Merge branch '94_iptables_for_ufw'

Fixes #94

weaver/weave

@@ -47,6 +47,32 @@ check_command_and_run() {
     fi
 }
 
+run_iptables() {
+    # -w is recent addition to iptables
+    if [ -z "$CHECKED_IPTABLES_W" ] ; then
+        if iptables -S -w >/dev/null 2>&1 ; then
+            IPTABLES_W=-w
+        fi
+        CHECKED_IPTABLES_W=1
+    fi
+
+    iptables $IPTABLES_W "$@"
+}
+
+# Add a rule to iptables, if it doesn't exist already
+add_iptables_rule() {
+    IPTABLES_TABLE="$1"
+    shift 1
+    if ! run_iptables -t $IPTABLES_TABLE -C "$@" >/dev/null 2>&1
+    then
+        run_iptables -t $IPTABLES_TABLE -A "$@" >/dev/null
+    fi
+}
+
+add_nat_rule() {
+    add_iptables_rule nat "$@"
+}
+
 create_bridge() {
     [ ! -d /sys/class/net/$BRIDGE ] && {
         ip link add dev $BRIDGE type bridge
@@ -60,6 +86,9 @@ create_bridge() {
         ip link del dev v${CONTAINER_IFNAME}du
         # disable offloading
         check_command_and_run ethtool ethtool -K $BRIDGE tx off >/dev/null
+        # Work around the situation where there are no rules allowing traffic
+        # across our bridge. E.g. ufw
+        add_iptables_rule filter FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT
     }
     ip link set dev $BRIDGE up
 }
@@ -68,25 +97,7 @@ destroy_bridge() {
     if [ -d /sys/class/net/$BRIDGE ] ; then
         ip link del dev $BRIDGE
     fi
-}
-
-run_iptables() {
-    # -w is recent addition to iptables
-    if [ -z "$CHECKED_IPTABLES_W" ] ; then
-        if iptables -S -w >/dev/null 2>&1 ; then
-            IPTABLES_W=-w
-        fi
-        CHECKED_IPTABLES_W=1
-    fi
-
-    iptables $IPTABLES_W "$@"
-}
-
-add_nat_rule() {
-    if ! run_iptables -t nat -C "$@" >/dev/null 2>&1
-    then
-        run_iptables -t nat -A "$@" >/dev/null
-    fi
+    run_iptables -t filter -D FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT 2>/dev/null || true
 }
 
 setup_masquerading() {