mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-31 13:03:02 +02:00
Joachim Wiberg
9273f4cd1e
Rename test directories in infix_containers/ to remove the redundant 'container_' prefix since they already live under infix_containers/: container_basic -> basic container_bridge -> bridge container_enabled -> enabled container_environment -> environment container_firewall_basic -> firewall_basic container_host_commands -> host_commands container_phys -> phys container_veth -> veth container_volume -> volume Also update references in all.yaml and Readme.adoc files. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
49 lines
1.8 KiB
Plaintext
49 lines
1.8 KiB
Plaintext
=== Basic Firewall Container
|
|
|
|
ifdef::topdoc[:imagesdir: {topdoc}../../test/case/infix_containers/firewall_basic]
|
|
|
|
==== Description
|
|
|
|
Verify that an nftables container can be used for IP masquerading and
|
|
port forwarding to another container.
|
|
|
|
....
|
|
<--- Docker containers --->
|
|
.-------------. .----------------------. .--------..---------------.
|
|
| | mgmt |------------| mgmt | | | | fire || | web |
|
|
| host | data |------------| ext0 | target | int0 | | wall || eth0 | server |
|
|
'-------------'.42 .1'----------------------' '--------''---------------'
|
|
\ .1 .2 /
|
|
192.168.0.0/24 \ 10.0.0.0/24 /
|
|
`-- VETH pair --'
|
|
....
|
|
|
|
The web server container is connected to the target on an internal
|
|
network, using a VETH pair, serving HTTP on port 91.
|
|
|
|
The firewall container sets up a port forward with IP masquerding
|
|
to/from `ext0:8080` to 10.0.0.2:91.
|
|
|
|
Operation is verified using HTTP GET requests for internal port 91 and
|
|
external port 8080 to ensure the web page, with a known key phrase, is
|
|
only reachable from the public interface `ext0`, on 192.168.0.1:8080.
|
|
|
|
==== Topology
|
|
|
|
image::topology.svg[Basic Firewall Container topology, align=center, scaledwidth=75%]
|
|
|
|
==== Sequence
|
|
|
|
. Set up topology and attach to target DUT
|
|
. Set hostname to 'container-host'
|
|
. Create VETH pair for web server container
|
|
. Create firewall container from bundled OCI image
|
|
. Create web server container from bundled OCI image
|
|
. Verify firewall container has started
|
|
. Verify web container has started
|
|
. Verify connectivity, host can reach target:ext0
|
|
. Verify 'web' is NOT reachable on http://container-host.local:91
|
|
. Verify 'web' is reachable on http://container-host.local:8080
|
|
|
|
|