0

I am running a custom-built firewall application on my OpenWRT router. This application manipulates the iptables rules and routing table rules dynamically based on packet patterns. This application works perfectly:

  • When embedded as a package inside the OpenWRT firmware.
  • When run inside a privileged LxC container.
  • When run inside a privileged Docker container.

Now, I want to run this inside a unprivileged container. And, I don't even know where to start :)

AFAICT, in an unprivileged container, the network namespace is NOT shared. Then any manipulation of the iptables or routing rules are limited to the container & are not shared with the host. The question(s) I have are:

  1. First problem is for the firewall-application to intercept the packets on the OpenWRT/Host. Is there any means to forward the packets the container from the host?
  2. Second problem is to transfer/translate the iptables rules from the container to the host. Is this possible? I am aware we can run an agent on the host/OpenWRT that can use UDS (or socket) to communicate with the application inside the container. But is there any other option without making design changes?

Any pointers will be helpful. I am open to solutions both on docker & LxC.

Thanks in advance, Stackers.

meetrp
  • 155
  • 9
  • It sounds like you don't really want Docker's network isolation; does `--net host` have the effect you want? (Why do you want to use Docker to manage the host's firewall rules?) – David Maze Apr 12 '20 at 02:00
  • @DavidMaze: Thanks for your response. Correct me if I am wrong but isn't the '--net host' equivalent to sharing the Network Namespace? Eventually, I will be publishing my firewall application containers (docker or lxc). Hence, I need the solution to work in a high-constraint environment (like unprivileged containers), Hope this helps to understand my goal. – meetrp Apr 13 '20 at 07:41
  • Can you make the container get direct access to the host network interface and have the host not use the actual network interface directly but just one of the container network interfaces instead? I am doing it with distinct bridges in Proxmox, for example. – Paul Stelian Feb 20 '22 at 16:14

0 Answers0