#install
Title
# install
c
cool-sandwich-30095
05/18/2022, 9:14 PMWhere do I start.
Well, do test the quick install if it really works as intended.
Next, why is caddy running in host mode https://github.com/gravitl/netmaker/blob/master/compose/docker-compose.yml#L68 while the caddy is using hostnames https://github.com/gravitl/netmaker/blob/master/docker/Caddyfile which are only available in dockers own networks?
All other containers are created with their own network due to compose, yet caddy is in the hostnetwork. Which won't work, unless you create a network and assign it to the containers and the caddy container.
Also generally speaking, unless things changed, ufw is kinda useless on the docker host.
Reason being in how the firewall is managed by docker and where the rules land.
Since when docker is "publishing" ports, it lands on the forward filer, which bypasses the input filter.
j
jolly-london-20127
05/18/2022, 9:21 PMwe need to update the default docker-compose on the github. The default is actually https://github.com/gravitl/netmaker/blob/master/compose/docker-compose.contained.yml, which does not expose caddy with host networking.
docker-compose.yml should match exactly docker-compose.contained.yml, but appears it does not
c
cool-sandwich-30095
05/18/2022, 9:22 PMOr update the docs.
iirc this should still work https://github.com/moby/moby/issues/22054#issuecomment-962202433
So, unless the rules land in the
mangle-t mangle -A PREROUTINGj
jolly-london-20127
05/18/2022, 9:25 PMdocs have been updated, and I've created an issue to update the docker-compose.yml in the next release
c
cool-sandwich-30095
05/18/2022, 9:27 PMBut that is only my experience, do test it out yourself.
j
jolly-london-20127
05/18/2022, 9:28 PMYour assessment is correct. We updated caddy configuration to avoid host networking, and just did not update all the docker-compose files equally
c
cool-sandwich-30095
05/18/2022, 9:30 PMNah, talking about the firewall and docker iptables.
The first part is just a minor documentation problem.
j
jolly-london-20127
05/18/2022, 9:31 PMwhat issue are you encountering with iptables?
c
cool-sandwich-30095
05/18/2022, 9:33 PMI am implying that the ufw rules will only protect against people trying to access ports without any extra work.
But due to how docker does it's iptables configuration, if you change the routing on your system to use the docker host and iterate over the internal ips, you will be able to access the published ports that would otherwise be protected by the INPUT filter.
see ^
So what I am implying is: I hope you have no internal ports that would chat or publish information without authentication, assuming they are protected by the system firewall.
When using docker, that is.
And not having a dedicated firewall in front of the system.
4 Views