mirror of
https://github.com/kernelkit/infix.git
synced 2026-08-01 21:33:02 +02:00
Joachim Wiberg
fe2d0f488d
This commit greatly simplifies AsciiDoc image references in generated Readme.adoc files. The two focused use-cases that remain after this change are working references in: - Generated output/images/test-report.pdf - Viewing test's Readme.adoc from GitHub Previously we aimed to have working images also when the test's Readme was included in the parent directory's Readme.adoc. This, however, is not supported as of this commit. It seems unlikely also to ever be a supported feature of AsciiDoc on GitHub, for details, see the following issue: <https://github.com/github/markup/issues/1095> Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
ifdef::topdoc[:imagesdir: {topdoc}../../test/case/infix_containers/container_firewall_basic]
=== Basic Firewall Container
==== Description
Verify that an nftables container can be used for IP masquerading and
port forwarding to another container running a basic web server.
....
<--- Docker containers --->
.-------------. .----------------------. .--------..---------------.
| | mgmt |------------| mgmt | | | | fire || | web |
| host | data |------------| ext0 | target | int0 | | wall || eth0 | server |
'-------------'.42 .1'----------------------' '--------''---------------'
\ .1 .2 /
192.168.0.0/24 \ 10.0.0.0/24 /
`-- VETH pair --'
....
The web server container is connected to the target on an internal
network, using a VETH pair, serving HTTP on port 91.
The firewall container sets up a port forward with IP masquerding
to/from `ext0:8080` to 10.0.0.2:91.
Correct operation is verified using HTTP GET requests for internal port
91 and external port 8080, to ensure the web page, with a known key
phrase, is only reachable from the public interface `ext0`, on
192.168.0.1:8080.
==== Topology
image::topology.svg[Basic Firewall Container topology, align=center, scaledwidth=75%]
==== Sequence
. Set up topology and attach to target DUT
. Set hostname to 'container-host'
. Create VETH pair for web server container
. Create firewall container from bundled OCI image
. Create web server container from bundled OCI image
. Verify firewall container has started
. Verify web container has started
. Verify connectivity, host can reach target:ext0
. Verify 'web' is NOT reachable on http://container-host.local:91
. Verify 'web' is reachable on http://container-host.local:8080