-ce: add bip uci to default config
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2020-07-29 13:09:08 +02:00
Florian Eckert
5136421254 docker-ce: add hosts option
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2020-07-29 13:07:07 +02:00
Florian Eckert
b9b565e068 docker-ce: add uci support for dockerd
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2020-07-07 15:03:28 +02:00