From 051452cdcfa4ba30142aad2ce39578867346626a Mon Sep 17 00:00:00 2001 From: Sameer Vohra Date: Wed, 24 Jun 2020 11:18:50 -0500 Subject: [PATCH] Update firewall README.md Document `CNI-ADMIN` chain usage as well as `iptablesAdminChainName` Signed-off-by: Sameer Vohra --- plugins/meta/firewall/README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/plugins/meta/firewall/README.md b/plugins/meta/firewall/README.md index f73a4121..1d3f3b1a 100644 --- a/plugins/meta/firewall/README.md +++ b/plugins/meta/firewall/README.md @@ -133,3 +133,17 @@ of the container as shown: - `-s 10.88.0.2 -m conntrack --ctstate RELATED,ESTABLISHED -j CNI-FORWARD` - `-d 10.88.0.2 -j CNI-FORWARD` +A new chain, CNI-ADMIN is added to the CNI-FORWARD chain. CNI-ADMIN is intended as a user-controlled chain that all traffic passes through prior to the rules managed by the `firewall` plugin. + +`CNI-FORWARD` chain: +- `-j CNI-ADMIN` + +The chain name `CNI-ADMIN` can be overridden by specifying `iptablesAdminChainName` in + +``` + { + "type": "firewall", + "backend": "iptables", + "iptablesAdminChainName": "SOME-OTHER-CHAIN-NAME", + } +```