From b9be18c38696a2c57318580e8a6ad0ffa885b69c Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Sat, 30 Aug 2014 14:25:00 +0100 Subject: [PATCH] set up masquerading as part of 'weave launch' thus simplifying external access --- README.md | 12 ++---------- weaver/weave | 9 +++++++++ 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 4b6d5602..42c6f3cf 100644 --- a/README.md +++ b/README.md @@ -185,15 +185,7 @@ Say we want to make our 'nc' "service" that is running in the container on $HOST1 accessible to the outside world via $HOST2. This requires the following steps on $HOST2... -1. Add a NAT masquerading rule for the entire weave network. This - needs to be done just once. - - host2# iptables -t nat -A POSTROUTING -d 10.0.0.2/16 ! -s 10.0.0.2/16 -j MASQUERADE - - The IP address and netmask are the same as given in the `weave - launch` command. - -2. Add an IP address to the weave bridge. This needs to be done once +1. Add an IP address to the weave bridge. This needs to be done once for every weave application subnet. host2# ip addr add dev weave 10.0.1.102/24 @@ -201,7 +193,7 @@ requires the following steps on $HOST2... The address must be on the destination container's weave subnet and not already in use. -3. Add a NAT rule to route from the outside world to the destination +2. Add a NAT rule to route from the outside world to the destination container service. This needs to be done once for every service we want to expose. diff --git a/weaver/weave b/weaver/weave index 73da8bd0..67b0efc1 100755 --- a/weaver/weave +++ b/weaver/weave @@ -39,9 +39,18 @@ create_bridge() { ip link set dev $BRIDGE up } +setup_masquerading() { + IPTABLES_ARGS="POSTROUTING -d $IPADDR ! -s $IPADDR -j MASQUERADE" + if ! iptables -w -t nat -C $IPTABLES_ARGS >/dev/null 2>&1 + then + iptables -w -t nat -A $IPTABLES_ARGS >/dev/null + fi +} + case "$COMMAND" in launch) create_bridge + setup_masquerading # We set the router name to the bridge mac since that is # stable across re-creations of the containers. #