ClearFoundation Tracker - ClearCenter
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0021031ClearCenterapp-clearglass - ClearGLASS Enginepublic2018-08-08 15:282018-10-30 19:47
ReporterNickH 
Assigned Touser2 
PrioritynormalSeverityminorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version 
Target Version7.5.0 UpdatesFixed in Version7.5.0 Updates 
Summary0021031: Firewall issues
Description/etc/clearos/firewall.d/10-docker largely fails on boot as the interface docker0 does not exist. In this case you need to restart the firewall after docker starts to get the rules (or run the configlet manually). Starting docker does neither of these.

Also in /etc/clearos/firewall.d/10-docker, superfluous rules are generated. The rules:
$IPTABLES -t filter -A FORWARD -i $IFACE ! -o $IFACE -j ACCEPT
$IPTABLES -t filter -A FORWARD -i $IFACE -o $IFACE -j ACCEPT
are covered by:
$IPTABLES -t filter -A FORWARD -i $IFACE -j ACCEPT

and the rule:
$IPTABLES -t filter -A FORWARD -o $IFACE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
is entirely covered by the default rule which allows all related and established packets in both directions.

$IPTABLES -t filter -A OUTPUT -o $IFACE -j ACCEPT should be unnecessary as all OUTPUT is allowed by default although ClearOS does seem to add OUTPUT rules matching INPUT rules.

Lastly, it is probably a good idea to split out the docker rules from the ClearGLASS rules so, if you run other containers such as Samba AD Domain Controller, you don't pull in the ClearGLASS rules and vice-versa.
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
related to 0021061closed NickH ClearOS Create docker firewall framework 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2018-08-08 15:28NickHNew Issue
2018-08-10 00:31user2Note Added: 0007751
2018-08-10 00:33user2Note Added: 0007761
2018-08-10 00:33user2ProjectClearOS => ClearCenter
2018-08-10 00:33user2Categoryapp-docker - Docker => General
2018-08-10 00:34user2Statusnew => confirmed
2018-08-10 00:34user2CategoryGeneral => app-clearglass - ClearGLASS Engine
2018-08-10 00:34user2Target Version => 7.5.0 Updates
2018-08-10 00:35user2Note Added: 0007771
2018-08-10 14:48NickHNote Added: 0007791
2018-08-13 07:58user2Issue cloned: 0021061
2018-08-13 07:58user2Relationship addedrelated to 0021061
2018-08-13 08:15user2Note Added: 0007821
2018-08-14 10:53user2Statusconfirmed => resolved
2018-08-14 10:53user2Fixed in Version => 7.5.0 Updates
2018-08-14 10:53user2Resolutionopen => fixed
2018-08-14 10:53user2Assigned To => user2
2018-10-30 19:47user2Statusresolved => closed

Notes
(0007751)
user2   
2018-08-10 00:31   
Ultimately, the 10-docker configlet was designed to mimic the behavior of Docker rules (including rules that may be superfluous in gateway mode). As discussed in tech meetings, this is a complete dead end - Docker + iptables + ClearOS gateway is a non-starter. At this point 10-docker is really just a hack to get ClearGLASS working.

Bottom line: Docker in its current version/state should not be used on a ClearOS gateway.
(0007761)
user2   
2018-08-10 00:33   
The ClearGLASS containers do not recover well on a reboot. A workaround was added -- a ClearOS "onboot event" handler was added. I'll add the firewall configlet restart to the workaround.
(0007771)
user2   
2018-08-10 00:35   
Also, let me see if I can get a champion assigned to this app.
(0007791)
NickH   
2018-08-10 14:48   
Please can you classify this back to an app-docker bug and include in app-docker package a file /etc/sysconfig/network-scripts/ifcfg-docker0. In it put:
DEVICE=docker0
TYPE="Bridge"
ONBOOT="yes"
USERCTL="no"
BOOTPROTO="none"

This creates a stub interface which allows all rules with a docker0 interface to be applied correctly on boot. When docker then starts, it configures the interface as it wants (tested).

Then all the rules specific to ClearGLASS (the ones with the br- interface) can be split into a separate configlet, say 11-clearglass, which will run after 10-docker runs to make sure the DOCKER and DOCKER-ISOLATION chains exist before it applies rules to them.

It is necessary for docker to be able to start correctly from boot if it is to run Samba Domain Controller.
(0007821)
user2   
2018-08-13 08:15   
> Please can you classify this back to an app-docker bug

Done! This tracker item is now only about this scope:

     /etc/clearos/firewall.d/10-docker largely fails on boot as the interface
    docker0 does not exist. In this case you need to restart the firewall after
    docker starts to get the rules (or run the configlet manually). Starting docker does neither of these.

The Docker firewall integration has moved to 0021061 under "app-docker"