Bridge setup iptables rules

net/bridge.go

@@ -7,6 +7,7 @@ import (
 	"net"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/coreos/go-iptables/iptables"
 	"github.com/vishvananda/netlink"
 
 	"github.com/weaveworks/weave/common/odp"
@@ -159,6 +160,7 @@ type BridgeConfig struct {
 	NoBridgedFastdp  bool
 	MTU              int
 	Mac              string
+	Port             int
 }
 
 func CreateBridge(config *BridgeConfig) (BridgeType, error) {
@@ -196,7 +198,9 @@ func CreateBridge(config *BridgeConfig) (BridgeType, error) {
 			return None, err
 		}
 
-		configureIPTables(config)
+		if err = configureIPTables(config); err != nil {
+			return bridgeType, err
+		}
 	}
 
 	if bridgeType == Bridge {
@@ -293,7 +297,56 @@ func initBridgedFastdp(config *BridgeConfig) error {
 }
 
 func configureIPTables(config *BridgeConfig) error {
-	return fmt.Errorf("Not implemented")
+	ipt, err := iptables.New()
+	if err != nil {
+		return err
+	}
+	if config.DockerBridgeName != "" {
+		if config.WeaveBridgeName != config.DockerBridgeName {
+			err := ipt.Insert("filter", "FORWARD", 1, "-i", config.DockerBridgeName, "-o", config.WeaveBridgeName, "-j", "DROP")
+			if err != nil {
+				return err
+			}
+		}
+
+		dockerBridgeIP, err := FindBridgeIP(config.DockerBridgeName, nil)
+		if err != nil {
+			return err
+		}
+
+		// forbid traffic to the Weave port from other containers
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.DockerBridgeName, "-p", "tcp", "--dst", dockerBridgeIP.String(), "--dport", fmt.Sprint(config.Port), "-j", "DROP"); err != nil {
+			return err
+		}
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.DockerBridgeName, "-p", "udp", "--dst", dockerBridgeIP.String(), "--dport", fmt.Sprint(config.Port), "-j", "DROP"); err != nil {
+			return err
+		}
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.DockerBridgeName, "-p", "udp", "--dst", dockerBridgeIP.String(), "--dport", fmt.Sprint(config.Port+1), "-j", "DROP"); err != nil {
+			return err
+		}
+
+		// let DNS traffic to weaveDNS, since otherwise it might get blocked by the likes of UFW
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.DockerBridgeName, "-p", "udp", "--dport", "53", "-j", "ACCEPT"); err != nil {
+			return err
+		}
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.DockerBridgeName, "-p", "tcp", "--dport", "53", "-j", "ACCEPT"); err != nil {
+			return err
+		}
+	}
+
+	// Work around the situation where there are no rules allowing traffic
+	// across our bridge. E.g. ufw
+	if err = ipt.AppendUnique("filter", "FORWARD", "-i", config.WeaveBridgeName, "-o", config.WeaveBridgeName, "-j", "ACCEPT"); err != nil {
+		return err
+	}
+
+	// create a chain for masquerading
+	ipt.NewChain("nat", "WEAVE")
+	if err = ipt.AppendUnique("nat", "POSTROUTING", "-j", "WEAVE"); err != nil {
+		return err
+	}
+
+	return nil
 }
 
 func linkSetUpByName(linkName string) error {