Problem Description
I’m trying to install Docker on a Sympl host running Debian 12, and it looks as though the sympl-firewall system is deleting the DOCKER-FORWARD chain from IPTables.
Is there any way to keep this chain (which Docker manages dynamically) between sympl-firewall runs? The documentation mentions being able to run scripts using local.d if running Docker, but that seems like it would have to lose the chain before recreating it each time sympl-firewall runs.
Environment
- Sympl Version: 12
- Debian Version: 12
- Hardware Type: VM
- Hosted With: DigitalOcean
In trying to find a way around this, I think I’ve found a bug in sympl-firewall: sympl-firewall doesn't find local templates (#370) · Issues · sympl.io / Sympl · GitLab.
Fixing that allows a workaround template in /usr/local/share/sympl/firewall/action.d/load.sh.erb which I can modify to not delete Docker’s rules, but fixing sympl-firewall: The firewall shouldn't destroy other chains, and should be less ambiguous. (#289) · Issues · sympl.io / Sympl · GitLab would be the long-term solution.
I’d be interested in a stable fix for running containers on sympl.io servers but I found too many issues so for several years have a rule to run docker on native linux not scripted such as sympl.io hosts.
I’m not 100% certain if that’s an incomplete feature, or an older testing system for when it was Symbiosis (very possible), but it’s not a bug.
sympl-firewall is still built to simply fail-safe and blow away the old firewall and replace it with whatever it’s configured for, ignoring any other chains or similar, which is the same reason fail2ban doesn’t work with it.
The best way around this would be to use /etc/sympl/firewall/local.d/ and insert a script there which has Docker regenerate/reimplement its network rules.
The other way around it would simply not to run sympl-firewall, and manage the firewall yourself.