From 5a1361167e5dd40a9738a5e97214938b3be47346 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Fri, 5 Jan 2018 12:44:33 +0000 Subject: [PATCH] Move our rules to the top of the FORWARD chain We want our DROP rule to be executed ahead of any ACCEPT rules which might have been added by another program on the system. --- net/bridge.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/bridge.go b/net/bridge.go index f46c08c9..c084d7cd 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -504,7 +504,7 @@ func linkSetUpByName(linkName string) error { // ensureRules ensures the presence of given iptables rules. // // If any rule from the list is missing, the function deletes all given -// rules and re-appends them to ensure the order of the rules. +// rules and re-inserts them to ensure the order of the rules. func ensureRules(table, chain string, rulespecs [][]string, ipt *iptables.IPTables) error { allFound := true @@ -524,13 +524,13 @@ func ensureRules(table, chain string, rulespecs [][]string, ipt *iptables.IPTabl return nil } - for _, rs := range rulespecs { + for pos, rs := range rulespecs { // If any is missing, then delete all, as we need to preserve the order of // given rules. Ignore errors, as rule might not exist. if !allFound { ipt.Delete(table, chain, rs...) } - if err := ipt.Append(table, chain, rs...); err != nil { + if err := ipt.Insert(table, chain, pos+1, rs...); err != nil { return errors.Wrapf(err, "ipt.Append(%s, %s, %s)", table, chain, rs) } }