Skip to content

Commit c46b7bc

Browse files
robmryrobmry
committed
Update description of gateway modes
Signed-off-by: Rob Murray <[email protected]>
1 parent d2bc218 commit c46b7bc

File tree

2 files changed

+61
-23
lines changed

2 files changed

+61
-23
lines changed

‎content/manuals/engine/network/drivers/bridge.md‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -105,16 +105,16 @@ flag.
105105
The following table describes the driver-specific options that you can pass to
106106
`--option` when creating a custom network using the `bridge` driver.
107107

108-
| Option | Default | Description |
109-
|-------------------------------------------------------------------------------------------------|-----------------------------|-----------------------------------------------------------------------------------------------------|
110-
| `com.docker.network.bridge.name` | | Interface name to use when creating the Linux bridge. |
111-
| `com.docker.network.bridge.enable_ip_masquerade` | `true` | Enable IP masquerading. |
112-
| `com.docker.network.bridge.gateway_mode_ipv4`<br/>`com.docker.network.bridge.gateway_mode_ipv6` | `nat` | Enable NAT and masquerading (`nat`), or only allow direct routing to the container (`routed`). |
113-
| `com.docker.network.bridge.enable_icc` | `true` | Enable or Disable inter-container connectivity. |
114-
| `com.docker.network.bridge.host_binding_ipv4` | all IPv4 and IPv6 addresses | Default IP when binding container ports. |
115-
| `com.docker.network.driver.mtu` | `0` (no limit) | Set the containers network Maximum Transmission Unit (MTU). |
116-
| `com.docker.network.container_iface_prefix` | `eth` | Set a custom prefix for container interfaces. |
117-
| `com.docker.network.bridge.inhibit_ipv4` | `false` | Prevent Docker from [assigning an IP address](#skip-bridge-ip-address-configuration) to the bridge. |
108+
| Option | Default | Description |
109+
|-------------------------------------------------------------------------------------------------|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
110+
| `com.docker.network.bridge.name` | | Interface name to use when creating the Linux bridge. |
111+
| `com.docker.network.bridge.enable_ip_masquerade` | `true` | Enable IP masquerading. |
112+
| `com.docker.network.bridge.gateway_mode_ipv4`<br/>`com.docker.network.bridge.gateway_mode_ipv6` | `nat` | Enable NAT and masquerading (`nat`), or only allow direct routing to the container (`routed`). See [Packet filtering and firewalls](packet-filtering-firewalls.md). |
113+
| `com.docker.network.bridge.enable_icc` | `true` | Enable or Disable inter-container connectivity. |
114+
| `com.docker.network.bridge.host_binding_ipv4` | all IPv4 and IPv6 addresses | Default IP when binding container ports. |
115+
| `com.docker.network.driver.mtu` | `0` (no limit) | Set the containers network Maximum Transmission Unit (MTU). |
116+
| `com.docker.network.container_iface_prefix` | `eth` | Set a custom prefix for container interfaces. |
117+
| `com.docker.network.bridge.inhibit_ipv4` | `false` | Prevent Docker from [assigning an IP address](#skip-bridge-ip-address-configuration) to the bridge. |
118118

119119
Some of these options are also available as flags to the `dockerd` CLI, and you
120120
can use them to configure the default `docker0` bridge when starting the Docker

‎content/manuals/engine/network/packet-filtering-firewalls.md‎

Lines changed: 51 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -129,31 +129,69 @@ clients. No routes are normally set up in the host's network for container
129129
addresses that exist within a host.
130130

131131
But, particularly with IPv6 you may prefer to avoid using NAT and instead
132-
arrange for external routing to container addresses.
132+
arrange for external routing to container addresses ("direct routing").
133133

134134
To access containers on a bridge network from outside the Docker host,
135135
you must set up routing to the bridge network via an address on the Docker
136136
host. This can be achieved using static routes, Border Gateway Protocol
137137
(BGP), or any other means appropriate for your network.
138138

139-
The bridge network driver has options
140-
`com.docker.network.bridge.gateway_mode_ipv6=<nat|routed>` and
141-
`com.docker.network.bridge.gateway_mode_ipv4=<nat|routed>`.
139+
Within a local layer 2 network, remote hosts can set up static routes
140+
to a container network using the Docker daemon host's address on the local
141+
network. Those hosts can access containers directly. For remote hosts
142+
outside the local network, direct access to containers requires router
143+
configuration to enable the necessary routing.
144+
145+
#### Gateway modes
146+
147+
The bridge network driver has the following options:
148+
- `com.docker.network.bridge.gateway_mode_ipv6`
149+
- `com.docker.network.bridge.gateway_mode_ipv4`
150+
151+
Each of these can be set to one of the gateway modes:
152+
- `nat`
153+
- `nat-unprotected`
154+
- `routed`
142155

143156
The default is `nat`, NAT and masquerading rules are set up for each
144-
published container port. With mode `routed`, no NAT or masquerading rules
145-
are set up, but `iptables` are still set up so that only published container
146-
ports are accessible.
157+
published container port. Packets leaving the host will use a host address.
158+
159+
With mode `routed`, no NAT or masquerading rules are set up, but `iptables`
160+
are still set up so that only published container ports are accessible.
161+
Outgoing packets from the container will use the container's address,
162+
not a host address.
163+
164+
In `nat` mode, when a port is published to a specific host address, that
165+
port is only accessible via the host interface with that address. So,
166+
for example, publishing a port to an address on the loopback interface
167+
means remote hosts cannot access it.
168+
169+
However, using direct routing, published container ports are always
170+
accessible from remote hosts, unless the Docker host's firewall has
171+
additional restrictions. Hosts on the local layer-2 network can set up
172+
direct routing without needing any additional network configuration.
173+
Hosts outside the local network can only use direct routing to the
174+
container if the network's routers are configured to enable it.
175+
176+
In `nat-unprotected` mode, unpublished container ports are also
177+
accessible using direct routing, no port filtering rules are set up.
178+
This mode is included for compatibility with legacy default behaviour.
179+
180+
The gateway mode also affects communication between containers that
181+
are connected to different Docker networks on the same host.
182+
- In `nat` and `nat-unprotected` modes, containers in other bridge
183+
networks can only access published ports via the host addresses they
184+
are published to. Direct routing from other networks is not allowed.
185+
- In `routed` mode containers in other networks can use direct
186+
routing to access ports, without going via a host address.
147187

148188
In `routed` mode, a host port in a `-p` or `--publish` port mapping is
149189
not used, and the host address is only used to decide whether to apply
150190
the mapping to IPv4 or IPv6. So, when a mapping only applies to `routed`
151-
mode, only addresses `0.0.0.0` or `::1` are allowed, and a host port
152-
must not be given.
153-
154-
Mapped container ports, in `nat` or `routed` mode, are accessible from
155-
any remote address, if routing is set up in the network, unless the
156-
Docker host's firewall has additional restrictions.
191+
mode, only addresses `0.0.0.0` or `::` should be used, and a host port
192+
should not be given. If a specific address or port is given, it will
193+
have no effect on the published port and a warning message will be
194+
logged.
157195

158196
#### Example
159197

0 commit comments

Comments
 (0)