infix

=== Basic Firewall Container
==== Description
Verify that an nftables container can be used for IP masquerading and
port forwarding to another container running a basic web server.

....
                                                    <--- Docker containers --->
.-------------.            .----------------------. .--------..---------------.
|      | mgmt |------------| mgmt |        |      | |  fire  ||      |  web   |
| host | data |------------| ext0 | target | int0 | |  wall  || eth0 | server |
'-------------'.42       .1'----------------------' '--------''---------------'
                                              \ .1             .2 /
              192.168.0.0/24                   \   10.0.0.0/24   /
                                                `-- VETH pair --'
....

The web server container is connected to the target on an internal
network, using a VETH pair, serving HTTP on port 91.

The firewall container sets up a port forward with IP masquerding
to/from `ext0:8080` to 10.0.0.2:91.

Correct operation is verified using HTTP GET requests for internal port
91 and external port 8080, to ensure the web page, with a known key
phrase, is only reachable from the public interface `ext0`, on
192.168.0.1:8080.

==== Topology
ifdef::topdoc[]
image::../../test/case/infix_containers/container_firewall_basic/topology.svg[Basic Firewall Container topology]
endif::topdoc[]
ifndef::topdoc[]
ifdef::testgroup[]
image::container_firewall_basic/topology.svg[Basic Firewall Container topology]
endif::testgroup[]
ifndef::testgroup[]
image::topology.svg[Basic Firewall Container topology]
endif::testgroup[]
endif::topdoc[]
==== Test sequence
. Set up topology and attach to target DUT
. Set hostname to 'container-host'
. Create VETH pair for web server container
. Create firewall container from bundled OCI image
. Create web server container from bundled OCI image
. Verify firewall container has started
. Verify web container has started
. Verify connectivity, host can reach target:ext0
. Verify 'web' is NOT reachable on http://container-host.local:91
. Verify 'web' is reachable on http://container-host.local:8080


<<<