COMMIT
可以看到已经智能自动修改了
6、添加额外的外网ip
使用-ap来添加
[root@docker-test3 code]# python modify_docker_container_firewall.py test1 -ap 117.121.x.99/24
add external ip:117.121.x.99/24 is success!
[root@docker-test3 code]# ping 117.121.x.99 -c 2
PING 117.121.x.99 (117.121.x.99) 56(84) bytes of data.
64 bytes from 117.121.x.99: icmp_seq=1 ttl=64 time=0.039 ms
64 bytes from 117.121.x.99: icmp_seq=2 ttl=64 time=0.032 ms
--- 117.121.x.99 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.032/0.035/0.039/0.006 ms可以看到已经添加成功，并且能ping通，安全起见，我把额外的外网ip第三位添加个x，防止坏人扫描。
在通过修改防火墙来设置外部模式策略
[root@docker-test3 code]# python modify_docker_container_firewall.py test1 -a -m external -pm dynamic -s all -d 117.121.x.99 -dp 22
{'Mode': 'internal', 'Container_name': 'test1', 'Source_port': '40030', 'Source_ip': '1.1.1.1/24', 'Local_port': '22', 'Port_mode': 'dynamic', 'Id': 1, 'Container_ip': '172.16.1.2/24'}
{'Destination_ip': '117.121.x.99', 'Mode': 'external', 'Container_name': 'test1', 'Source_port': '40033', 'Port_mode': 'dynamic', 'Local_port': '22', 'Source_ip': '0.0.0.0/0.0.0.0', 'Id': 2, 'Container_ip': '172.16.1.2/24'}备注：其中-s all是允许所有公网ip访问
然后生效
[root@docker-test3 code]# python modify_docker_container_firewall.py test1 -e
config firewall rule is success!
[root@docker-test3 code]# iptables -t nat -L -nv
Chain PREROUTING (policy ACCEPT 16 packets, 1308 bytes)
pkts bytes target prot opt in out source destination
1 60 DOCKER all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 1 packets, 60 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER all -- * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * * 172.16.0.0/16 !172.16.0.0/16
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- !ovs2 * 1.1.1.0/24 0.0.0.0/0 tcp dpt:40030 to:172.16.1.2:22
0 0 DNAT tcp -- !ovs2 * 0.0.0.0/0 117.121.x.99 tcp dpt:40033 to:172.16.1.2:22然后ssh登陆试试
[root@docker-test3 code]# ssh 117.121.x.99 -l root -p 40033
The authenticity of host '[117.121.x.99]:40033 ([117.121.x.99]:40033)' can't be established.
RSA key fingerprint is 39:7c:13:9f:d4:b0:d7:63:fc:ff:ae:e3:46:a4:bf:6b.
