Signed-off-by: Alessandro Boch <aboch@docker.com>
| ... | ... |
@@ -27,7 +27,7 @@ clone git github.com/RackSec/srslog 6eb773f331e46fbba8eecb8e794e635e75fc04de |
| 27 | 27 |
clone git github.com/imdario/mergo 0.2.1 |
| 28 | 28 |
|
| 29 | 29 |
#get libnetwork packages |
| 30 |
-clone git github.com/docker/libnetwork v0.6.0-rc6 |
|
| 30 |
+clone git github.com/docker/libnetwork v0.6.0-rc7 |
|
| 31 | 31 |
clone git github.com/armon/go-metrics eb0af217e5e9747e41dd5303755356b62d28e3ec |
| 32 | 32 |
clone git github.com/hashicorp/go-msgpack 71c2886f5a673a35f909803f38ece5810165097b |
| 33 | 33 |
clone git github.com/hashicorp/memberlist 9a1e242e454d2443df330bdd51a436d5a9058fc4 |
| ... | ... |
@@ -138,6 +138,7 @@ func setupIPTablesInternal(bridgeIface string, addr net.Addr, icc, ipmasq, hairp |
| 138 | 138 |
address = addr.String() |
| 139 | 139 |
natRule = iptRule{table: iptables.Nat, chain: "POSTROUTING", preArgs: []string{"-t", "nat"}, args: []string{"-s", address, "!", "-o", bridgeIface, "-j", "MASQUERADE"}}
|
| 140 | 140 |
hpNatRule = iptRule{table: iptables.Nat, chain: "POSTROUTING", preArgs: []string{"-t", "nat"}, args: []string{"-m", "addrtype", "--src-type", "LOCAL", "-o", bridgeIface, "-j", "MASQUERADE"}}
|
| 141 |
+ skipDNAT = iptRule{table: iptables.Nat, chain: DockerChain, preArgs: []string{"-t", "nat"}, args: []string{"-i", bridgeIface, "-j", "RETURN"}}
|
|
| 141 | 142 |
outRule = iptRule{table: iptables.Filter, chain: "FORWARD", args: []string{"-i", bridgeIface, "!", "-o", bridgeIface, "-j", "ACCEPT"}}
|
| 142 | 143 |
inRule = iptRule{table: iptables.Filter, chain: "FORWARD", args: []string{"-o", bridgeIface, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"}}
|
| 143 | 144 |
) |
| ... | ... |
@@ -147,6 +148,9 @@ func setupIPTablesInternal(bridgeIface string, addr net.Addr, icc, ipmasq, hairp |
| 147 | 147 |
if err := programChainRule(natRule, "NAT", enable); err != nil {
|
| 148 | 148 |
return err |
| 149 | 149 |
} |
| 150 |
+ if err := programChainRule(skipDNAT, "SKIP DNAT", enable); err != nil {
|
|
| 151 |
+ return err |
|
| 152 |
+ } |
|
| 150 | 153 |
} |
| 151 | 154 |
|
| 152 | 155 |
// In hairpin mode, masquerade traffic from localhost |