FWD » Documentation

#!/bin/bash

set -euo pipefail

update_bridge_forward_rules()

{

   local lan_if="$1"

   local bridge_if="$2"

   local subnet="$3"

   sudo iptables -C FORWARD -i "$lan_if" -o "$bridge_if" -d "$subnet" -j ACCEPT 2>/dev/null || \

      sudo iptables -A FORWARD -i "$lan_if" -o "$bridge_if" -d "$subnet" -j ACCEPT

   sudo iptables -C FORWARD -i "$bridge_if" -o "$lan_if" -s "$subnet" -j ACCEPT 2>/dev/null || \

      sudo iptables -A FORWARD -i "$bridge_if" -o "$lan_if" -s "$subnet" -j ACCEPT

}

remove_bridge_forward_rules()

{

   local lan_if="$1"

   local bridge_if="$2"

   local subnet="$3"

   while sudo iptables -C FORWARD -i "$lan_if" -o "$bridge_if" -d "$subnet" -j ACCEPT 2>/dev/null

   do

      sudo iptables -D FORWARD -i "$lan_if" -o "$bridge_if" -d "$subnet" -j ACCEPT

   done

   while sudo iptables -C FORWARD -i "$bridge_if" -o "$lan_if" -s "$subnet" -j ACCEPT 2>/dev/null

   do

      sudo iptables -D FORWARD -i "$bridge_if" -o "$lan_if" -s "$subnet" -j ACCEPT

   done

}

update_forward_rules()

{

   local lan_if="$1"

   local host_if="$2"

   local subnet="$3"

   sudo iptables -C FORWARD -i "$lan_if" -o "$host_if" -d "$subnet" -j ACCEPT 2>/dev/null || \

      sudo iptables -A FORWARD -i "$lan_if" -o "$host_if" -d "$subnet" -j ACCEPT

   sudo iptables -C FORWARD -i "$host_if" -o "$lan_if" -s "$subnet" -j ACCEPT 2>/dev/null || \

      sudo iptables -A FORWARD -i "$host_if" -o "$lan_if" -s "$subnet" -j ACCEPT

}

remove_forward_rules()

{

   local lan_if="$1"

   local host_if="$2"

   local subnet="$3"

   while sudo iptables -C FORWARD -i "$lan_if" -o "$host_if" -d "$subnet" -j ACCEPT 2>/dev/null

   do

      sudo iptables -D FORWARD -i "$lan_if" -o "$host_if" -d "$subnet" -j ACCEPT

   done

   while sudo iptables -C FORWARD -i "$host_if" -o "$lan_if" -s "$subnet" -j ACCEPT 2>/dev/null

   do

      sudo iptables -D FORWARD -i "$host_if" -o "$lan_if" -s "$subnet" -j ACCEPT

   done

}

update_bridge_host_rules()

{

   local subnet="$1"

   local bridge_if="$2"

   sudo iptables -C OUTPUT -o "$bridge_if" -d "$subnet" -j ACCEPT 2>/dev/null || \

      sudo iptables -A OUTPUT -o "$bridge_if" -d "$subnet" -j ACCEPT

   sudo iptables -C INPUT -i "$bridge_if" -s "$subnet" -j ACCEPT 2>/dev/null || \

      sudo iptables -A INPUT -i "$bridge_if" -s "$subnet" -j ACCEPT

}

remove_bridge_host_rules()

{

   local subnet="$1"

   local bridge_if="$2"

   while sudo iptables -C OUTPUT -o "$bridge_if" -d "$subnet" -j ACCEPT 2>/dev/null

   do

      sudo iptables -D OUTPUT -o "$bridge_if" -d "$subnet" -j ACCEPT

   done

   while sudo iptables -C INPUT -i "$bridge_if" -s "$subnet" -j ACCEPT 2>/dev/null

   do

      sudo iptables -D INPUT -i "$bridge_if" -s "$subnet" -j ACCEPT

   done

}

invalid_cidr()

{

   local cidr="$1"

   if [[ ! $cidr =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]{1,2})$ ]]; then

      return 0

   fi

   local ip="${cidr%/*}"

   local prefix="${cidr#*/}"

   if (( prefix < 0 || prefix > 32 )); then

      return 0

   fi

   IFS='.' read -r o1 o2 o3 o4 <<< "$ip"

   for octet in "$o1" "$o2" "$o3" "$o4"

   do

      if (( octet < 0 || octet > 255 )); then

         return 0

      fi

   done

   return 1

}

show_usage()

{

   cat <<EOF

Create or remove a Docker network and optionally configure host access.

Usage:

   $0 [-t <ntype>] [-s <subnet>] [-g <gateway>] [-n <nname>] [-i] [--link_ip=<link ip>] [--bridge-name=<bridge ifname>]

   $0 -r -n <nname>

Where:

   -t <ntype>          Network type: bridge, macvlan, ipvlan (def=${ntype})

   -s <subnet>         Subnet in CIDR format (def=${sn})

   -g <gateway>        Gateway IP address (def=${gw})

   -n <nname>          Docker network name (def=${nname})

   -i                  Configure host/routed access

   -r                  Remove/cleanup the given network

   --link_ip=<cidr>    Host-side helper IP for macvlan/ipvlan (def=${lip})

   --bridge-name=<if>  Linux bridge interface name for bridge networks (optional, otherwise br-nnnnnnnnnnnn)

Notes:

   * For macvlan/ipvlan, -g should normally be the real upstream router.

   * For bridge, -g is the Docker bridge gateway.

   * For bridge, -i adds INPUT/OUTPUT rules for host access and FORWARD rules for routed LAN access.

   * In remove mode, the network name is required.

EOF

}

derive_bridge_ifname()

{

   local network_name="$1"

   local explicit_bridge_name="$2"

   local bridge_if

   if [ -n "$explicit_bridge_name" ]; then

      echo "$explicit_bridge_name"

      return 0

   fi

   bridge_if=$(docker network inspect "$network_name" -f '{{index .Options "com.docker.network.bridge.name"}}' 2>/dev/null || true)

   if [ -n "$bridge_if" ] && [ "$bridge_if" != "<no value>" ]; then

      echo "$bridge_if"

      return 0

   fi

   local netid

   netid=$(docker network inspect "$network_name" -f '{{.Id}}')

   echo "br-${netid:0:12}"

}

network_has_endpoints()

{

   local network_name="$1"

   local count

   count=$(docker network inspect "$network_name" -f '{{len .Containers}}' 2>/dev/null || echo "0")

   [ "$count" != "0" ]

}

remove_network()

{

   local network_name="$1"

   local host_if_name="${network_name}_host"

   if ! docker network inspect "$network_name" >/dev/null 2>&1; then

      echo "Docker network $network_name does not exist"

      exit 1

   fi

   local driver

   local subnet

   local bridge_if

   driver=$(docker network inspect "$network_name" -f '{{.Driver}}')

   subnet=$(docker network inspect "$network_name" -f '{{(index .IPAM.Config 0).Subnet}}')

   echo "Removing Docker network $network_name"

   echo "  Driver: $driver"

   echo "  Subnet: $subnet"

   case "$driver" in

      bridge)

         bridge_if=$(derive_bridge_ifname "$network_name" "$bridge_name")

         if ip link show "$bridge_if" >/dev/null 2>&1; then

            echo "Removing bridge INPUT/OUTPUT rules for $bridge_if"

            remove_bridge_host_rules "$subnet" "$bridge_if"

            echo "Removing bridge FORWARD rules for $bridge_if"

            remove_bridge_forward_rules "$interf" "$bridge_if" "$subnet"

         fi

         ;;

      macvlan|ipvlan)

         if ip link show "$host_if_name" >/dev/null 2>&1; then

            echo "Removing FORWARD rules for helper interface $host_if_name"

            remove_forward_rules "$interf" "$host_if_name" "$subnet"

            echo "Deleting helper interface $host_if_name"

            sudo ip link delete "$host_if_name"

         fi

         ;;

   esac

   if network_has_endpoints "$network_name"; then

      echo "ERROR: Network $network_name still has attached containers/endpoints"

      echo "Detach or remove them first, then rerun."

      exit 1

   fi

   docker network rm "$network_name"

   echo "Removed Docker network $network_name"

}

# Defaults

ntype="macvlan"

sn="192.168.2.0/24"

gw="192.168.2.1"

interf=$(ip route get 8.8.8.8 | awk '{for(i=1;i<=NF;i++) if ($i=="dev") print $(i+1)}')

nname="corp_lan"

configure_host_access=false

remove_mode=false

lname="${nname}_host"

lip="192.168.2.10/24"

bridge_name=""

# Process options

while getopts "h?t:s:g:n:ir-:" opt

do

   case $opt in

      t )

         ntype=$OPTARG

         ;;

      s )

         sn=$OPTARG

         ;;

      g )

         gw=$OPTARG

         ;;

      n )

         nname=$OPTARG

         lname="${nname}_host"

         ;;

      i )

         configure_host_access=true

         ;;

      r )

         remove_mode=true

         ;;

      - )

         case ${OPTARG} in

            link_ip=* )

               lip="${OPTARG#*=}"

               ;;

            bridge-name=* )

               bridge_name="${OPTARG#*=}"

               ;;

            * )

               echo "Unknown option: --${OPTARG}"

               show_usage

               exit 1

               ;;

         esac

         ;;

      h | \? )

         show_usage

         exit 1

         ;;

   esac

done

shift $((OPTIND - 1))

if [ "$remove_mode" = true ]; then

   if [ -z "$nname" ]; then

      echo "ERROR: Remove mode requires -n <network_name>"

      exit 1

   fi

   remove_network "$nname"

   exit 0

fi

# Validate inputs

if invalid_cidr "$sn"; then

   echo "ERROR: Invalid CIDR IPv4 format: $sn"

   exit 1

fi

if [ "$configure_host_access" = true ] && [ "$ntype" != "bridge" ] && invalid_cidr "$lip"; then

   echo "ERROR: Invalid CIDR IPv4 format: $lip"

   exit 1

fi

case "$ntype" in

   bridge|macvlan|ipvlan)

      ;;

   *)

      echo "ERROR: Unsupported network type: $ntype"

      exit 1

      ;;

esac

# Ensure Docker network

if docker network inspect "$nname" >/dev/null 2>&1; then

   echo "Docker network $nname already exists"

else

   echo "Creating Docker network $nname"

   if [ "$ntype" = "bridge" ]; then

      create_cmd=(docker network create -d bridge --subnet="$sn" --gateway="$gw")

      if [ -n "$bridge_name" ]; then

         create_cmd+=(-o "com.docker.network.bridge.name=$bridge_name")

      fi

      if [ "$configure_host_access" = true ]; then

         create_cmd+=(-o "com.docker.network.bridge.trusted_host_interfaces=$interf")

      fi

      create_cmd+=("$nname")

      "${create_cmd[@]}"

   else

      docker network create \

         -d "$ntype" \

         --subnet="$sn" \

         --gateway="$gw" \

         -o parent="$interf" \

         "$nname"

   fi

fi

# Host-access configuration

if [ "$configure_host_access" = true ]; then

   if [ "$ntype" = "bridge" ]; then

      bridge_if=$(derive_bridge_ifname "$nname" "$bridge_name")

      if ! ip link show "$bridge_if" >/dev/null 2>&1; then

         echo "ERROR: Derived bridge interface $bridge_if does not exist"

         exit 1

      fi

      echo "Configuring host firewall rules for bridge interface $bridge_if"

      update_bridge_host_rules "$sn" "$bridge_if"

      update_bridge_forward_rules "$interf" "$bridge_if" "$sn"

   else

      if ip link show "$lname" >/dev/null 2>&1; then

         echo "Link $lname already exists... removing"

         sudo ip link delete "$lname"

      fi

      echo "Creating host ${ntype} link $lname"

      sudo ip link add "$lname" link "$interf" type "$ntype" mode bridge

      if ip addr show "$lname" | grep -q "$lip"; then

         echo "IP $lip already assigned to $lname"

      else

         echo "Assigning IP $lip to $lname"

         sudo ip addr add "$lip" dev "$lname"

      fi

      if ip link show "$lname" | grep -q "state UP"; then

         echo "$lname already UP"

      else

         echo "Bringing $lname up"

         sudo ip link set "$lname" up

      fi

      update_forward_rules "$interf" "$lname" "$sn"

   fi

fi