add Phase 2B contained runtime artifacts
This commit is contained in:
parent
a9fec0d83d
commit
82e64cec43
35 changed files with 5177 additions and 40 deletions
4
docs/le-app-database-migration/phase2b-contained-runtime/.gitattributes
vendored
Normal file
4
docs/le-app-database-migration/phase2b-contained-runtime/.gitattributes
vendored
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
# Preserve checksummed generated evidence and staged payload bytes verbatim.
|
||||
inventory/** -whitespace
|
||||
payload/** -whitespace
|
||||
tests/** -whitespace
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# Exact staged installation and acceptance order
|
||||
|
||||
Every numbered boundary requires review and explicit approval. Nothing here authorizes execution.
|
||||
|
||||
1. From this directory, run only `tests/00-root-preinstall-validate.sh` as root and require zero failures. It atomically checks both manifests, staged nftables/systemd/shell/JSON, exact Phase 1 ownership/modes, absent approval marker/installed payload/manager/process/socket/linger, and public/NAT address drift. Save output outside production.
|
||||
2. Preserve the approved Quad9 DNS pair `9.9.9.9` and `149.112.112.112`, observed public/NAT address denial `74.67.173.56`, and verified root inventory. Quad9 requires no LAN exception; `192.168.10.1` remains denied. Any different value or public/NAT drift requires artifact edits, a new manifest, and another review.
|
||||
3. Copy only the manifest-listed launcher to `/usr/local/libexec`, mode `0755`, `root:root`; rehash the installed file.
|
||||
4. Copy only the slice and `user@1200.service` drop-ins, resolver file, namespace helper/unit, and nftables fragment to their manifest paths with `root:root`, directories/files `0755/0644`, helper `0755`. After exact-value approval, create root-owned mode `0644` `/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED` containing the artifact-manifest checksum and approval timestamp. Do not start anything. Run `systemd-analyze verify` and `nft --check -f`; inspect the merged `systemctl cat`/properties.
|
||||
5. Copy the Docker user unit/config/context and tests below `/srv/le-app-codex`; set directories `0750`, config/unit/tests `0640` except tests `0750`, all owned `1200:1200`. Do not create credentials, checkout, or source copies.
|
||||
6. Run `systemctl daemon-reload`. Confirm the user manager remains inactive, lingering absent, and socket/process absent.
|
||||
7. Start only `le-app-codex-netns.service`. Inspect namespace identity, IPv4-only addresses/routes, nftables counters/rules, host routing, and production Docker health. Stop on any drift.
|
||||
8. Run `tests/run-inert-without-user-manager.sh`. This starts only a finite transient test process, never `user@1200.service`, Docker, or Codex. Require every filesystem/process/cgroup/device/socket/network assertion to pass.
|
||||
9. Review the inert evidence. Only a later explicit runtime-acceptance approval may start `user@1200.service`, enable `docker.service` within its controlled lifetime, or run `tests/20-rootless-docker.sh` as UID 1200.
|
||||
10. The later positive/negative Docker test uses only `unix:///run/user/1200/docker.sock`, disposable pinned images, and teardown. It must prove rootless/data-root/context behavior and denial of rootful sockets, private/host/LAN/VPN/metadata/SMTP/IPv6, and published ports.
|
||||
11. Stop the manager after testing. Codex authentication, Codex startup, repository/source/credential copying, application startup, and production changes remain out of scope.
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
f5bc35fd3767c0cbc72495b1dea283e8237789dd383ed754bf629ca09379ab97 .gitattributes
|
||||
e4c381697c727f364c2a212fede2f703cfab8e0a57aaa4fa98550478a76eef55 INSTALL-ORDER.md
|
||||
a62100ff7046a6e7d89adb8d2ab6bdf4ef7a72153df7cc439c8b00b42c7df347 README.md
|
||||
b72075836eddd338eb1402beab775b4dc21a61d315e78cd8385f719578924293 ROLLBACK.md
|
||||
b8a5f38f26fa76db6281a14de2baae3505cd78428b4c81a27a23ea89e256f321 STATIC-SAFETY-AUDIT.md
|
||||
05bdf987ad0049118acf9371c6affae0d7bf65bfcb869d297986860ee20dfac4 inventory/SHA256SUMS
|
||||
e6f6da94601927a23d252f32de93e92c99d31fb2d2cbd9b00f2b88224dbb684e inventory/docker-networks.json
|
||||
9a5d343092c8cf473f0e4d06cb6848f1788aa8bc41b1b3fb7412faea7ea7b48c inventory/docker-networks.psv
|
||||
67178aa964dfa23116984dfc5c677f8c7ef8631d5d7de989193a54a620ceaec1 inventory/host-network.txt
|
||||
4695953ecd1d859198d1a5cbb6242d10ba27493ab3b1ffb3f8f77da39fd458e0 inventory/nftables-ruleset.txt
|
||||
0a0db228df70f4d15e09f5c96bd0d5ac9952f4300b898266d8963225a9815988 inventory/runtime-state.txt
|
||||
4d5c3252ac4f9f537ce3f69110127f13a88ea424cbc69a46ca75448341e2bae7 inventory/runtime-versions.txt
|
||||
1565a8f5b5f08059ab9df69d78fed1b8190ccf674a9d368a436af63c03b804a8 inventory/workspace-acls.txt
|
||||
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 inventory/workspace-mounts.txt
|
||||
362b311c42fdd35bda6bcc9639403dd0f1dca17bc6469ccc9c86a9580021f046 inventory/workspace-tree.psv
|
||||
1bc6ed97f33210f0d9337c7593082aaad46efdc26c86af3603f4c7c6ed88933c payload/etc/le-app-codex-runtime/resolv.conf
|
||||
4289b705dbd786281daccb6d5aa660c27b83441f1a34d0cd18590666124be386 payload/etc/nftables.d/50-le-app-codex.nft
|
||||
628370fd3cbb5c4572866f820fc404c23ce63505d5ac704e0b2019b3c1e72656 payload/etc/systemd/system/le-app-codex-netns.service
|
||||
ea0c280203614c3e308013a8d51271bfa8adafd517f65cdf3224d2385244af6d payload/etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf
|
||||
30d9fdc95642ba6c9b496cc08fbfc5c9a3c8349d4c2b3331a1ff2bf4de06a383 payload/etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf
|
||||
44ec71cb10ef3885484a0e53a48c4cef1d028d417f4757dd7be6c95b556b92e8 payload/srv/le-app-codex/home/.config/docker/daemon.json
|
||||
97aabdffb67c48379a0e5d524d8a728154cc197efa82c163608de2387b211b3b payload/srv/le-app-codex/home/.config/systemd/user/docker.service
|
||||
9975f57e7cd150744f0acfe6d38c7074aa1d302465e50ca19015eedf04d6587d payload/srv/le-app-codex/home/.docker/config.json
|
||||
612b81ebb800af1fe5261d1d29284136977ce278eb689d8cdee0eec2c2969cd6 payload/srv/le-app-codex/home/.docker/contexts/meta/1b645e55bd6af77d420732b143423e7a27b12fbb5a71497e5d89c52481b6a535/meta.json
|
||||
904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46 payload/usr/local/libexec/dockerd-rootless-29.6.1.sh
|
||||
9aed833454a78dc99af6c18da1cf09660ef717964adfd309f61f043b53c05464 payload/usr/local/libexec/le-app-codex-netns
|
||||
4f94d88283207b2bfa849f4e5b126efa8872be97e59edd1f700b1b0a80623035 tests/00-read-only-preflight.sh
|
||||
f7629ad1178720c6046bf73d2babdcf7f8db6398ded172c5a088340f38d077a2 tests/00-root-preinstall-validate.sh
|
||||
9a573d539da46fbd683da60920596118174fdcf053f79f037ba21aee2deab82d tests/10-inert-containment.sh
|
||||
0ec4d5d955e55fa8eb053fe2efa9a60509ada31afa48b71b29652dfacbf4d1c2 tests/20-rootless-docker.sh
|
||||
1cf5dfa80b8d00de3ef1a47d84c30a891f4c6192345d5fc9247c4ab7d4f40f31 tests/run-inert-without-user-manager.sh
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
# Phase 2B contained Codex runtime — review only
|
||||
|
||||
Status: complete staged review set, 2026-07-12. **Do not install or execute it.** No Phase 2B file has been copied to a host target; no namespace, nftables table, service, user manager, Docker daemon, container, Codex process, authentication, checkout, migration source, credential, or production change was created.
|
||||
|
||||
## Read-only verification record
|
||||
|
||||
- Docker was revalidated before launcher selection: package `1:29.6.1-1`; client `29.6.1` build `8900f1d330`; daemon binary `29.6.1` build `8ec5ab355a`.
|
||||
- The exact Moby `docker-v29.6.1` `contrib/dockerd-rootless.sh` was fetched for review and reproduced SHA-256 `904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46`.
|
||||
- Future acceptance images are pinned to OCI indexes: Alpine 3.23.3 `sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659` and nginx 1.29.4-alpine `sha256:4870c12cd2ca986de501a804b4f506ad3875a0b1874940ba0a2c7f763f1855b2`.
|
||||
- The root inventory at 2026-07-12 20:24 EDT is retained verbatim under `inventory/`; every checksum in its original `SHA256SUMS` passes. Host interfaces include `192.168.10.151/24` on `enp4s0`, `10.98.0.2/24` on `wg0`, public IPv6 `2603:7080:7500:1279:75aa:d64d:4cf0:8f10/64`, loopback, and the Docker bridges below. Observed public IPv4 is `74.67.173.56`. The observed gateway/router resolver is `192.168.10.1`; it is **not approved DNS** by observation.
|
||||
- `/etc/resolv.conf` also observes link-local IPv6 resolver `fe80::3e8c:f8ff:fef4:2590%enp4s0`. The proposed namespace is IPv4-only, so it is not usable there.
|
||||
- Observed Docker bridge IPv4 subnets are `10.1.0.0/16`, `10.2.0.0/16`, `10.3.0.0/16`, `10.4.0.0/16`, `10.9.0.0/16`, `10.10.0.0/16`, `10.13.0.0/16`, `10.16.0.0/16` through `10.20.0.0/16`, `10.24.0.0/16`, `10.26.0.0/16` through `10.32.0.0/16`, `10.40.0.0/16`, `10.41.0.0/16`, `10.55.0.0/16`, `10.99.0.0/16`, and `172.17.0.0/16` through `172.31.0.0/16` except `172.24` is present and all ranges in that continuous interval were observed. The policy denies their covering RFC1918 ranges and the preflight re-inventories them.
|
||||
- Observed Docker bridge IPv6 includes `fd00:1::/64`, `fd00:3::/64`, `fd00:4::/64`, `fd00:9::/64`, `fd00:10::/64`, `fd00:16::/64`, `fd00:17::/64`, `fd00:18::/64`, `fd00:20::/64`, `fd00:24::/64`, `fd00:26::/64` through `fd00:31::/64`, `fd00:40::/64`, `fd00:41::/64`, and link-local `fe80::/64` addresses. Namespace IPv6 is disabled and forward traffic is dropped.
|
||||
- `user@1200.service` is loaded/static but inactive/dead; only the packaged `10-login-barrier.conf` drop-in exists. UID 1200 is not logged in or lingering; no UID 1200 process was observed. `/run/user/1200/docker.sock` is absent.
|
||||
- `/srv/le-app-codex` is `root:le_app_codex` mode `0750`; `home`, checkout, runtime, testing, and build directories are UID/GID 1200 with mode `0700`; the source directory is root-owned `0550`; nonproduction secrets are root-owned `0750`. ACLs add no access beyond those modes. The root inventory found no project-rooted mounts.
|
||||
- Root Docker inspection records 41 networks, all covered by the private/IPv6 denials. The complete nftables export has no pre-existing Phase 2B table, chain, namespace, or interface. `tests/00-read-only-preflight.sh` requires a fresh matching inventory immediately before installation.
|
||||
|
||||
## Artifact map
|
||||
|
||||
The `payload/` tree mirrors proposed absolute installation paths and makes each file separately reviewable:
|
||||
|
||||
- pinned Moby launcher;
|
||||
- aggregate `user-1200.slice` resource drop-in;
|
||||
- complete `user@1200.service` filesystem/process/device containment drop-in;
|
||||
- root-owned IPv4-only namespace unit/helper;
|
||||
- private read-only resolver configuration using the proposed public Quad9 IPv4 pair;
|
||||
- separate default-deny nftables tables with reviewed host/network values;
|
||||
- genuine rootless Docker user service;
|
||||
- daemon and client context configuration accepting only `unix:///run/user/1200/docker.sock`;
|
||||
- preflight, inert containment, and rootless Docker positive/negative tests;
|
||||
- exact installation/acceptance order and Phase 2B-only rollback.
|
||||
|
||||
There are no remaining documentation sentinels. The operator approved Quad9's malware-blocking, DNSSEC-validating IPv4 pair, `9.9.9.9` and `149.112.112.112`. It requires **no LAN-address exception**; `192.168.10.1` and all of `192.168.0.0/16` remain denied. The root-created approval marker is intentionally absent because installation has not begun. Observed public/NAT IPv4 `74.67.173.56` remains explicitly denied; drift is a fail-closed configuration-review condition before later namespace restarts or policy regeneration.
|
||||
|
||||
## Unresolved operator inputs
|
||||
|
||||
1. Hard disk-growth enforcement is deferred and is not a Phase 2B installation blocker. Filesystem visibility and CPU/memory/task controls remain mandatory but are not a hard storage quota.
|
||||
2. Whether `ProtectProc=invisible` passes inert and runtime acceptance without breaking rootless Docker; compatibility must not be assumed.
|
||||
3. Later, separate approvals for starting the user manager/runtime and for the Codex authentication method. No Forge SSH exception, TCP Docker endpoint, rootful socket, LAN access, direct SMTP, or inbound publication is proposed.
|
||||
|
||||
## Validation status
|
||||
|
||||
The root pre-install validator passed on TITANSERVER with zero failures: both manifests, staged nftables syntax, staged systemd units/drop-ins, shell/JSON syntax, Phase 1 ownership/modes, mount absence, installed-path absence, inactive user manager, absent linger/process/socket, and unchanged public/NAT IPv4 all passed. Missing `/usr/local/libexec` warnings were expected for the uninstalled payload.
|
||||
|
||||
See `STATIC-SAFETY-AUDIT.md`, `INSTALL-ORDER.md`, `ROLLBACK.md`, `tests/`, `inventory/`, and `MANIFEST.sha256`. Any edit invalidates the manifest and requires another review.
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
# Phase 2B-only rollback
|
||||
|
||||
Do not remove Phase 1 identity/workspace, Phase 2A packages, kernels, snapshots, production resources, or unrelated nftables objects.
|
||||
|
||||
1. Stop `user@1200.service`; confirm UID 1200 has no processes. This is the only user-manager stop in scope.
|
||||
2. Stop `le-app-codex-netns.service`. Its `ExecStop` removes only `lecodex-host` and `/run/netns/le-app-codex` and deletes only the two `le_app_codex*` nftables tables.
|
||||
3. Remove only the Phase 2B files enumerated in `MANIFEST.sha256` and `/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED`, preserving the pre-existing `/srv/le-app-codex` skeleton.
|
||||
4. Run `systemctl daemon-reload` and `systemctl reset-failed le-app-codex-netns.service`.
|
||||
5. Confirm there is no UID 1200 process, socket, namespace, veth, project nftables table, containment/resource drop-in, launcher, Docker user unit, daemon/client config, or Phase 2B test copy.
|
||||
6. Confirm lingering is still disabled and production/rootful Docker remains healthy and unchanged.
|
||||
|
||||
If a file existed before Phase 2B, stop: this rollback package intentionally has no overwrite/restore path because installation must have failed closed on pre-existence.
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
# Static safety audit
|
||||
|
||||
Status: pass for final review; execution remains approval-gated.
|
||||
|
||||
- **Endpoint:** daemon service, daemon configuration, client context, environment, and tests name only `unix:///run/user/1200/docker.sock`. No TCP, SSH, rootful, fallback, or inherited default endpoint is accepted.
|
||||
- **Lifecycle:** no linger artifact or command exists. Root explicitly controls `user@1200.service`; the namespace unit cannot start until a separate operator approval marker exists.
|
||||
- **Filesystem:** the complete user manager receives a private read-only `/srv` with only `/srv/le-app-codex` rebound, empty private `/var`, `/mnt`, `/media`, and `/opt`, private `/tmp`, protected homes/processes, explicit production/archive/transitional path tests, and inaccessible rootful sockets/runtime data.
|
||||
- **Devices/resources:** closed device policy permits only FUSE and TUN. Aggregate CPU, memory, swap, and task limits cover the user manager and descendants. Hard disk-growth enforcement is deferred and is not a Phase 2B installation blocker; these mandatory controls are not a storage quota.
|
||||
- **IPv4-only:** the namespace receives only `10.200.120.2/30`; namespace-scoped IPv6 is disabled; daemon IPv6/ip6tables are disabled; nftables drops IPv6 from the project interface.
|
||||
- **Egress:** only DNS to `9.9.9.9`/`149.112.112.112` and public TCP 80/443 are accepted. Nonpublic/reserved IPv4, loopback, link-local/metadata, multicast, all RFC1918 Docker/LAN/WireGuard ranges, direct SMTP, and all other protocols/ports drop.
|
||||
- **Host isolation:** host-to-project forwarding and unsolicited inbound traffic drop. Project traffic to host private addresses and observed public/NAT address `74.67.173.56` drops. RootlessKit host-loopback and external port publication are disabled and tested negatively.
|
||||
- **DNS:** the operator-approved Quad9 malware-blocking, DNSSEC-validating IPv4 pair avoids any LAN exception. `/etc/resolv.conf` is rebound read-only for the user manager. The observed `192.168.10.1` router resolver remains denied.
|
||||
- **Existing nftables:** the verified ruleset has no `le_app_codex` objects. Dedicated tables avoid editing Docker-owned chains. Interface-scoped terminal drops remain effective alongside existing Docker base chains.
|
||||
- **Inventory:** the root record checksums pass. UID 1200 is inactive, not lingering, has no process/runtime/socket; project ACLs and modes match Phase 1; no project-rooted mounts exist; all 41 Docker networks fall within denied IPv4/IPv6 space.
|
||||
- **Rollback:** names and paths are Phase 2B-specific; teardown deletes only the project tables, namespace/veth, marker, and manifest-listed files.
|
||||
|
||||
Hard stops remain: changed Docker version/launcher hash, changed inventory, public/NAT address drift, missing approval marker at namespace-start time, pre-existing project tables/namespace, any acceptance failure, or any endpoint other than the single rootless Unix socket. `ProtectProc=invisible` remains an unproven runtime acceptance candidate.
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
e6f6da94601927a23d252f32de93e92c99d31fb2d2cbd9b00f2b88224dbb684e docker-networks.json
|
||||
9a5d343092c8cf473f0e4d06cb6848f1788aa8bc41b1b3fb7412faea7ea7b48c docker-networks.psv
|
||||
67178aa964dfa23116984dfc5c677f8c7ef8631d5d7de989193a54a620ceaec1 host-network.txt
|
||||
4695953ecd1d859198d1a5cbb6242d10ba27493ab3b1ffb3f8f77da39fd458e0 nftables-ruleset.txt
|
||||
0a0db228df70f4d15e09f5c96bd0d5ac9952f4300b898266d8963225a9815988 runtime-state.txt
|
||||
4d5c3252ac4f9f537ce3f69110127f13a88ea424cbc69a46ca75448341e2bae7 runtime-versions.txt
|
||||
1565a8f5b5f08059ab9df69d78fed1b8190ccf674a9d368a436af63c03b804a8 workspace-acls.txt
|
||||
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 workspace-mounts.txt
|
||||
362b311c42fdd35bda6bcc9639403dd0f1dca17bc6469ccc9c86a9580021f046 workspace-tree.psv
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,41 @@
|
|||
5a9988b94efd|arrmail_backend|bridge|local
|
||||
cfae917b997e|arrmailnetmail_clamav|bridge|local
|
||||
d89dcf384c2a|arrmailnetmail_oletools|bridge|local
|
||||
b7976abb6e55|arrmailnetmail_radicale|bridge|local
|
||||
ecba5adea6ea|arrmailnetmail_tika|bridge|local
|
||||
e02b7c89a2d3|backend_net|bridge|local
|
||||
a13cb8d34076|bridge|bridge|local
|
||||
051bbcfc21d8|castopod_ma_net|bridge|local
|
||||
28584d053169|collabora_s6_net|bridge|local
|
||||
263c8508de6f|conduit_net|bridge|local
|
||||
8b881e367322|directus_net|bridge|local
|
||||
87e08370adff|forge_net|bridge|local
|
||||
bca9ecea74f1|heimdall_s6_net|bridge|local
|
||||
d905d3d625d9|host|host|local
|
||||
4ecbee63f4b0|immich_s6_net|bridge|local
|
||||
527a7cd84ff6|irc_net|bridge|local
|
||||
8200b83f03e9|jellyfin_s6_net|bridge|local
|
||||
6caddd639b0b|lasereverythingnetmanager_default|bridge|local
|
||||
875fced92cd0|lasereverythingnettv_default|bridge|local
|
||||
03ee8c9e4bea|lemmy_net|bridge|local
|
||||
68e2ed0ec6ac|mailu_net|bridge|local
|
||||
11ceaf8736f5|makearmy_net|bridge|local
|
||||
2d50ca7a8f5d|makearmyiocast_default|bridge|local
|
||||
eeee48934935|makearmyiodcm_default|bridge|local
|
||||
dee363d4e0c6|makearmyiovdo_default|bridge|local
|
||||
4efe811b8402|makearmyiowatch_peertube_net|bridge|local
|
||||
f3f5c7cfa74e|mastodon_net|bridge|local
|
||||
fea0382ed10b|meet_net|bridge|local
|
||||
f10b040acc46|misskey_net|bridge|local
|
||||
618855db6757|navidrome_s6_net|bridge|local
|
||||
dc41f9983a47|nextcloud_ma_net|bridge|local
|
||||
57b7955ca01d|none|null|local
|
||||
ed1bb1cc9d39|picsur_net|bridge|local
|
||||
59ca07fbf200|pixelfed_ma_net|bridge|local
|
||||
f9343d8383ac|privatebin_rw_net|bridge|local
|
||||
71bcae37092b|s6vinetgames_default|bridge|local
|
||||
c50ccbc5e464|s6vinetmedia_media_s6_net|bridge|local
|
||||
9891a93b5e9c|s6vinetyt_default|bridge|local
|
||||
9aea00f5a485|snappy_net|bridge|local
|
||||
f63e542ab28c|vault_net|bridge|local
|
||||
a35cbfd37253|yacht_s6_net|bridge|local
|
||||
|
|
@ -0,0 +1,885 @@
|
|||
=== IPv4/IPv6 addresses ===
|
||||
lo UNKNOWN 127.0.0.1/8 ::1/128
|
||||
enp4s0 UP 192.168.10.151/24 2603:7080:7500:1279:75aa:d64d:4cf0:8f10/64 fe80::e6f:317c:ee82:e5e/64
|
||||
wlo1 DOWN
|
||||
wg0 UNKNOWN 10.98.0.2/24
|
||||
br-11ceaf8736f5 UP 10.55.0.1/16 fe80::a065:eaff:fef3:532d/64
|
||||
br-dee363d4e0c6 DOWN 172.29.0.1/16 fe80::b86e:58ff:fef5:85f6/64
|
||||
docker0 UP 172.17.0.1/16 fe80::48e9:9ff:fea5:2c72/64
|
||||
br-5a9988b94efd UP 10.1.0.1/16 fd00:1::1/64 fe80::a843:f3ff:fedb:ef64/64
|
||||
br-e02b7c89a2d3 UP 10.99.0.1/16 fe80::2c30:58ff:fe89:f9d2/64
|
||||
br-875fced92cd0 DOWN 172.25.0.1/16 fe80::6c7e:7fff:fe2a:bf1d/64
|
||||
vethf79d976@if2 UP fe80::4c52:c7ff:fe49:3b0e/64
|
||||
veth605aea1@if2 UP fe80::ec3f:78ff:fe38:75b9/64
|
||||
vethf583175@if2 UP fe80::f0c3:fff:fe8b:74e3/64
|
||||
vethca028f8@if2 UP fe80::ccd1:f1ff:fe0f:c699/64
|
||||
veth880eb86@if2 UP fe80::548d:f8ff:fef4:c0db/64
|
||||
veth7e2863d@if2 UP fe80::ac5e:9cff:fe45:ec06/64
|
||||
veth55cb2ec@if2 UP fe80::28b8:bdff:fe81:370f/64
|
||||
br-9aea00f5a485 UP 10.3.0.1/16 fd00:3::1/64 fe80::68b1:bff:fee2:9d17/64
|
||||
vethee5b2b0@if2 UP fe80::6486:bfff:fee7:22df/64
|
||||
br-68e2ed0ec6ac UP 10.2.0.1/16 fe80::1058:f8ff:fe69:21bb/64
|
||||
br-b7976abb6e55 UP 172.18.0.1/16 fe80::a8fe:4ff:fe1f:d81a/64
|
||||
br-ecba5adea6ea UP 172.19.0.1/16 fe80::f8d4:eff:fe6e:19a9/64
|
||||
br-cfae917b997e UP 172.20.0.1/16 fe80::60fc:94ff:fe7d:a58f/64
|
||||
br-d89dcf384c2a UP 172.21.0.1/16 fe80::b471:19ff:fe52:ff1/64
|
||||
vethbe8f01c@if2 UP fe80::63:73ff:fede:43f9/64
|
||||
veth38ae454@if2 UP fe80::f01a:4eff:fef2:9942/64
|
||||
veth2edd7d6@if2 UP fe80::3c0c:90ff:fe10:332f/64
|
||||
veth563d3b9@if2 UP fe80::d037:e3ff:fe79:1a5f/64
|
||||
veth766794b@if2 UP fe80::3441:76ff:fe3f:f8d1/64
|
||||
veth426f4c7@if2 UP fe80::74c2:12ff:fe72:7875/64
|
||||
veth362d4c6@if2 UP fe80::f038:dbff:fefd:87d3/64
|
||||
veth4ecfbb5@if2 UP fe80::d847:aaff:fe89:3f9/64
|
||||
veth2d01312@if3 UP fe80::5455:fbff:fec6:391e/64
|
||||
veth99bb318@if2 UP fe80::4a3:bbff:fea9:df98/64
|
||||
vethcae9493@if2 UP fe80::2844:4dff:fec7:1613/64
|
||||
veth8c83268@if2 UP fe80::8832:52ff:fee4:8a93/64
|
||||
veth6f6f074@if3 UP fe80::ac67:76ff:fe15:1676/64
|
||||
veth4216565@if3 UP fe80::4463:6dff:fe29:79d5/64
|
||||
veth46248ff@if4 UP fe80::18c7:26ff:fe8b:bea4/64
|
||||
vethc0ef06c@if2 UP fe80::5852:d0ff:fe9e:545/64
|
||||
br-f63e542ab28c UP 10.4.0.1/16 fd00:4::1/64 fe80::28df:aff:fe50:a6d2/64
|
||||
vethaeee758@if2 UP fe80::e807:c7ff:fee0:f12d/64
|
||||
br-8b881e367322 DOWN 10.40.0.1/16 fd00:40::1/64 fe80::c030:54ff:fe2d:eb36/64
|
||||
br-6caddd639b0b UP 172.22.0.1/16 fe80::c0da:5bff:fea4:92dc/64
|
||||
veth2906c94@if2 UP fe80::1c13:3ff:fe18:c9a4/64
|
||||
br-2d50ca7a8f5d UP 172.23.0.1/16 fe80::548d:1eff:fe36:12c5/64
|
||||
vethbb40f36@if2 UP fe80::c000:96ff:fe7d:11a8/64
|
||||
br-dc41f9983a47 UP 10.30.0.1/16 fd00:30::1/64 fe80::78cf:3dff:fe72:528b/64
|
||||
veth6594ba0@if2 UP fe80::9091:4aff:feee:8942/64
|
||||
veth28958e3@if2 UP fe80::d037:82ff:fee7:27c5/64
|
||||
veth1f2dc82@if3 UP fe80::e49e:23ff:feb7:932d/64
|
||||
veth04a7fbe@if4 UP fe80::e488:ccff:fe2f:e545/64
|
||||
veth2273529@if2 UP fe80::869:a1ff:fee9:63a6/64
|
||||
br-eeee48934935 UP 172.24.0.1/16 fe80::ac86:86ff:fe64:f2d4/64
|
||||
veth160d05f@if2 UP fe80::50f3:d6ff:fedd:1cd3/64
|
||||
br-f10b040acc46 UP 10.29.0.1/16 fd00:29::1/64 fe80::4c63:fcff:fe4c:7d6a/64
|
||||
vethd88eb9b@if2 UP fe80::a4a0:13ff:fe7f:7c8d/64
|
||||
veth80da983@if2 UP fe80::a0eb:3bff:fe66:df68/64
|
||||
veth2bde217@if3 UP fe80::24de:7fff:fef9:e7af/64
|
||||
br-87e08370adff UP 10.27.0.1/16 fd00:27::1/64 fe80::40f5:bfff:fed7:8296/64
|
||||
veth9e2bcbb@if2 UP fe80::5030:beff:fead:c50a/64
|
||||
veth0477205@if3 UP fe80::48ec:7cff:fe17:27bc/64
|
||||
br-ed1bb1cc9d39 UP 10.28.0.1/16 fd00:28::1/64 fe80::30d4:6bff:fe54:5fb3/64
|
||||
veth370f490@if2 UP fe80::c090:5eff:fed8:d1cc/64
|
||||
vethca0ee65@if2 UP fe80::c1f:b5ff:fe0a:c936/64
|
||||
veth4692f5c@if3 UP fe80::2c60:58ff:fe86:30d3/64
|
||||
br-527a7cd84ff6 UP 10.20.0.1/16 fd00:20::1/64 fe80::4482:41ff:feb3:9c74/64
|
||||
vethd14eb7e@if2 UP fe80::84bf:b2ff:fec4:ea7/64
|
||||
br-03ee8c9e4bea UP 172.28.0.1/16 fe80::f01f:e5ff:fe2b:ec80/64
|
||||
veth3c1861e@if2 UP fe80::1c6e:c5ff:fe94:c515/64
|
||||
veth32d5964@if2 UP fe80::80a3:1eff:fe61:4f10/64
|
||||
vetha548a1a@if3 UP fe80::3c6e:51ff:fe48:e037/64
|
||||
veth762d601@if2 UP fe80::424:9bff:fe91:317e/64
|
||||
vethf48aa55@if2 UP fe80::805a:47ff:fe53:cfcd/64
|
||||
br-f3f5c7cfa74e UP 10.31.0.1/16 fd00:31::1/64 fe80::f4a6:b6ff:fe24:af71/64
|
||||
vethf5f3d34@if2 UP fe80::c006:5ff:fea6:b743/64
|
||||
veth335556c@if2 UP fe80::90ed:30ff:fe51:2b5a/64
|
||||
veth9cc2ad8@if2 UP fe80::6c50:96ff:fe29:70a6/64
|
||||
veth6232cb7@if2 UP fe80::64fe:2aff:fed1:1e41/64
|
||||
veth337e2fd@if2 UP fe80::f0bf:5ff:fee7:2b1e/64
|
||||
veth7d6d658@if3 UP fe80::80fb:8fff:fead:2208/64
|
||||
veth448a204@if3 UP fe80::90ff:b0ff:fe58:21fb/64
|
||||
veth79ea708@if3 UP fe80::ac43:75ff:fefa:cbfd/64
|
||||
br-263c8508de6f UP 10.26.0.1/16 fd00:26::1/64 fe80::d8c8:aaff:fe63:6af9/64
|
||||
veth4ba8ed1@if2 UP fe80::2095:66ff:fe78:518e/64
|
||||
br-fea0382ed10b UP 172.26.0.1/16 fe80::6c9c:c1ff:fe95:888e/64
|
||||
veth4a87e58@if2 UP fe80::c899:1fff:fe27:7f66/64
|
||||
vethacfaa19@if2 UP fe80::90ed:f4ff:feed:a749/64
|
||||
veth30db54a@if2 UP fe80::e855:acff:fef2:5aa3/64
|
||||
vethe969d14@if2 UP fe80::303f:6ff:fe24:1fa6/64
|
||||
veth0e4600c@if2 UP fe80::b441:acff:fe66:5981/64
|
||||
br-f9343d8383ac UP 10.24.0.1/16 fd00:24::1/64 fe80::c8b0:56ff:fe7e:bc48/64
|
||||
veth21e2097@if2 UP fe80::b48b:1aff:fe71:36d3/64
|
||||
br-59ca07fbf200 UP 10.32.0.1/16 fe80::fc79:ccff:fefd:20d7/64
|
||||
veth58179de@if2 UP fe80::6cb5:cff:fea2:a675/64
|
||||
veth6b9d50d@if2 UP fe80::d45e:64ff:fe90:37e7/64
|
||||
veth2445f8e@if2 UP fe80::cc80:50ff:feb5:67b/64
|
||||
veth368657c@if3 UP fe80::a065:bfff:fea5:34/64
|
||||
veth5f6906b@if3 UP fe80::502a:e5ff:fe5c:d5fa/64
|
||||
veth2dd045f@if4 UP fe80::464:d7ff:fea1:a54a/64
|
||||
veth53fd806@if4 UP fe80::7cdd:44ff:fe90:1f77/64
|
||||
br-051bbcfc21d8 UP 10.41.0.1/16 fd00:41::1/64 fe80::d457:2bff:fe72:23f/64
|
||||
veth2b9371a@if2 UP fe80::d44c:3bff:fe3b:934f/64
|
||||
veth165b4aa@if2 UP fe80::c85e:5aff:feaa:f812/64
|
||||
veth8c376e6@if3 UP fe80::542a:61ff:fe38:307c/64
|
||||
veth73c775b@if4 UP fe80::7462:7dff:fe8f:115d/64
|
||||
br-4efe811b8402 UP 172.27.0.1/16 fe80::d87e:fbff:fec6:5aeb/64
|
||||
veth56166e3@if2 UP fe80::dc0f:5dff:fec4:7c53/64
|
||||
veth14193e1@if2 UP fe80::aca7:68ff:fe42:e77/64
|
||||
vethe9fcee3@if3 UP fe80::443:71ff:feac:bdfb/64
|
||||
br-bca9ecea74f1 UP 10.10.0.1/16 fd00:10::1/64 fe80::4421:95ff:fe94:d7c5/64
|
||||
veth71028db@if2 UP fe80::a4ab:b9ff:fe3e:af94/64
|
||||
br-a35cbfd37253 UP 10.13.0.1/16 fe80::aca7:12ff:fe18:d1b9/64
|
||||
vethe123758@if2 UP fe80::44ee:8eff:fe1a:bcf4/64
|
||||
br-71bcae37092b UP 172.30.0.1/16 fe80::286c:a2ff:fe49:5772/64
|
||||
veth8d698e0@if2 UP fe80::d86b:4fff:fec2:50e0/64
|
||||
vethd87ba34@if2 UP fe80::e87f:edff:fe10:e8d6/64
|
||||
br-c50ccbc5e464 UP 10.19.0.1/16 fe80::9879:f6ff:fe6d:57be/64
|
||||
veth1bece5c@if2 UP fe80::30f1:2cff:feac:90cb/64
|
||||
veth6091231@if2 UP fe80::d44d:feff:fe18:d291/64
|
||||
veth502e53b@if2 UP fe80::a047:6eff:fe8b:1f48/64
|
||||
br-618855db6757 UP 10.16.0.1/16 fd00:16::1/64 fe80::aca8:14ff:feee:df7c/64
|
||||
vethe6c6432@if2 UP fe80::e447:bff:feea:1f61/64
|
||||
veth1f1f066@if3 UP fe80::90da:e3ff:fefa:7464/64
|
||||
veth26a5545@if4 UP fe80::888d:45ff:feeb:4a48/64
|
||||
br-28584d053169 UP 10.17.0.1/16 fd00:17::1/64 fe80::7c73:c8ff:fe04:3dd2/64
|
||||
vethe488043@if2 UP fe80::7069:c0ff:febd:1d88/64
|
||||
br-4ecbee63f4b0 UP 10.18.0.1/16 fd00:18::1/64 fe80::e46c:23ff:fec3:3ab9/64
|
||||
veth15eb212@if2 UP fe80::5c80:75ff:feff:22dd/64
|
||||
veth551b749@if2 UP fe80::7c42:75ff:fe80:5953/64
|
||||
veth41b1943@if2 UP fe80::bc01:62ff:fe13:b616/64
|
||||
vethc2b3531@if3 UP fe80::b4d5:57ff:fe87:83f9/64
|
||||
br-8200b83f03e9 UP 10.9.0.1/16 fd00:9::1/64 fe80::4c80:8fff:feec:15d4/64
|
||||
veth62aa43d@if2 UP fe80::acc5:57ff:fece:3b51/64
|
||||
br-9891a93b5e9c UP 172.31.0.1/16 fe80::e0a6:32ff:fe63:9f8d/64
|
||||
veth081c8bf@if2 UP fe80::3c1f:f9ff:fe36:4122/64
|
||||
|
||||
=== IPv4 routes ===
|
||||
default via 10.98.0.1 dev wg0 table wg0
|
||||
default via 192.168.10.1 dev enp4s0 proto dhcp src 192.168.10.151 metric 100
|
||||
10.1.0.0/16 dev br-5a9988b94efd proto kernel scope link src 10.1.0.1
|
||||
10.2.0.0/16 dev br-68e2ed0ec6ac proto kernel scope link src 10.2.0.1
|
||||
10.3.0.0/16 dev br-9aea00f5a485 proto kernel scope link src 10.3.0.1
|
||||
10.4.0.0/16 dev br-f63e542ab28c proto kernel scope link src 10.4.0.1
|
||||
10.9.0.0/16 dev br-8200b83f03e9 proto kernel scope link src 10.9.0.1
|
||||
10.10.0.0/16 dev br-bca9ecea74f1 proto kernel scope link src 10.10.0.1
|
||||
10.13.0.0/16 dev br-a35cbfd37253 proto kernel scope link src 10.13.0.1
|
||||
10.16.0.0/16 dev br-618855db6757 proto kernel scope link src 10.16.0.1
|
||||
10.17.0.0/16 dev br-28584d053169 proto kernel scope link src 10.17.0.1
|
||||
10.18.0.0/16 dev br-4ecbee63f4b0 proto kernel scope link src 10.18.0.1
|
||||
10.19.0.0/16 dev br-c50ccbc5e464 proto kernel scope link src 10.19.0.1
|
||||
10.20.0.0/16 dev br-527a7cd84ff6 proto kernel scope link src 10.20.0.1
|
||||
10.24.0.0/16 dev br-f9343d8383ac proto kernel scope link src 10.24.0.1
|
||||
10.26.0.0/16 dev br-263c8508de6f proto kernel scope link src 10.26.0.1
|
||||
10.27.0.0/16 dev br-87e08370adff proto kernel scope link src 10.27.0.1
|
||||
10.28.0.0/16 dev br-ed1bb1cc9d39 proto kernel scope link src 10.28.0.1
|
||||
10.29.0.0/16 dev br-f10b040acc46 proto kernel scope link src 10.29.0.1
|
||||
10.30.0.0/16 dev br-dc41f9983a47 proto kernel scope link src 10.30.0.1
|
||||
10.31.0.0/16 dev br-f3f5c7cfa74e proto kernel scope link src 10.31.0.1
|
||||
10.32.0.0/16 dev br-59ca07fbf200 proto kernel scope link src 10.32.0.1
|
||||
10.40.0.0/16 dev br-8b881e367322 proto kernel scope link src 10.40.0.1 linkdown
|
||||
10.41.0.0/16 dev br-051bbcfc21d8 proto kernel scope link src 10.41.0.1
|
||||
10.55.0.0/16 dev br-11ceaf8736f5 proto kernel scope link src 10.55.0.1
|
||||
10.98.0.0/24 dev wg0 proto kernel scope link src 10.98.0.2
|
||||
10.99.0.0/16 dev br-e02b7c89a2d3 proto kernel scope link src 10.99.0.1
|
||||
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
|
||||
172.18.0.0/16 dev br-b7976abb6e55 proto kernel scope link src 172.18.0.1
|
||||
172.19.0.0/16 dev br-ecba5adea6ea proto kernel scope link src 172.19.0.1
|
||||
172.20.0.0/16 dev br-cfae917b997e proto kernel scope link src 172.20.0.1
|
||||
172.21.0.0/16 dev br-d89dcf384c2a proto kernel scope link src 172.21.0.1
|
||||
172.22.0.0/16 dev br-6caddd639b0b proto kernel scope link src 172.22.0.1
|
||||
172.23.0.0/16 dev br-2d50ca7a8f5d proto kernel scope link src 172.23.0.1
|
||||
172.24.0.0/16 dev br-eeee48934935 proto kernel scope link src 172.24.0.1
|
||||
172.25.0.0/16 dev br-875fced92cd0 proto kernel scope link src 172.25.0.1 linkdown
|
||||
172.26.0.0/16 dev br-fea0382ed10b proto kernel scope link src 172.26.0.1
|
||||
172.27.0.0/16 dev br-4efe811b8402 proto kernel scope link src 172.27.0.1
|
||||
172.28.0.0/16 dev br-03ee8c9e4bea proto kernel scope link src 172.28.0.1
|
||||
172.29.0.0/16 dev br-dee363d4e0c6 proto kernel scope link src 172.29.0.1 linkdown
|
||||
172.30.0.0/16 dev br-71bcae37092b proto kernel scope link src 172.30.0.1
|
||||
172.31.0.0/16 dev br-9891a93b5e9c proto kernel scope link src 172.31.0.1
|
||||
192.168.10.0/24 dev enp4s0 proto kernel scope link src 192.168.10.151 metric 100
|
||||
local 10.1.0.1 dev br-5a9988b94efd table local proto kernel scope host src 10.1.0.1
|
||||
broadcast 10.1.255.255 dev br-5a9988b94efd table local proto kernel scope link src 10.1.0.1
|
||||
local 10.2.0.1 dev br-68e2ed0ec6ac table local proto kernel scope host src 10.2.0.1
|
||||
broadcast 10.2.255.255 dev br-68e2ed0ec6ac table local proto kernel scope link src 10.2.0.1
|
||||
local 10.3.0.1 dev br-9aea00f5a485 table local proto kernel scope host src 10.3.0.1
|
||||
broadcast 10.3.255.255 dev br-9aea00f5a485 table local proto kernel scope link src 10.3.0.1
|
||||
local 10.4.0.1 dev br-f63e542ab28c table local proto kernel scope host src 10.4.0.1
|
||||
broadcast 10.4.255.255 dev br-f63e542ab28c table local proto kernel scope link src 10.4.0.1
|
||||
local 10.9.0.1 dev br-8200b83f03e9 table local proto kernel scope host src 10.9.0.1
|
||||
broadcast 10.9.255.255 dev br-8200b83f03e9 table local proto kernel scope link src 10.9.0.1
|
||||
local 10.10.0.1 dev br-bca9ecea74f1 table local proto kernel scope host src 10.10.0.1
|
||||
broadcast 10.10.255.255 dev br-bca9ecea74f1 table local proto kernel scope link src 10.10.0.1
|
||||
local 10.13.0.1 dev br-a35cbfd37253 table local proto kernel scope host src 10.13.0.1
|
||||
broadcast 10.13.255.255 dev br-a35cbfd37253 table local proto kernel scope link src 10.13.0.1
|
||||
local 10.16.0.1 dev br-618855db6757 table local proto kernel scope host src 10.16.0.1
|
||||
broadcast 10.16.255.255 dev br-618855db6757 table local proto kernel scope link src 10.16.0.1
|
||||
local 10.17.0.1 dev br-28584d053169 table local proto kernel scope host src 10.17.0.1
|
||||
broadcast 10.17.255.255 dev br-28584d053169 table local proto kernel scope link src 10.17.0.1
|
||||
local 10.18.0.1 dev br-4ecbee63f4b0 table local proto kernel scope host src 10.18.0.1
|
||||
broadcast 10.18.255.255 dev br-4ecbee63f4b0 table local proto kernel scope link src 10.18.0.1
|
||||
local 10.19.0.1 dev br-c50ccbc5e464 table local proto kernel scope host src 10.19.0.1
|
||||
broadcast 10.19.255.255 dev br-c50ccbc5e464 table local proto kernel scope link src 10.19.0.1
|
||||
local 10.20.0.1 dev br-527a7cd84ff6 table local proto kernel scope host src 10.20.0.1
|
||||
broadcast 10.20.255.255 dev br-527a7cd84ff6 table local proto kernel scope link src 10.20.0.1
|
||||
local 10.24.0.1 dev br-f9343d8383ac table local proto kernel scope host src 10.24.0.1
|
||||
broadcast 10.24.255.255 dev br-f9343d8383ac table local proto kernel scope link src 10.24.0.1
|
||||
local 10.26.0.1 dev br-263c8508de6f table local proto kernel scope host src 10.26.0.1
|
||||
broadcast 10.26.255.255 dev br-263c8508de6f table local proto kernel scope link src 10.26.0.1
|
||||
local 10.27.0.1 dev br-87e08370adff table local proto kernel scope host src 10.27.0.1
|
||||
broadcast 10.27.255.255 dev br-87e08370adff table local proto kernel scope link src 10.27.0.1
|
||||
local 10.28.0.1 dev br-ed1bb1cc9d39 table local proto kernel scope host src 10.28.0.1
|
||||
broadcast 10.28.255.255 dev br-ed1bb1cc9d39 table local proto kernel scope link src 10.28.0.1
|
||||
local 10.29.0.1 dev br-f10b040acc46 table local proto kernel scope host src 10.29.0.1
|
||||
broadcast 10.29.255.255 dev br-f10b040acc46 table local proto kernel scope link src 10.29.0.1
|
||||
local 10.30.0.1 dev br-dc41f9983a47 table local proto kernel scope host src 10.30.0.1
|
||||
broadcast 10.30.255.255 dev br-dc41f9983a47 table local proto kernel scope link src 10.30.0.1
|
||||
local 10.31.0.1 dev br-f3f5c7cfa74e table local proto kernel scope host src 10.31.0.1
|
||||
broadcast 10.31.255.255 dev br-f3f5c7cfa74e table local proto kernel scope link src 10.31.0.1
|
||||
local 10.32.0.1 dev br-59ca07fbf200 table local proto kernel scope host src 10.32.0.1
|
||||
broadcast 10.32.255.255 dev br-59ca07fbf200 table local proto kernel scope link src 10.32.0.1
|
||||
local 10.40.0.1 dev br-8b881e367322 table local proto kernel scope host src 10.40.0.1
|
||||
broadcast 10.40.255.255 dev br-8b881e367322 table local proto kernel scope link src 10.40.0.1 linkdown
|
||||
local 10.41.0.1 dev br-051bbcfc21d8 table local proto kernel scope host src 10.41.0.1
|
||||
broadcast 10.41.255.255 dev br-051bbcfc21d8 table local proto kernel scope link src 10.41.0.1
|
||||
local 10.55.0.1 dev br-11ceaf8736f5 table local proto kernel scope host src 10.55.0.1
|
||||
broadcast 10.55.255.255 dev br-11ceaf8736f5 table local proto kernel scope link src 10.55.0.1
|
||||
local 10.98.0.2 dev wg0 table local proto kernel scope host src 10.98.0.2
|
||||
broadcast 10.98.0.255 dev wg0 table local proto kernel scope link src 10.98.0.2
|
||||
local 10.99.0.1 dev br-e02b7c89a2d3 table local proto kernel scope host src 10.99.0.1
|
||||
broadcast 10.99.255.255 dev br-e02b7c89a2d3 table local proto kernel scope link src 10.99.0.1
|
||||
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
|
||||
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
|
||||
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
|
||||
local 172.17.0.1 dev docker0 table local proto kernel scope host src 172.17.0.1
|
||||
broadcast 172.17.255.255 dev docker0 table local proto kernel scope link src 172.17.0.1
|
||||
local 172.18.0.1 dev br-b7976abb6e55 table local proto kernel scope host src 172.18.0.1
|
||||
broadcast 172.18.255.255 dev br-b7976abb6e55 table local proto kernel scope link src 172.18.0.1
|
||||
local 172.19.0.1 dev br-ecba5adea6ea table local proto kernel scope host src 172.19.0.1
|
||||
broadcast 172.19.255.255 dev br-ecba5adea6ea table local proto kernel scope link src 172.19.0.1
|
||||
local 172.20.0.1 dev br-cfae917b997e table local proto kernel scope host src 172.20.0.1
|
||||
broadcast 172.20.255.255 dev br-cfae917b997e table local proto kernel scope link src 172.20.0.1
|
||||
local 172.21.0.1 dev br-d89dcf384c2a table local proto kernel scope host src 172.21.0.1
|
||||
broadcast 172.21.255.255 dev br-d89dcf384c2a table local proto kernel scope link src 172.21.0.1
|
||||
local 172.22.0.1 dev br-6caddd639b0b table local proto kernel scope host src 172.22.0.1
|
||||
broadcast 172.22.255.255 dev br-6caddd639b0b table local proto kernel scope link src 172.22.0.1
|
||||
local 172.23.0.1 dev br-2d50ca7a8f5d table local proto kernel scope host src 172.23.0.1
|
||||
broadcast 172.23.255.255 dev br-2d50ca7a8f5d table local proto kernel scope link src 172.23.0.1
|
||||
local 172.24.0.1 dev br-eeee48934935 table local proto kernel scope host src 172.24.0.1
|
||||
broadcast 172.24.255.255 dev br-eeee48934935 table local proto kernel scope link src 172.24.0.1
|
||||
local 172.25.0.1 dev br-875fced92cd0 table local proto kernel scope host src 172.25.0.1
|
||||
broadcast 172.25.255.255 dev br-875fced92cd0 table local proto kernel scope link src 172.25.0.1 linkdown
|
||||
local 172.26.0.1 dev br-fea0382ed10b table local proto kernel scope host src 172.26.0.1
|
||||
broadcast 172.26.255.255 dev br-fea0382ed10b table local proto kernel scope link src 172.26.0.1
|
||||
local 172.27.0.1 dev br-4efe811b8402 table local proto kernel scope host src 172.27.0.1
|
||||
broadcast 172.27.255.255 dev br-4efe811b8402 table local proto kernel scope link src 172.27.0.1
|
||||
local 172.28.0.1 dev br-03ee8c9e4bea table local proto kernel scope host src 172.28.0.1
|
||||
broadcast 172.28.255.255 dev br-03ee8c9e4bea table local proto kernel scope link src 172.28.0.1
|
||||
local 172.29.0.1 dev br-dee363d4e0c6 table local proto kernel scope host src 172.29.0.1
|
||||
broadcast 172.29.255.255 dev br-dee363d4e0c6 table local proto kernel scope link src 172.29.0.1 linkdown
|
||||
local 172.30.0.1 dev br-71bcae37092b table local proto kernel scope host src 172.30.0.1
|
||||
broadcast 172.30.255.255 dev br-71bcae37092b table local proto kernel scope link src 172.30.0.1
|
||||
local 172.31.0.1 dev br-9891a93b5e9c table local proto kernel scope host src 172.31.0.1
|
||||
broadcast 172.31.255.255 dev br-9891a93b5e9c table local proto kernel scope link src 172.31.0.1
|
||||
local 192.168.10.151 dev enp4s0 table local proto kernel scope host src 192.168.10.151
|
||||
broadcast 192.168.10.255 dev enp4s0 table local proto kernel scope link src 192.168.10.151
|
||||
|
||||
=== IPv6 routes ===
|
||||
2603:7080:7500:1279::/64 dev enp4s0 proto ra metric 100 pref medium
|
||||
fd00:1::/64 dev br-5a9988b94efd proto kernel metric 256 pref medium
|
||||
fd00:3::/64 dev br-9aea00f5a485 proto kernel metric 256 pref medium
|
||||
fd00:4::/64 dev br-f63e542ab28c proto kernel metric 256 pref medium
|
||||
fd00:9::/64 dev br-8200b83f03e9 proto kernel metric 256 pref medium
|
||||
fd00:10::/64 dev br-bca9ecea74f1 proto kernel metric 256 pref medium
|
||||
fd00:16::/64 dev br-618855db6757 proto kernel metric 256 pref medium
|
||||
fd00:17::/64 dev br-28584d053169 proto kernel metric 256 pref medium
|
||||
fd00:18::/64 dev br-4ecbee63f4b0 proto kernel metric 256 pref medium
|
||||
fd00:20::/64 dev br-527a7cd84ff6 proto kernel metric 256 pref medium
|
||||
fd00:24::/64 dev br-f9343d8383ac proto kernel metric 256 pref medium
|
||||
fd00:26::/64 dev br-263c8508de6f proto kernel metric 256 pref medium
|
||||
fd00:27::/64 dev br-87e08370adff proto kernel metric 256 pref medium
|
||||
fd00:28::/64 dev br-ed1bb1cc9d39 proto kernel metric 256 pref medium
|
||||
fd00:29::/64 dev br-f10b040acc46 proto kernel metric 256 pref medium
|
||||
fd00:30::/64 dev br-dc41f9983a47 proto kernel metric 256 pref medium
|
||||
fd00:31::/64 dev br-f3f5c7cfa74e proto kernel metric 256 pref medium
|
||||
fd00:40::/64 dev br-8b881e367322 proto kernel metric 256 linkdown pref medium
|
||||
fd00:41::/64 dev br-051bbcfc21d8 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethf79d976 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev docker0 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth605aea1 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-5a9988b94efd proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethca028f8 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-e02b7c89a2d3 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-dee363d4e0c6 proto kernel metric 256 linkdown pref medium
|
||||
fe80::/64 dev br-875fced92cd0 proto kernel metric 256 linkdown pref medium
|
||||
fe80::/64 dev vethf583175 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-11ceaf8736f5 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth880eb86 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth7e2863d proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth55cb2ec proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethee5b2b0 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-9aea00f5a485 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethbe8f01c proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-b7976abb6e55 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth2edd7d6 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-68e2ed0ec6ac proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth38ae454 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-cfae917b997e proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth563d3b9 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-ecba5adea6ea proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth766794b proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-d89dcf384c2a proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth426f4c7 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth362d4c6 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth2d01312 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth4ecfbb5 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth99bb318 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethcae9493 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth8c83268 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth6f6f074 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth4216565 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth46248ff proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethc0ef06c proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethaeee758 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-f63e542ab28c proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-8b881e367322 proto kernel metric 256 linkdown pref medium
|
||||
fe80::/64 dev veth2906c94 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-6caddd639b0b proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethbb40f36 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-2d50ca7a8f5d proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth6594ba0 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-dc41f9983a47 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth28958e3 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth1f2dc82 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth04a7fbe proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth2273529 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth160d05f proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-eeee48934935 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethd88eb9b proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-f10b040acc46 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth80da983 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth2bde217 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth9e2bcbb proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth0477205 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-87e08370adff proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth370f490 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-ed1bb1cc9d39 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethca0ee65 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth4692f5c proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethd14eb7e proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-527a7cd84ff6 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth3c1861e proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-03ee8c9e4bea proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth32d5964 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vetha548a1a proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth762d601 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethf48aa55 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethf5f3d34 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-f3f5c7cfa74e proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth335556c proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth9cc2ad8 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth6232cb7 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth337e2fd proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth7d6d658 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth448a204 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth79ea708 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth4ba8ed1 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-263c8508de6f proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth4a87e58 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-fea0382ed10b proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethacfaa19 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth30db54a proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethe969d14 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth0e4600c proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth21e2097 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-f9343d8383ac proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth58179de proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-59ca07fbf200 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth6b9d50d proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth2445f8e proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth368657c proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth5f6906b proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth2dd045f proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth53fd806 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth2b9371a proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-051bbcfc21d8 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth165b4aa proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth8c376e6 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth73c775b proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth56166e3 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-4efe811b8402 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth14193e1 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethe9fcee3 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth71028db proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-bca9ecea74f1 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethe123758 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-a35cbfd37253 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth8d698e0 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-71bcae37092b proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethd87ba34 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth1bece5c proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-c50ccbc5e464 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth6091231 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth502e53b proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethe6c6432 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-618855db6757 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth1f1f066 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth26a5545 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethe488043 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-28584d053169 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth551b749 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth15eb212 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-4ecbee63f4b0 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth41b1943 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev vethc2b3531 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth62aa43d proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-8200b83f03e9 proto kernel metric 256 pref medium
|
||||
fe80::/64 dev veth081c8bf proto kernel metric 256 pref medium
|
||||
fe80::/64 dev br-9891a93b5e9c proto kernel metric 256 pref medium
|
||||
fe80::/64 dev enp4s0 proto kernel metric 1024 pref medium
|
||||
default via fe80::3e8c:f8ff:fef4:2590 dev enp4s0 proto ra metric 100 pref medium
|
||||
local ::1 dev lo table local proto kernel metric 0 pref medium
|
||||
anycast 2603:7080:7500:1279:: dev enp4s0 table local proto kernel metric 0 pref medium
|
||||
local 2603:7080:7500:1279:75aa:d64d:4cf0:8f10 dev enp4s0 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:1:: dev br-5a9988b94efd table local proto kernel metric 0 pref medium
|
||||
local fd00:1::1 dev br-5a9988b94efd table local proto kernel metric 0 pref medium
|
||||
anycast fd00:3:: dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
|
||||
local fd00:3::1 dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:4:: dev br-f63e542ab28c table local proto kernel metric 0 pref medium
|
||||
local fd00:4::1 dev br-f63e542ab28c table local proto kernel metric 0 pref medium
|
||||
anycast fd00:9:: dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
|
||||
local fd00:9::1 dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:10:: dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
|
||||
local fd00:10::1 dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:16:: dev br-618855db6757 table local proto kernel metric 0 pref medium
|
||||
local fd00:16::1 dev br-618855db6757 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:17:: dev br-28584d053169 table local proto kernel metric 0 pref medium
|
||||
local fd00:17::1 dev br-28584d053169 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:18:: dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
|
||||
local fd00:18::1 dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:20:: dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
|
||||
local fd00:20::1 dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:24:: dev br-f9343d8383ac table local proto kernel metric 0 pref medium
|
||||
local fd00:24::1 dev br-f9343d8383ac table local proto kernel metric 0 pref medium
|
||||
anycast fd00:26:: dev br-263c8508de6f table local proto kernel metric 0 pref medium
|
||||
local fd00:26::1 dev br-263c8508de6f table local proto kernel metric 0 pref medium
|
||||
anycast fd00:27:: dev br-87e08370adff table local proto kernel metric 0 pref medium
|
||||
local fd00:27::1 dev br-87e08370adff table local proto kernel metric 0 pref medium
|
||||
anycast fd00:28:: dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
|
||||
local fd00:28::1 dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:29:: dev br-f10b040acc46 table local proto kernel metric 0 pref medium
|
||||
local fd00:29::1 dev br-f10b040acc46 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:30:: dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
|
||||
local fd00:30::1 dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:31:: dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
|
||||
local fd00:31::1 dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
|
||||
anycast fd00:40:: dev br-8b881e367322 table local proto kernel metric 0 pref medium
|
||||
local fd00:40::1 dev br-8b881e367322 table local proto kernel metric 0 pref medium
|
||||
anycast fd00:41:: dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
|
||||
local fd00:41::1 dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev enp4s0 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth605aea1 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethf79d976 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-5a9988b94efd table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev docker0 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-dee363d4e0c6 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethca028f8 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethf583175 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-e02b7c89a2d3 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-875fced92cd0 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-11ceaf8736f5 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth880eb86 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethee5b2b0 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth55cb2ec table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth766794b table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth38ae454 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethbe8f01c table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth563d3b9 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-b7976abb6e55 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-68e2ed0ec6ac table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth7e2863d table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-cfae917b997e table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth4216565 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth2edd7d6 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethcae9493 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth426f4c7 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-ecba5adea6ea table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth2d01312 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth8c83268 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth362d4c6 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth6f6f074 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth99bb318 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-d89dcf384c2a table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-8b881e367322 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth4ecfbb5 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethc0ef06c table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth46248ff table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethaeee758 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethbb40f36 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-2d50ca7a8f5d table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-6caddd639b0b table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-f63e542ab28c table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth04a7fbe table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth2906c94 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth28958e3 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth1f2dc82 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-f10b040acc46 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethd88eb9b table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth6594ba0 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth2273529 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-eeee48934935 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth160d05f table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth2bde217 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth80da983 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth9e2bcbb table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth370f490 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-87e08370adff table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth0477205 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethd14eb7e table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth3c1861e table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vetha548a1a table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethca0ee65 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethf48aa55 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth32d5964 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-03ee8c9e4bea table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth4692f5c table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth79ea708 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth7d6d658 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth9cc2ad8 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth6232cb7 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth762d601 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth337e2fd table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth335556c table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth4ba8ed1 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-fea0382ed10b table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethf5f3d34 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth448a204 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-263c8508de6f table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth4a87e58 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethe969d14 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth0e4600c table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth21e2097 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth30db54a table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethacfaa19 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-f9343d8383ac table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-59ca07fbf200 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth6b9d50d table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth2dd045f table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth2445f8e table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth58179de table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth368657c table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth5f6906b table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth165b4aa table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth53fd806 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth8c376e6 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth2b9371a table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth56166e3 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth73c775b table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-4efe811b8402 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethe9fcee3 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth14193e1 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth71028db table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-a35cbfd37253 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth8d698e0 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethe123758 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-71bcae37092b table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth6091231 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethd87ba34 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth1bece5c table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-c50ccbc5e464 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth26a5545 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth502e53b table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethe6c6432 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-618855db6757 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth1f1f066 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethe488043 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-28584d053169 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth41b1943 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth551b749 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth15eb212 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev vethc2b3531 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth62aa43d table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev br-9891a93b5e9c table local proto kernel metric 0 pref medium
|
||||
anycast fe80:: dev veth081c8bf table local proto kernel metric 0 pref medium
|
||||
local fe80::63:73ff:fede:43f9 dev vethbe8f01c table local proto kernel metric 0 pref medium
|
||||
local fe80::424:9bff:fe91:317e dev veth762d601 table local proto kernel metric 0 pref medium
|
||||
local fe80::443:71ff:feac:bdfb dev vethe9fcee3 table local proto kernel metric 0 pref medium
|
||||
local fe80::464:d7ff:fea1:a54a dev veth2dd045f table local proto kernel metric 0 pref medium
|
||||
local fe80::4a3:bbff:fea9:df98 dev veth99bb318 table local proto kernel metric 0 pref medium
|
||||
local fe80::869:a1ff:fee9:63a6 dev veth2273529 table local proto kernel metric 0 pref medium
|
||||
local fe80::c1f:b5ff:fe0a:c936 dev vethca0ee65 table local proto kernel metric 0 pref medium
|
||||
local fe80::e6f:317c:ee82:e5e dev enp4s0 table local proto kernel metric 0 pref medium
|
||||
local fe80::1058:f8ff:fe69:21bb dev br-68e2ed0ec6ac table local proto kernel metric 0 pref medium
|
||||
local fe80::18c7:26ff:fe8b:bea4 dev veth46248ff table local proto kernel metric 0 pref medium
|
||||
local fe80::1c13:3ff:fe18:c9a4 dev veth2906c94 table local proto kernel metric 0 pref medium
|
||||
local fe80::1c6e:c5ff:fe94:c515 dev veth3c1861e table local proto kernel metric 0 pref medium
|
||||
local fe80::2095:66ff:fe78:518e dev veth4ba8ed1 table local proto kernel metric 0 pref medium
|
||||
local fe80::24de:7fff:fef9:e7af dev veth2bde217 table local proto kernel metric 0 pref medium
|
||||
local fe80::2844:4dff:fec7:1613 dev vethcae9493 table local proto kernel metric 0 pref medium
|
||||
local fe80::286c:a2ff:fe49:5772 dev br-71bcae37092b table local proto kernel metric 0 pref medium
|
||||
local fe80::28b8:bdff:fe81:370f dev veth55cb2ec table local proto kernel metric 0 pref medium
|
||||
local fe80::28df:aff:fe50:a6d2 dev br-f63e542ab28c table local proto kernel metric 0 pref medium
|
||||
local fe80::2c30:58ff:fe89:f9d2 dev br-e02b7c89a2d3 table local proto kernel metric 0 pref medium
|
||||
local fe80::2c60:58ff:fe86:30d3 dev veth4692f5c table local proto kernel metric 0 pref medium
|
||||
local fe80::303f:6ff:fe24:1fa6 dev vethe969d14 table local proto kernel metric 0 pref medium
|
||||
local fe80::30d4:6bff:fe54:5fb3 dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
|
||||
local fe80::30f1:2cff:feac:90cb dev veth1bece5c table local proto kernel metric 0 pref medium
|
||||
local fe80::3441:76ff:fe3f:f8d1 dev veth766794b table local proto kernel metric 0 pref medium
|
||||
local fe80::3c0c:90ff:fe10:332f dev veth2edd7d6 table local proto kernel metric 0 pref medium
|
||||
local fe80::3c1f:f9ff:fe36:4122 dev veth081c8bf table local proto kernel metric 0 pref medium
|
||||
local fe80::3c6e:51ff:fe48:e037 dev vetha548a1a table local proto kernel metric 0 pref medium
|
||||
local fe80::40f5:bfff:fed7:8296 dev br-87e08370adff table local proto kernel metric 0 pref medium
|
||||
local fe80::4421:95ff:fe94:d7c5 dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
|
||||
local fe80::4463:6dff:fe29:79d5 dev veth4216565 table local proto kernel metric 0 pref medium
|
||||
local fe80::4482:41ff:feb3:9c74 dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
|
||||
local fe80::44ee:8eff:fe1a:bcf4 dev vethe123758 table local proto kernel metric 0 pref medium
|
||||
local fe80::48e9:9ff:fea5:2c72 dev docker0 table local proto kernel metric 0 pref medium
|
||||
local fe80::48ec:7cff:fe17:27bc dev veth0477205 table local proto kernel metric 0 pref medium
|
||||
local fe80::4c52:c7ff:fe49:3b0e dev vethf79d976 table local proto kernel metric 0 pref medium
|
||||
local fe80::4c63:fcff:fe4c:7d6a dev br-f10b040acc46 table local proto kernel metric 0 pref medium
|
||||
local fe80::4c80:8fff:feec:15d4 dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
|
||||
local fe80::502a:e5ff:fe5c:d5fa dev veth5f6906b table local proto kernel metric 0 pref medium
|
||||
local fe80::5030:beff:fead:c50a dev veth9e2bcbb table local proto kernel metric 0 pref medium
|
||||
local fe80::50f3:d6ff:fedd:1cd3 dev veth160d05f table local proto kernel metric 0 pref medium
|
||||
local fe80::542a:61ff:fe38:307c dev veth8c376e6 table local proto kernel metric 0 pref medium
|
||||
local fe80::5455:fbff:fec6:391e dev veth2d01312 table local proto kernel metric 0 pref medium
|
||||
local fe80::548d:1eff:fe36:12c5 dev br-2d50ca7a8f5d table local proto kernel metric 0 pref medium
|
||||
local fe80::548d:f8ff:fef4:c0db dev veth880eb86 table local proto kernel metric 0 pref medium
|
||||
local fe80::5852:d0ff:fe9e:545 dev vethc0ef06c table local proto kernel metric 0 pref medium
|
||||
local fe80::5c80:75ff:feff:22dd dev veth15eb212 table local proto kernel metric 0 pref medium
|
||||
local fe80::60fc:94ff:fe7d:a58f dev br-cfae917b997e table local proto kernel metric 0 pref medium
|
||||
local fe80::6486:bfff:fee7:22df dev vethee5b2b0 table local proto kernel metric 0 pref medium
|
||||
local fe80::64fe:2aff:fed1:1e41 dev veth6232cb7 table local proto kernel metric 0 pref medium
|
||||
local fe80::68b1:bff:fee2:9d17 dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
|
||||
local fe80::6c50:96ff:fe29:70a6 dev veth9cc2ad8 table local proto kernel metric 0 pref medium
|
||||
local fe80::6c7e:7fff:fe2a:bf1d dev br-875fced92cd0 table local proto kernel metric 0 pref medium
|
||||
local fe80::6c9c:c1ff:fe95:888e dev br-fea0382ed10b table local proto kernel metric 0 pref medium
|
||||
local fe80::6cb5:cff:fea2:a675 dev veth58179de table local proto kernel metric 0 pref medium
|
||||
local fe80::7069:c0ff:febd:1d88 dev vethe488043 table local proto kernel metric 0 pref medium
|
||||
local fe80::7462:7dff:fe8f:115d dev veth73c775b table local proto kernel metric 0 pref medium
|
||||
local fe80::74c2:12ff:fe72:7875 dev veth426f4c7 table local proto kernel metric 0 pref medium
|
||||
local fe80::78cf:3dff:fe72:528b dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
|
||||
local fe80::7c42:75ff:fe80:5953 dev veth551b749 table local proto kernel metric 0 pref medium
|
||||
local fe80::7c73:c8ff:fe04:3dd2 dev br-28584d053169 table local proto kernel metric 0 pref medium
|
||||
local fe80::7cdd:44ff:fe90:1f77 dev veth53fd806 table local proto kernel metric 0 pref medium
|
||||
local fe80::805a:47ff:fe53:cfcd dev vethf48aa55 table local proto kernel metric 0 pref medium
|
||||
local fe80::80a3:1eff:fe61:4f10 dev veth32d5964 table local proto kernel metric 0 pref medium
|
||||
local fe80::80fb:8fff:fead:2208 dev veth7d6d658 table local proto kernel metric 0 pref medium
|
||||
local fe80::84bf:b2ff:fec4:ea7 dev vethd14eb7e table local proto kernel metric 0 pref medium
|
||||
local fe80::8832:52ff:fee4:8a93 dev veth8c83268 table local proto kernel metric 0 pref medium
|
||||
local fe80::888d:45ff:feeb:4a48 dev veth26a5545 table local proto kernel metric 0 pref medium
|
||||
local fe80::9091:4aff:feee:8942 dev veth6594ba0 table local proto kernel metric 0 pref medium
|
||||
local fe80::90da:e3ff:fefa:7464 dev veth1f1f066 table local proto kernel metric 0 pref medium
|
||||
local fe80::90ed:30ff:fe51:2b5a dev veth335556c table local proto kernel metric 0 pref medium
|
||||
local fe80::90ed:f4ff:feed:a749 dev vethacfaa19 table local proto kernel metric 0 pref medium
|
||||
local fe80::90ff:b0ff:fe58:21fb dev veth448a204 table local proto kernel metric 0 pref medium
|
||||
local fe80::9879:f6ff:fe6d:57be dev br-c50ccbc5e464 table local proto kernel metric 0 pref medium
|
||||
local fe80::a047:6eff:fe8b:1f48 dev veth502e53b table local proto kernel metric 0 pref medium
|
||||
local fe80::a065:bfff:fea5:34 dev veth368657c table local proto kernel metric 0 pref medium
|
||||
local fe80::a065:eaff:fef3:532d dev br-11ceaf8736f5 table local proto kernel metric 0 pref medium
|
||||
local fe80::a0eb:3bff:fe66:df68 dev veth80da983 table local proto kernel metric 0 pref medium
|
||||
local fe80::a4a0:13ff:fe7f:7c8d dev vethd88eb9b table local proto kernel metric 0 pref medium
|
||||
local fe80::a4ab:b9ff:fe3e:af94 dev veth71028db table local proto kernel metric 0 pref medium
|
||||
local fe80::a843:f3ff:fedb:ef64 dev br-5a9988b94efd table local proto kernel metric 0 pref medium
|
||||
local fe80::a8fe:4ff:fe1f:d81a dev br-b7976abb6e55 table local proto kernel metric 0 pref medium
|
||||
local fe80::ac43:75ff:fefa:cbfd dev veth79ea708 table local proto kernel metric 0 pref medium
|
||||
local fe80::ac5e:9cff:fe45:ec06 dev veth7e2863d table local proto kernel metric 0 pref medium
|
||||
local fe80::ac67:76ff:fe15:1676 dev veth6f6f074 table local proto kernel metric 0 pref medium
|
||||
local fe80::ac86:86ff:fe64:f2d4 dev br-eeee48934935 table local proto kernel metric 0 pref medium
|
||||
local fe80::aca7:12ff:fe18:d1b9 dev br-a35cbfd37253 table local proto kernel metric 0 pref medium
|
||||
local fe80::aca7:68ff:fe42:e77 dev veth14193e1 table local proto kernel metric 0 pref medium
|
||||
local fe80::aca8:14ff:feee:df7c dev br-618855db6757 table local proto kernel metric 0 pref medium
|
||||
local fe80::acc5:57ff:fece:3b51 dev veth62aa43d table local proto kernel metric 0 pref medium
|
||||
local fe80::b441:acff:fe66:5981 dev veth0e4600c table local proto kernel metric 0 pref medium
|
||||
local fe80::b471:19ff:fe52:ff1 dev br-d89dcf384c2a table local proto kernel metric 0 pref medium
|
||||
local fe80::b48b:1aff:fe71:36d3 dev veth21e2097 table local proto kernel metric 0 pref medium
|
||||
local fe80::b4d5:57ff:fe87:83f9 dev vethc2b3531 table local proto kernel metric 0 pref medium
|
||||
local fe80::b86e:58ff:fef5:85f6 dev br-dee363d4e0c6 table local proto kernel metric 0 pref medium
|
||||
local fe80::bc01:62ff:fe13:b616 dev veth41b1943 table local proto kernel metric 0 pref medium
|
||||
local fe80::c000:96ff:fe7d:11a8 dev vethbb40f36 table local proto kernel metric 0 pref medium
|
||||
local fe80::c006:5ff:fea6:b743 dev vethf5f3d34 table local proto kernel metric 0 pref medium
|
||||
local fe80::c030:54ff:fe2d:eb36 dev br-8b881e367322 table local proto kernel metric 0 pref medium
|
||||
local fe80::c090:5eff:fed8:d1cc dev veth370f490 table local proto kernel metric 0 pref medium
|
||||
local fe80::c0da:5bff:fea4:92dc dev br-6caddd639b0b table local proto kernel metric 0 pref medium
|
||||
local fe80::c85e:5aff:feaa:f812 dev veth165b4aa table local proto kernel metric 0 pref medium
|
||||
local fe80::c899:1fff:fe27:7f66 dev veth4a87e58 table local proto kernel metric 0 pref medium
|
||||
local fe80::c8b0:56ff:fe7e:bc48 dev br-f9343d8383ac table local proto kernel metric 0 pref medium
|
||||
local fe80::cc80:50ff:feb5:67b dev veth2445f8e table local proto kernel metric 0 pref medium
|
||||
local fe80::ccd1:f1ff:fe0f:c699 dev vethca028f8 table local proto kernel metric 0 pref medium
|
||||
local fe80::d037:82ff:fee7:27c5 dev veth28958e3 table local proto kernel metric 0 pref medium
|
||||
local fe80::d037:e3ff:fe79:1a5f dev veth563d3b9 table local proto kernel metric 0 pref medium
|
||||
local fe80::d44c:3bff:fe3b:934f dev veth2b9371a table local proto kernel metric 0 pref medium
|
||||
local fe80::d44d:feff:fe18:d291 dev veth6091231 table local proto kernel metric 0 pref medium
|
||||
local fe80::d457:2bff:fe72:23f dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
|
||||
local fe80::d45e:64ff:fe90:37e7 dev veth6b9d50d table local proto kernel metric 0 pref medium
|
||||
local fe80::d847:aaff:fe89:3f9 dev veth4ecfbb5 table local proto kernel metric 0 pref medium
|
||||
local fe80::d86b:4fff:fec2:50e0 dev veth8d698e0 table local proto kernel metric 0 pref medium
|
||||
local fe80::d87e:fbff:fec6:5aeb dev br-4efe811b8402 table local proto kernel metric 0 pref medium
|
||||
local fe80::d8c8:aaff:fe63:6af9 dev br-263c8508de6f table local proto kernel metric 0 pref medium
|
||||
local fe80::dc0f:5dff:fec4:7c53 dev veth56166e3 table local proto kernel metric 0 pref medium
|
||||
local fe80::e0a6:32ff:fe63:9f8d dev br-9891a93b5e9c table local proto kernel metric 0 pref medium
|
||||
local fe80::e447:bff:feea:1f61 dev vethe6c6432 table local proto kernel metric 0 pref medium
|
||||
local fe80::e46c:23ff:fec3:3ab9 dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
|
||||
local fe80::e488:ccff:fe2f:e545 dev veth04a7fbe table local proto kernel metric 0 pref medium
|
||||
local fe80::e49e:23ff:feb7:932d dev veth1f2dc82 table local proto kernel metric 0 pref medium
|
||||
local fe80::e807:c7ff:fee0:f12d dev vethaeee758 table local proto kernel metric 0 pref medium
|
||||
local fe80::e855:acff:fef2:5aa3 dev veth30db54a table local proto kernel metric 0 pref medium
|
||||
local fe80::e87f:edff:fe10:e8d6 dev vethd87ba34 table local proto kernel metric 0 pref medium
|
||||
local fe80::ec3f:78ff:fe38:75b9 dev veth605aea1 table local proto kernel metric 0 pref medium
|
||||
local fe80::f01a:4eff:fef2:9942 dev veth38ae454 table local proto kernel metric 0 pref medium
|
||||
local fe80::f01f:e5ff:fe2b:ec80 dev br-03ee8c9e4bea table local proto kernel metric 0 pref medium
|
||||
local fe80::f038:dbff:fefd:87d3 dev veth362d4c6 table local proto kernel metric 0 pref medium
|
||||
local fe80::f0bf:5ff:fee7:2b1e dev veth337e2fd table local proto kernel metric 0 pref medium
|
||||
local fe80::f0c3:fff:fe8b:74e3 dev vethf583175 table local proto kernel metric 0 pref medium
|
||||
local fe80::f4a6:b6ff:fe24:af71 dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
|
||||
local fe80::f8d4:eff:fe6e:19a9 dev br-ecba5adea6ea table local proto kernel metric 0 pref medium
|
||||
local fe80::fc79:ccff:fefd:20d7 dev br-59ca07fbf200 table local proto kernel metric 0 pref medium
|
||||
multicast ff00::/8 dev enp4s0 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev wg0 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethf79d976 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev docker0 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth605aea1 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-5a9988b94efd table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethca028f8 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-e02b7c89a2d3 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-dee363d4e0c6 table local proto kernel metric 256 linkdown pref medium
|
||||
multicast ff00::/8 dev br-875fced92cd0 table local proto kernel metric 256 linkdown pref medium
|
||||
multicast ff00::/8 dev vethf583175 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-11ceaf8736f5 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth880eb86 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth7e2863d table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth55cb2ec table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethee5b2b0 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-9aea00f5a485 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethbe8f01c table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-b7976abb6e55 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth2edd7d6 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-68e2ed0ec6ac table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth38ae454 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-cfae917b997e table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth563d3b9 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-ecba5adea6ea table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth766794b table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-d89dcf384c2a table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth426f4c7 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth362d4c6 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth2d01312 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth4ecfbb5 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth99bb318 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethcae9493 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth8c83268 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth6f6f074 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth4216565 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth46248ff table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethc0ef06c table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethaeee758 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-f63e542ab28c table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-8b881e367322 table local proto kernel metric 256 linkdown pref medium
|
||||
multicast ff00::/8 dev veth2906c94 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-6caddd639b0b table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethbb40f36 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-2d50ca7a8f5d table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth6594ba0 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-dc41f9983a47 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth28958e3 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth1f2dc82 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth04a7fbe table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth2273529 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth160d05f table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-eeee48934935 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethd88eb9b table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-f10b040acc46 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth80da983 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth2bde217 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth9e2bcbb table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth0477205 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-87e08370adff table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth370f490 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-ed1bb1cc9d39 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethca0ee65 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth4692f5c table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethd14eb7e table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-527a7cd84ff6 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth3c1861e table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-03ee8c9e4bea table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth32d5964 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vetha548a1a table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth762d601 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethf48aa55 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethf5f3d34 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-f3f5c7cfa74e table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth335556c table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth9cc2ad8 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth6232cb7 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth337e2fd table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth7d6d658 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth448a204 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth79ea708 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth4ba8ed1 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-263c8508de6f table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth4a87e58 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-fea0382ed10b table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethacfaa19 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth30db54a table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethe969d14 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth0e4600c table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth21e2097 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-f9343d8383ac table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth58179de table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-59ca07fbf200 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth6b9d50d table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth2445f8e table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth368657c table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth5f6906b table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth2dd045f table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth53fd806 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth2b9371a table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-051bbcfc21d8 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth165b4aa table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth8c376e6 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth73c775b table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth56166e3 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-4efe811b8402 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth14193e1 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethe9fcee3 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth71028db table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-bca9ecea74f1 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethe123758 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-a35cbfd37253 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth8d698e0 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-71bcae37092b table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethd87ba34 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth1bece5c table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-c50ccbc5e464 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth6091231 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth502e53b table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethe6c6432 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-618855db6757 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth1f1f066 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth26a5545 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethe488043 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-28584d053169 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth551b749 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth15eb212 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-4ecbee63f4b0 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth41b1943 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev vethc2b3531 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth62aa43d table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-8200b83f03e9 table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev veth081c8bf table local proto kernel metric 256 pref medium
|
||||
multicast ff00::/8 dev br-9891a93b5e9c table local proto kernel metric 256 pref medium
|
||||
|
||||
=== IPv4 rules ===
|
||||
0: from all lookup local
|
||||
32765: from 10.98.0.2 lookup wg0
|
||||
32766: from all lookup main
|
||||
32767: from all lookup default
|
||||
|
||||
=== IPv6 rules ===
|
||||
0: from all lookup local
|
||||
32766: from all lookup main
|
||||
|
||||
=== namespaces ===
|
||||
|
||||
=== resolvers ===
|
||||
# Generated by NetworkManager
|
||||
search lan
|
||||
nameserver 192.168.10.1
|
||||
nameserver fe80::3e8c:f8ff:fef4:2590%enp4s0
|
||||
|
||||
=== observed public IPv4 ===
|
||||
74.67.173.56
|
||||
|
||||
=== observed public IPv6 ===
|
||||
2603:7080:7500:1279:75aa:d64d:4cf0:8f10
|
||||
|
|
@ -0,0 +1,702 @@
|
|||
# Warning: table ip filter is managed by iptables-nft, do not touch!
|
||||
table ip filter { # handle 1
|
||||
chain INPUT { # handle 1
|
||||
type filter hook input priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain FORWARD { # handle 2
|
||||
type filter hook forward priority filter; policy accept;
|
||||
counter packets 1393654 bytes 658721511 jump DOCKER-USER # handle 170
|
||||
counter packets 1393654 bytes 658721511 jump DOCKER-FORWARD # handle 9
|
||||
}
|
||||
|
||||
chain OUTPUT { # handle 3
|
||||
type filter hook output priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain DOCKER { # handle 4
|
||||
ip daddr 172.31.0.2 iifname != "br-9891a93b5e9c" oifname "br-9891a93b5e9c" tcp dport 8945 counter packets 0 bytes 0 accept # handle 463
|
||||
ip daddr 10.9.0.2 iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 accept # handle 458
|
||||
ip daddr 10.17.0.2 iifname != "br-28584d053169" oifname "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 accept # handle 446
|
||||
ip daddr 10.1.0.6 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 accept # handle 441
|
||||
ip daddr 10.19.0.3 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5030 counter packets 0 bytes 0 accept # handle 435
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 9696 counter packets 0 bytes 0 accept # handle 434
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8989 counter packets 0 bytes 0 accept # handle 433
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8888 counter packets 0 bytes 0 accept # handle 432
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8787 counter packets 0 bytes 0 accept # handle 431
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8265 counter packets 0 bytes 0 accept # handle 430
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8191 counter packets 0 bytes 0 accept # handle 429
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8080 counter packets 0 bytes 0 accept # handle 428
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 7878 counter packets 0 bytes 0 accept # handle 427
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 6767 counter packets 0 bytes 0 accept # handle 426
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5075 counter packets 0 bytes 0 accept # handle 425
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5055 counter packets 0 bytes 0 accept # handle 424
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5000 counter packets 0 bytes 0 accept # handle 423
|
||||
ip daddr 172.30.0.3 iifname != "br-71bcae37092b" oifname "br-71bcae37092b" tcp dport 8080 counter packets 0 bytes 0 accept # handle 418
|
||||
ip daddr 10.13.0.2 iifname != "br-a35cbfd37253" oifname "br-a35cbfd37253" tcp dport 8000 counter packets 0 bytes 0 accept # handle 413
|
||||
ip daddr 10.10.0.2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 443 counter packets 0 bytes 0 accept # handle 408
|
||||
ip daddr 10.10.0.2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 80 counter packets 0 bytes 0 accept # handle 407
|
||||
ip daddr 10.99.0.16 iifname != "br-e02b7c89a2d3" oifname "br-e02b7c89a2d3" tcp dport 9000 counter packets 0 bytes 0 accept # handle 402
|
||||
ip daddr 10.1.0.5 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 8080 counter packets 0 bytes 0 accept # handle 397
|
||||
ip daddr 10.1.0.3 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 80 counter packets 0 bytes 0 accept # handle 391
|
||||
ip daddr 10.24.0.2 iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" tcp dport 8080 counter packets 0 bytes 0 accept # handle 386
|
||||
ip daddr 172.26.0.5 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 80 counter packets 0 bytes 0 accept # handle 381
|
||||
ip daddr 172.26.0.4 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" udp dport 10009 counter packets 0 bytes 0 accept # handle 380
|
||||
ip daddr 172.26.0.4 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 9090 counter packets 0 bytes 0 accept # handle 379
|
||||
ip daddr 172.26.0.3 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 8888 counter packets 0 bytes 0 accept # handle 378
|
||||
ip daddr 172.26.0.2 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 5280 counter packets 0 bytes 0 accept # handle 377
|
||||
ip daddr 10.26.0.2 iifname != "br-263c8508de6f" oifname "br-263c8508de6f" tcp dport 6167 counter packets 0 bytes 0 accept # handle 372
|
||||
ip daddr 10.31.0.5 iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" tcp dport 4000 counter packets 0 bytes 0 accept # handle 367
|
||||
ip daddr 10.31.0.4 iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" tcp dport 3000 counter packets 0 bytes 0 accept # handle 366
|
||||
ip daddr 10.31.0.2 iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" tcp dport 9200 counter packets 0 bytes 0 accept # handle 363
|
||||
ip daddr 172.28.0.5 iifname != "br-03ee8c9e4bea" oifname "br-03ee8c9e4bea" tcp dport 8536 counter packets 0 bytes 0 accept # handle 358
|
||||
ip daddr 172.28.0.5 iifname != "br-03ee8c9e4bea" oifname "br-03ee8c9e4bea" tcp dport 1236 counter packets 0 bytes 0 accept # handle 357
|
||||
ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" tcp dport 8097 counter packets 0 bytes 0 accept # handle 352
|
||||
ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" tcp dport 6697 counter packets 1 bytes 52 accept # handle 351
|
||||
ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" tcp dport 6667 counter packets 0 bytes 0 accept # handle 350
|
||||
ip daddr 10.28.0.3 iifname != "br-ed1bb1cc9d39" oifname "br-ed1bb1cc9d39" tcp dport 8080 counter packets 0 bytes 0 accept # handle 345
|
||||
ip daddr 10.27.0.2 iifname != "br-87e08370adff" oifname "br-87e08370adff" tcp dport 3000 counter packets 0 bytes 0 accept # handle 340
|
||||
ip daddr 10.27.0.2 iifname != "br-87e08370adff" oifname "br-87e08370adff" tcp dport 2244 counter packets 0 bytes 0 accept # handle 339
|
||||
ip daddr 10.29.0.3 iifname != "br-f10b040acc46" oifname "br-f10b040acc46" tcp dport 3000 counter packets 0 bytes 0 accept # handle 332
|
||||
ip daddr 172.24.0.2 iifname != "br-eeee48934935" oifname "br-eeee48934935" tcp dport 7576 counter packets 0 bytes 0 accept # handle 326
|
||||
ip daddr 10.30.0.4 iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" tcp dport 80 counter packets 0 bytes 0 accept # handle 321
|
||||
ip daddr 172.23.0.2 iifname != "br-2d50ca7a8f5d" oifname "br-2d50ca7a8f5d" tcp dport 8080 counter packets 0 bytes 0 accept # handle 316
|
||||
ip daddr 172.23.0.2 iifname != "br-2d50ca7a8f5d" oifname "br-2d50ca7a8f5d" tcp dport 1935 counter packets 0 bytes 0 accept # handle 315
|
||||
ip daddr 172.22.0.2 iifname != "br-6caddd639b0b" oifname "br-6caddd639b0b" tcp dport 8765 counter packets 0 bytes 0 accept # handle 310
|
||||
ip daddr 10.4.0.2 iifname != "br-f63e542ab28c" oifname "br-f63e542ab28c" tcp dport 80 counter packets 0 bytes 0 accept # handle 299
|
||||
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 993 counter packets 33 bytes 1948 accept # handle 294
|
||||
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 465 counter packets 23 bytes 1252 accept # handle 293
|
||||
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 443 counter packets 0 bytes 0 accept # handle 292
|
||||
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 80 counter packets 0 bytes 0 accept # handle 291
|
||||
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 25 counter packets 500 bytes 29920 accept # handle 290
|
||||
ip daddr 10.3.0.2 iifname != "br-9aea00f5a485" oifname "br-9aea00f5a485" tcp dport 8888 counter packets 0 bytes 0 accept # handle 271
|
||||
ip daddr 10.55.0.3 iifname != "br-11ceaf8736f5" oifname "br-11ceaf8736f5" tcp dport 7001 counter packets 0 bytes 0 accept # handle 207
|
||||
ip daddr 10.55.0.2 iifname != "br-11ceaf8736f5" oifname "br-11ceaf8736f5" tcp dport 3000 counter packets 0 bytes 0 accept # handle 199
|
||||
ip daddr 172.17.0.4 iifname != "docker0" oifname "docker0" tcp dport 5432 counter packets 0 bytes 0 accept # handle 183
|
||||
ip daddr 172.17.0.3 iifname != "docker0" oifname "docker0" tcp dport 3306 counter packets 0 bytes 0 accept # handle 177
|
||||
iifname != "br-11ceaf8736f5" oifname "br-11ceaf8736f5" counter packets 0 bytes 0 drop # handle 18
|
||||
iifname != "br-dee363d4e0c6" oifname "br-dee363d4e0c6" counter packets 0 bytes 0 drop # handle 26
|
||||
iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 73
|
||||
iifname != "br-e02b7c89a2d3" oifname "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 137
|
||||
iifname != "br-875fced92cd0" oifname "br-875fced92cd0" counter packets 0 bytes 0 drop # handle 153
|
||||
iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop # handle 172
|
||||
iifname != "br-9aea00f5a485" oifname "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 268
|
||||
iifname != "br-68e2ed0ec6ac" oifname "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 273
|
||||
iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" counter packets 0 bytes 0 drop # handle 277
|
||||
iifname != "br-cfae917b997e" oifname "br-cfae917b997e" counter packets 0 bytes 0 drop # handle 284
|
||||
iifname != "br-f63e542ab28c" oifname "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 296
|
||||
iifname != "br-8b881e367322" oifname "br-8b881e367322" counter packets 0 bytes 0 drop # handle 301
|
||||
iifname != "br-6caddd639b0b" oifname "br-6caddd639b0b" counter packets 0 bytes 0 drop # handle 307
|
||||
iifname != "br-2d50ca7a8f5d" oifname "br-2d50ca7a8f5d" counter packets 0 bytes 0 drop # handle 312
|
||||
iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 318
|
||||
iifname != "br-eeee48934935" oifname "br-eeee48934935" counter packets 0 bytes 0 drop # handle 323
|
||||
iifname != "br-f10b040acc46" oifname "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 328
|
||||
iifname != "br-87e08370adff" oifname "br-87e08370adff" counter packets 0 bytes 0 drop # handle 334
|
||||
iifname != "br-ed1bb1cc9d39" oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 342
|
||||
iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 347
|
||||
iifname != "br-03ee8c9e4bea" oifname "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 354
|
||||
iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 360
|
||||
iifname != "br-263c8508de6f" oifname "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 369
|
||||
iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 374
|
||||
iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 383
|
||||
iifname != "br-59ca07fbf200" oifname "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 388
|
||||
iifname != "br-051bbcfc21d8" oifname "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 393
|
||||
iifname != "br-4efe811b8402" oifname "br-4efe811b8402" counter packets 0 bytes 0 drop # handle 399
|
||||
iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 404
|
||||
iifname != "br-a35cbfd37253" oifname "br-a35cbfd37253" counter packets 0 bytes 0 drop # handle 410
|
||||
iifname != "br-71bcae37092b" oifname "br-71bcae37092b" counter packets 0 bytes 0 drop # handle 415
|
||||
iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 420
|
||||
iifname != "br-618855db6757" oifname "br-618855db6757" counter packets 0 bytes 0 drop # handle 437
|
||||
iifname != "br-28584d053169" oifname "br-28584d053169" counter packets 0 bytes 0 drop # handle 443
|
||||
iifname != "br-4ecbee63f4b0" oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 448
|
||||
iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 455
|
||||
iifname != "br-9891a93b5e9c" oifname "br-9891a93b5e9c" counter packets 0 bytes 0 drop # handle 460
|
||||
}
|
||||
|
||||
chain DOCKER-FORWARD { # handle 5
|
||||
counter packets 1393654 bytes 658721511 jump DOCKER-CT # handle 12
|
||||
counter packets 811898 bytes 429419843 jump DOCKER-INTERNAL # handle 11
|
||||
counter packets 811898 bytes 429419843 jump DOCKER-BRIDGE # handle 10
|
||||
iifname "br-11ceaf8736f5" counter packets 3260 bytes 175561 accept # handle 17
|
||||
iifname "br-dee363d4e0c6" counter packets 0 bytes 0 accept # handle 25
|
||||
iifname "br-5a9988b94efd" counter packets 185 bytes 27196 accept # handle 72
|
||||
iifname "br-e02b7c89a2d3" counter packets 46734 bytes 8416975 accept # handle 136
|
||||
iifname "br-875fced92cd0" counter packets 0 bytes 0 accept # handle 152
|
||||
iifname "docker0" counter packets 0 bytes 0 accept # handle 171
|
||||
iifname "br-9aea00f5a485" counter packets 0 bytes 0 accept # handle 267
|
||||
iifname "br-68e2ed0ec6ac" counter packets 492 bytes 40183 accept # handle 272
|
||||
iifname "br-b7976abb6e55" counter packets 10668 bytes 5341503 accept # handle 276
|
||||
iifname "br-ecba5adea6ea" oifname "br-ecba5adea6ea" counter packets 0 bytes 0 accept # handle 282
|
||||
iifname "br-cfae917b997e" counter packets 43 bytes 4954 accept # handle 283
|
||||
iifname "br-d89dcf384c2a" oifname "br-d89dcf384c2a" counter packets 0 bytes 0 accept # handle 289
|
||||
iifname "br-f63e542ab28c" counter packets 0 bytes 0 accept # handle 295
|
||||
iifname "br-8b881e367322" counter packets 135 bytes 13854 accept # handle 300
|
||||
iifname "br-6caddd639b0b" counter packets 0 bytes 0 accept # handle 306
|
||||
iifname "br-2d50ca7a8f5d" counter packets 0 bytes 0 accept # handle 311
|
||||
iifname "br-dc41f9983a47" counter packets 0 bytes 0 accept # handle 317
|
||||
iifname "br-eeee48934935" counter packets 46 bytes 3053 accept # handle 322
|
||||
iifname "br-f10b040acc46" counter packets 1774 bytes 177630 accept # handle 327
|
||||
iifname "br-87e08370adff" counter packets 0 bytes 0 accept # handle 333
|
||||
iifname "br-ed1bb1cc9d39" counter packets 15 bytes 1717 accept # handle 341
|
||||
iifname "br-527a7cd84ff6" counter packets 3 bytes 132 accept # handle 346
|
||||
iifname "br-03ee8c9e4bea" counter packets 6089 bytes 353878 accept # handle 353
|
||||
iifname "br-f3f5c7cfa74e" counter packets 639 bytes 70250 accept # handle 359
|
||||
iifname "br-263c8508de6f" counter packets 24004 bytes 2190194 accept # handle 368
|
||||
iifname "br-fea0382ed10b" counter packets 134 bytes 30967 accept # handle 373
|
||||
iifname "br-f9343d8383ac" counter packets 0 bytes 0 accept # handle 382
|
||||
iifname "br-59ca07fbf200" counter packets 0 bytes 0 accept # handle 387
|
||||
iifname "br-051bbcfc21d8" counter packets 0 bytes 0 accept # handle 392
|
||||
iifname "br-4efe811b8402" counter packets 0 bytes 0 accept # handle 398
|
||||
iifname "br-bca9ecea74f1" counter packets 0 bytes 0 accept # handle 403
|
||||
iifname "br-a35cbfd37253" counter packets 0 bytes 0 accept # handle 409
|
||||
iifname "br-71bcae37092b" counter packets 0 bytes 0 accept # handle 414
|
||||
iifname "br-c50ccbc5e464" counter packets 637050 bytes 401364749 accept # handle 419
|
||||
iifname "br-618855db6757" counter packets 0 bytes 0 accept # handle 436
|
||||
iifname "br-28584d053169" counter packets 12 bytes 1526 accept # handle 442
|
||||
iifname "br-4ecbee63f4b0" counter packets 0 bytes 0 accept # handle 447
|
||||
iifname "br-8200b83f03e9" counter packets 52 bytes 6434 accept # handle 454
|
||||
iifname "br-9891a93b5e9c" counter packets 5916 bytes 322250 accept # handle 459
|
||||
}
|
||||
|
||||
chain DOCKER-BRIDGE { # handle 6
|
||||
oifname "br-11ceaf8736f5" counter packets 0 bytes 0 jump DOCKER # handle 20
|
||||
oifname "br-dee363d4e0c6" counter packets 0 bytes 0 jump DOCKER # handle 28
|
||||
oifname "br-5a9988b94efd" counter packets 0 bytes 0 jump DOCKER # handle 75
|
||||
oifname "br-e02b7c89a2d3" counter packets 0 bytes 0 jump DOCKER # handle 139
|
||||
oifname "br-875fced92cd0" counter packets 0 bytes 0 jump DOCKER # handle 155
|
||||
oifname "docker0" counter packets 0 bytes 0 jump DOCKER # handle 174
|
||||
oifname "br-9aea00f5a485" counter packets 0 bytes 0 jump DOCKER # handle 270
|
||||
oifname "br-68e2ed0ec6ac" counter packets 0 bytes 0 jump DOCKER # handle 275
|
||||
oifname "br-b7976abb6e55" counter packets 556 bytes 33120 jump DOCKER # handle 279
|
||||
oifname "br-cfae917b997e" counter packets 0 bytes 0 jump DOCKER # handle 286
|
||||
oifname "br-f63e542ab28c" counter packets 0 bytes 0 jump DOCKER # handle 298
|
||||
oifname "br-8b881e367322" counter packets 0 bytes 0 jump DOCKER # handle 303
|
||||
oifname "br-6caddd639b0b" counter packets 0 bytes 0 jump DOCKER # handle 309
|
||||
oifname "br-2d50ca7a8f5d" counter packets 0 bytes 0 jump DOCKER # handle 314
|
||||
oifname "br-dc41f9983a47" counter packets 0 bytes 0 jump DOCKER # handle 320
|
||||
oifname "br-eeee48934935" counter packets 0 bytes 0 jump DOCKER # handle 325
|
||||
oifname "br-f10b040acc46" counter packets 0 bytes 0 jump DOCKER # handle 330
|
||||
oifname "br-87e08370adff" counter packets 0 bytes 0 jump DOCKER # handle 336
|
||||
oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 jump DOCKER # handle 344
|
||||
oifname "br-527a7cd84ff6" counter packets 1 bytes 52 jump DOCKER # handle 349
|
||||
oifname "br-03ee8c9e4bea" counter packets 0 bytes 0 jump DOCKER # handle 356
|
||||
oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 jump DOCKER # handle 362
|
||||
oifname "br-263c8508de6f" counter packets 0 bytes 0 jump DOCKER # handle 371
|
||||
oifname "br-fea0382ed10b" counter packets 0 bytes 0 jump DOCKER # handle 376
|
||||
oifname "br-f9343d8383ac" counter packets 0 bytes 0 jump DOCKER # handle 385
|
||||
oifname "br-59ca07fbf200" counter packets 0 bytes 0 jump DOCKER # handle 390
|
||||
oifname "br-051bbcfc21d8" counter packets 0 bytes 0 jump DOCKER # handle 395
|
||||
oifname "br-4efe811b8402" counter packets 0 bytes 0 jump DOCKER # handle 401
|
||||
oifname "br-bca9ecea74f1" counter packets 0 bytes 0 jump DOCKER # handle 406
|
||||
oifname "br-a35cbfd37253" counter packets 0 bytes 0 jump DOCKER # handle 412
|
||||
oifname "br-71bcae37092b" counter packets 0 bytes 0 jump DOCKER # handle 417
|
||||
oifname "br-c50ccbc5e464" counter packets 0 bytes 0 jump DOCKER # handle 422
|
||||
oifname "br-618855db6757" counter packets 0 bytes 0 jump DOCKER # handle 439
|
||||
oifname "br-28584d053169" counter packets 0 bytes 0 jump DOCKER # handle 445
|
||||
oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 jump DOCKER # handle 450
|
||||
oifname "br-8200b83f03e9" counter packets 0 bytes 0 jump DOCKER # handle 457
|
||||
oifname "br-9891a93b5e9c" counter packets 0 bytes 0 jump DOCKER # handle 462
|
||||
}
|
||||
|
||||
chain DOCKER-CT { # handle 7
|
||||
oifname "br-11ceaf8736f5" xt match "conntrack" counter packets 5913 bytes 14315682 accept # handle 19
|
||||
oifname "br-dee363d4e0c6" xt match "conntrack" counter packets 0 bytes 0 accept # handle 27
|
||||
oifname "br-5a9988b94efd" xt match "conntrack" counter packets 260 bytes 99871 accept # handle 74
|
||||
oifname "br-e02b7c89a2d3" xt match "conntrack" counter packets 45927 bytes 21960391 accept # handle 138
|
||||
oifname "br-875fced92cd0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 154
|
||||
oifname "docker0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 173
|
||||
oifname "br-9aea00f5a485" xt match "conntrack" counter packets 0 bytes 0 accept # handle 269
|
||||
oifname "br-68e2ed0ec6ac" xt match "conntrack" counter packets 451 bytes 117758 accept # handle 274
|
||||
oifname "br-b7976abb6e55" xt match "conntrack" counter packets 11952 bytes 824461 accept # handle 278
|
||||
oifname "br-cfae917b997e" xt match "conntrack" counter packets 41 bytes 3861 accept # handle 285
|
||||
oifname "br-f63e542ab28c" xt match "conntrack" counter packets 0 bytes 0 accept # handle 297
|
||||
oifname "br-8b881e367322" xt match "conntrack" counter packets 168 bytes 419234 accept # handle 302
|
||||
oifname "br-6caddd639b0b" xt match "conntrack" counter packets 0 bytes 0 accept # handle 308
|
||||
oifname "br-2d50ca7a8f5d" xt match "conntrack" counter packets 0 bytes 0 accept # handle 313
|
||||
oifname "br-dc41f9983a47" xt match "conntrack" counter packets 0 bytes 0 accept # handle 319
|
||||
oifname "br-eeee48934935" xt match "conntrack" counter packets 61 bytes 204337 accept # handle 324
|
||||
oifname "br-f10b040acc46" xt match "conntrack" counter packets 2177 bytes 4824454 accept # handle 329
|
||||
oifname "br-87e08370adff" xt match "conntrack" counter packets 0 bytes 0 accept # handle 335
|
||||
oifname "br-ed1bb1cc9d39" xt match "conntrack" counter packets 15 bytes 11675 accept # handle 343
|
||||
oifname "br-527a7cd84ff6" xt match "conntrack" counter packets 4 bytes 207 accept # handle 348
|
||||
oifname "br-03ee8c9e4bea" xt match "conntrack" counter packets 7597 bytes 18374987 accept # handle 355
|
||||
oifname "br-f3f5c7cfa74e" xt match "conntrack" counter packets 664 bytes 703654 accept # handle 361
|
||||
oifname "br-263c8508de6f" xt match "conntrack" counter packets 18991 bytes 2926748 accept # handle 370
|
||||
oifname "br-fea0382ed10b" xt match "conntrack" counter packets 103 bytes 71274 accept # handle 375
|
||||
oifname "br-f9343d8383ac" xt match "conntrack" counter packets 0 bytes 0 accept # handle 384
|
||||
oifname "br-59ca07fbf200" xt match "conntrack" counter packets 0 bytes 0 accept # handle 389
|
||||
oifname "br-051bbcfc21d8" xt match "conntrack" counter packets 0 bytes 0 accept # handle 394
|
||||
oifname "br-4efe811b8402" xt match "conntrack" counter packets 0 bytes 0 accept # handle 400
|
||||
oifname "br-bca9ecea74f1" xt match "conntrack" counter packets 0 bytes 0 accept # handle 405
|
||||
oifname "br-a35cbfd37253" xt match "conntrack" counter packets 0 bytes 0 accept # handle 411
|
||||
oifname "br-71bcae37092b" xt match "conntrack" counter packets 0 bytes 0 accept # handle 416
|
||||
oifname "br-c50ccbc5e464" xt match "conntrack" counter packets 424336 bytes 101769455 accept # handle 421
|
||||
oifname "br-618855db6757" xt match "conntrack" counter packets 0 bytes 0 accept # handle 438
|
||||
oifname "br-28584d053169" xt match "conntrack" counter packets 12 bytes 6743 accept # handle 444
|
||||
oifname "br-4ecbee63f4b0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 449
|
||||
oifname "br-8200b83f03e9" xt match "conntrack" counter packets 66 bytes 182937 accept # handle 456
|
||||
oifname "br-9891a93b5e9c" xt match "conntrack" counter packets 7240 bytes 40405768 accept # handle 461
|
||||
}
|
||||
|
||||
chain DOCKER-INTERNAL { # handle 8
|
||||
ip saddr != 172.21.0.0/16 oifname "br-d89dcf384c2a" counter packets 0 bytes 0 drop # handle 288
|
||||
ip daddr != 172.21.0.0/16 iifname "br-d89dcf384c2a" counter packets 0 bytes 0 drop # handle 287
|
||||
ip saddr != 172.19.0.0/16 oifname "br-ecba5adea6ea" counter packets 0 bytes 0 drop # handle 281
|
||||
ip daddr != 172.19.0.0/16 iifname "br-ecba5adea6ea" counter packets 0 bytes 0 drop # handle 280
|
||||
}
|
||||
|
||||
chain DOCKER-USER { # handle 169
|
||||
}
|
||||
}
|
||||
# Warning: table ip6 filter is managed by iptables-nft, do not touch!
|
||||
table ip6 filter { # handle 2
|
||||
chain INPUT { # handle 1
|
||||
type filter hook input priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain FORWARD { # handle 2
|
||||
type filter hook forward priority filter; policy drop;
|
||||
counter packets 1704 bytes 966686 jump DOCKER-USER # handle 86
|
||||
counter packets 1704 bytes 966686 jump DOCKER-FORWARD # handle 9
|
||||
}
|
||||
|
||||
chain OUTPUT { # handle 3
|
||||
type filter hook output priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain DOCKER { # handle 4
|
||||
ip6 daddr fd00:9::2 iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 accept # handle 177
|
||||
ip6 daddr fd00:17::2 iifname != "br-28584d053169" oifname "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 accept # handle 167
|
||||
ip6 daddr fd00:1::6 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 accept # handle 162
|
||||
ip6 daddr fd00:10::2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 443 counter packets 0 bytes 0 accept # handle 156
|
||||
ip6 daddr fd00:10::2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 80 counter packets 0 bytes 0 accept # handle 155
|
||||
ip6 daddr fd00:1::5 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 8080 counter packets 0 bytes 0 accept # handle 150
|
||||
ip6 daddr fd00:1::3 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 80 counter packets 0 bytes 0 accept # handle 144
|
||||
ip6 daddr fd00:24::2 iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" tcp dport 8080 counter packets 0 bytes 0 accept # handle 143
|
||||
ip6 daddr fd00:30::4 iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" tcp dport 80 counter packets 0 bytes 0 accept # handle 114
|
||||
iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 34
|
||||
iifname != "br-9aea00f5a485" oifname "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 99
|
||||
iifname != "br-f63e542ab28c" oifname "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 103
|
||||
iifname != "br-8b881e367322" oifname "br-8b881e367322" counter packets 0 bytes 0 drop # handle 107
|
||||
iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 111
|
||||
iifname != "br-f10b040acc46" oifname "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 116
|
||||
iifname != "br-87e08370adff" oifname "br-87e08370adff" counter packets 0 bytes 0 drop # handle 120
|
||||
iifname != "br-ed1bb1cc9d39" oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 124
|
||||
iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 128
|
||||
iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 132
|
||||
iifname != "br-263c8508de6f" oifname "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 136
|
||||
iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 140
|
||||
iifname != "br-051bbcfc21d8" oifname "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 146
|
||||
iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 152
|
||||
iifname != "br-618855db6757" oifname "br-618855db6757" counter packets 0 bytes 0 drop # handle 158
|
||||
iifname != "br-28584d053169" oifname "br-28584d053169" counter packets 0 bytes 0 drop # handle 164
|
||||
iifname != "br-4ecbee63f4b0" oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 169
|
||||
iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 174
|
||||
}
|
||||
|
||||
chain DOCKER-FORWARD { # handle 5
|
||||
counter packets 1704 bytes 966686 jump DOCKER-CT # handle 12
|
||||
counter packets 798 bytes 112527 jump DOCKER-INTERNAL # handle 11
|
||||
counter packets 798 bytes 112527 jump DOCKER-BRIDGE # handle 10
|
||||
iifname "br-5a9988b94efd" counter packets 27 bytes 5590 accept # handle 33
|
||||
iifname "br-9aea00f5a485" counter packets 0 bytes 0 accept # handle 98
|
||||
iifname "br-f63e542ab28c" counter packets 0 bytes 0 accept # handle 102
|
||||
iifname "br-8b881e367322" counter packets 0 bytes 0 accept # handle 106
|
||||
iifname "br-dc41f9983a47" counter packets 0 bytes 0 accept # handle 110
|
||||
iifname "br-f10b040acc46" counter packets 0 bytes 0 accept # handle 115
|
||||
iifname "br-87e08370adff" counter packets 0 bytes 0 accept # handle 119
|
||||
iifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 accept # handle 123
|
||||
iifname "br-527a7cd84ff6" counter packets 0 bytes 0 accept # handle 127
|
||||
iifname "br-f3f5c7cfa74e" counter packets 544 bytes 83353 accept # handle 131
|
||||
iifname "br-263c8508de6f" counter packets 44 bytes 5795 accept # handle 135
|
||||
iifname "br-f9343d8383ac" counter packets 0 bytes 0 accept # handle 139
|
||||
iifname "br-051bbcfc21d8" counter packets 0 bytes 0 accept # handle 145
|
||||
iifname "br-bca9ecea74f1" counter packets 122 bytes 10531 accept # handle 151
|
||||
iifname "br-618855db6757" counter packets 0 bytes 0 accept # handle 157
|
||||
iifname "br-28584d053169" counter packets 0 bytes 0 accept # handle 163
|
||||
iifname "br-4ecbee63f4b0" counter packets 0 bytes 0 accept # handle 168
|
||||
iifname "br-8200b83f03e9" counter packets 0 bytes 0 accept # handle 173
|
||||
}
|
||||
|
||||
chain DOCKER-BRIDGE { # handle 6
|
||||
oifname "br-5a9988b94efd" counter packets 0 bytes 0 jump DOCKER # handle 36
|
||||
oifname "br-9aea00f5a485" counter packets 0 bytes 0 jump DOCKER # handle 101
|
||||
oifname "br-f63e542ab28c" counter packets 0 bytes 0 jump DOCKER # handle 105
|
||||
oifname "br-8b881e367322" counter packets 0 bytes 0 jump DOCKER # handle 109
|
||||
oifname "br-dc41f9983a47" counter packets 0 bytes 0 jump DOCKER # handle 113
|
||||
oifname "br-f10b040acc46" counter packets 0 bytes 0 jump DOCKER # handle 118
|
||||
oifname "br-87e08370adff" counter packets 0 bytes 0 jump DOCKER # handle 122
|
||||
oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 jump DOCKER # handle 126
|
||||
oifname "br-527a7cd84ff6" counter packets 0 bytes 0 jump DOCKER # handle 130
|
||||
oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 jump DOCKER # handle 134
|
||||
oifname "br-263c8508de6f" counter packets 0 bytes 0 jump DOCKER # handle 138
|
||||
oifname "br-f9343d8383ac" counter packets 0 bytes 0 jump DOCKER # handle 142
|
||||
oifname "br-051bbcfc21d8" counter packets 0 bytes 0 jump DOCKER # handle 148
|
||||
oifname "br-bca9ecea74f1" counter packets 0 bytes 0 jump DOCKER # handle 154
|
||||
oifname "br-618855db6757" counter packets 0 bytes 0 jump DOCKER # handle 160
|
||||
oifname "br-28584d053169" counter packets 0 bytes 0 jump DOCKER # handle 166
|
||||
oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 jump DOCKER # handle 171
|
||||
oifname "br-8200b83f03e9" counter packets 0 bytes 0 jump DOCKER # handle 176
|
||||
}
|
||||
|
||||
chain DOCKER-CT { # handle 7
|
||||
oifname "br-5a9988b94efd" xt match "conntrack" counter packets 28 bytes 16684 accept # handle 35
|
||||
oifname "br-9aea00f5a485" xt match "conntrack" counter packets 0 bytes 0 accept # handle 100
|
||||
oifname "br-f63e542ab28c" xt match "conntrack" counter packets 0 bytes 0 accept # handle 104
|
||||
oifname "br-8b881e367322" xt match "conntrack" counter packets 0 bytes 0 accept # handle 108
|
||||
oifname "br-dc41f9983a47" xt match "conntrack" counter packets 0 bytes 0 accept # handle 112
|
||||
oifname "br-f10b040acc46" xt match "conntrack" counter packets 0 bytes 0 accept # handle 117
|
||||
oifname "br-87e08370adff" xt match "conntrack" counter packets 0 bytes 0 accept # handle 121
|
||||
oifname "br-ed1bb1cc9d39" xt match "conntrack" counter packets 0 bytes 0 accept # handle 125
|
||||
oifname "br-527a7cd84ff6" xt match "conntrack" counter packets 0 bytes 0 accept # handle 129
|
||||
oifname "br-f3f5c7cfa74e" xt match "conntrack" counter packets 576 bytes 474421 accept # handle 133
|
||||
oifname "br-263c8508de6f" xt match "conntrack" counter packets 38 bytes 15719 accept # handle 137
|
||||
oifname "br-f9343d8383ac" xt match "conntrack" counter packets 0 bytes 0 accept # handle 141
|
||||
oifname "br-051bbcfc21d8" xt match "conntrack" counter packets 0 bytes 0 accept # handle 147
|
||||
oifname "br-bca9ecea74f1" xt match "conntrack" counter packets 225 bytes 333045 accept # handle 153
|
||||
oifname "br-618855db6757" xt match "conntrack" counter packets 0 bytes 0 accept # handle 159
|
||||
oifname "br-28584d053169" xt match "conntrack" counter packets 0 bytes 0 accept # handle 165
|
||||
oifname "br-4ecbee63f4b0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 170
|
||||
oifname "br-8200b83f03e9" xt match "conntrack" counter packets 0 bytes 0 accept # handle 175
|
||||
}
|
||||
|
||||
chain DOCKER-INTERNAL { # handle 8
|
||||
}
|
||||
|
||||
chain DOCKER-USER { # handle 85
|
||||
}
|
||||
}
|
||||
# Warning: table ip nat is managed by iptables-nft, do not touch!
|
||||
table ip nat { # handle 3
|
||||
chain DOCKER { # handle 1
|
||||
ip daddr 127.0.0.1 iifname != "docker0" tcp dport 3307 counter packets 0 bytes 0 xt target "DNAT" # handle 49
|
||||
ip daddr 127.0.0.1 iifname != "docker0" tcp dport 5434 counter packets 0 bytes 0 xt target "DNAT" # handle 55
|
||||
ip daddr 127.0.0.1 iifname != "br-11ceaf8736f5" tcp dport 3005 counter packets 0 bytes 0 xt target "DNAT" # handle 72
|
||||
ip daddr 127.0.0.1 iifname != "br-11ceaf8736f5" tcp dport 7001 counter packets 0 bytes 0 xt target "DNAT" # handle 80
|
||||
ip daddr 127.0.0.1 iifname != "br-9aea00f5a485" tcp dport 8440 counter packets 0 bytes 0 xt target "DNAT" # handle 141
|
||||
ip daddr 10.98.0.2 iifname != "br-b7976abb6e55" tcp dport 25 counter packets 500 bytes 29920 xt target "DNAT" # handle 145
|
||||
ip daddr 127.0.0.1 iifname != "br-b7976abb6e55" tcp dport 8088 counter packets 0 bytes 0 xt target "DNAT" # handle 146
|
||||
ip daddr 127.0.0.1 iifname != "br-b7976abb6e55" tcp dport 8443 counter packets 0 bytes 0 xt target "DNAT" # handle 147
|
||||
ip daddr 10.98.0.2 iifname != "br-b7976abb6e55" tcp dport 465 counter packets 23 bytes 1252 xt target "DNAT" # handle 148
|
||||
ip daddr 10.98.0.2 iifname != "br-b7976abb6e55" tcp dport 993 counter packets 33 bytes 1948 xt target "DNAT" # handle 149
|
||||
ip daddr 127.0.0.1 iifname != "br-f63e542ab28c" tcp dport 8017 counter packets 0 bytes 0 xt target "DNAT" # handle 151
|
||||
ip daddr 127.0.0.1 iifname != "br-6caddd639b0b" tcp dport 8765 counter packets 0 bytes 0 xt target "DNAT" # handle 156
|
||||
ip daddr 127.0.0.1 iifname != "br-2d50ca7a8f5d" tcp dport 1935 counter packets 0 bytes 0 xt target "DNAT" # handle 158
|
||||
ip daddr 127.0.0.1 iifname != "br-2d50ca7a8f5d" tcp dport 8086 counter packets 0 bytes 0 xt target "DNAT" # handle 159
|
||||
iifname != "br-dc41f9983a47" tcp dport 9098 counter packets 0 bytes 0 xt target "DNAT" # handle 161
|
||||
ip daddr 127.0.0.1 iifname != "br-eeee48934935" tcp dport 7576 counter packets 0 bytes 0 xt target "DNAT" # handle 163
|
||||
ip daddr 127.0.0.1 iifname != "br-f10b040acc46" tcp dport 3000 counter packets 0 bytes 0 xt target "DNAT" # handle 166
|
||||
ip daddr 10.98.0.2 iifname != "br-87e08370adff" tcp dport 2244 counter packets 0 bytes 0 xt target "DNAT" # handle 171
|
||||
ip daddr 127.0.0.1 iifname != "br-87e08370adff" tcp dport 2244 counter packets 0 bytes 0 xt target "DNAT" # handle 172
|
||||
ip daddr 127.0.0.1 iifname != "br-87e08370adff" tcp dport 3006 counter packets 0 bytes 0 xt target "DNAT" # handle 173
|
||||
ip daddr 127.0.0.1 iifname != "br-ed1bb1cc9d39" tcp dport 8181 counter packets 0 bytes 0 xt target "DNAT" # handle 175
|
||||
ip daddr 10.98.0.2 iifname != "br-527a7cd84ff6" tcp dport 6667 counter packets 0 bytes 0 xt target "DNAT" # handle 177
|
||||
ip daddr 10.98.0.2 iifname != "br-527a7cd84ff6" tcp dport 6697 counter packets 1 bytes 52 xt target "DNAT" # handle 178
|
||||
ip daddr 127.0.0.1 iifname != "br-527a7cd84ff6" tcp dport 8097 counter packets 0 bytes 0 xt target "DNAT" # handle 179
|
||||
ip daddr 127.0.0.1 iifname != "br-03ee8c9e4bea" tcp dport 1236 counter packets 0 bytes 0 xt target "DNAT" # handle 181
|
||||
ip daddr 127.0.0.1 iifname != "br-03ee8c9e4bea" tcp dport 8536 counter packets 0 bytes 0 xt target "DNAT" # handle 182
|
||||
ip daddr 127.0.0.1 iifname != "br-f3f5c7cfa74e" tcp dport 9201 counter packets 0 bytes 0 xt target "DNAT" # handle 184
|
||||
ip daddr 127.0.0.1 iifname != "br-f3f5c7cfa74e" tcp dport 3001 counter packets 0 bytes 0 xt target "DNAT" # handle 187
|
||||
ip daddr 127.0.0.1 iifname != "br-f3f5c7cfa74e" tcp dport 4001 counter packets 0 bytes 0 xt target "DNAT" # handle 188
|
||||
ip daddr 127.0.0.1 iifname != "br-263c8508de6f" tcp dport 6167 counter packets 0 bytes 0 xt target "DNAT" # handle 190
|
||||
ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 5280 counter packets 0 bytes 0 xt target "DNAT" # handle 192
|
||||
ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 8002 counter packets 0 bytes 0 xt target "DNAT" # handle 193
|
||||
ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 9090 counter packets 0 bytes 0 xt target "DNAT" # handle 194
|
||||
iifname != "br-fea0382ed10b" udp dport 10009 counter packets 0 bytes 0 xt target "DNAT" # handle 195
|
||||
ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 8001 counter packets 0 bytes 0 xt target "DNAT" # handle 196
|
||||
iifname != "br-f9343d8383ac" tcp dport 8383 counter packets 0 bytes 0 xt target "DNAT" # handle 198
|
||||
iifname != "br-5a9988b94efd" tcp dport 7778 counter packets 0 bytes 0 xt target "DNAT" # handle 200
|
||||
iifname != "br-5a9988b94efd" tcp dport 8016 counter packets 0 bytes 0 xt target "DNAT" # handle 203
|
||||
iifname != "br-e02b7c89a2d3" tcp dport 9009 counter packets 0 bytes 0 xt target "DNAT" # handle 205
|
||||
iifname != "br-bca9ecea74f1" tcp dport 8090 counter packets 0 bytes 0 xt target "DNAT" # handle 207
|
||||
iifname != "br-bca9ecea74f1" tcp dport 444 counter packets 0 bytes 0 xt target "DNAT" # handle 208
|
||||
iifname != "br-a35cbfd37253" tcp dport 8000 counter packets 0 bytes 0 xt target "DNAT" # handle 210
|
||||
ip daddr 127.0.0.1 iifname != "br-71bcae37092b" tcp dport 7676 counter packets 0 bytes 0 xt target "DNAT" # handle 212
|
||||
iifname != "br-c50ccbc5e464" tcp dport 5000 counter packets 0 bytes 0 xt target "DNAT" # handle 214
|
||||
iifname != "br-c50ccbc5e464" tcp dport 5055 counter packets 0 bytes 0 xt target "DNAT" # handle 215
|
||||
iifname != "br-c50ccbc5e464" tcp dport 5075 counter packets 0 bytes 0 xt target "DNAT" # handle 216
|
||||
iifname != "br-c50ccbc5e464" tcp dport 6767 counter packets 0 bytes 0 xt target "DNAT" # handle 217
|
||||
iifname != "br-c50ccbc5e464" tcp dport 7878 counter packets 0 bytes 0 xt target "DNAT" # handle 218
|
||||
iifname != "br-c50ccbc5e464" tcp dport 8080 counter packets 0 bytes 0 xt target "DNAT" # handle 219
|
||||
iifname != "br-c50ccbc5e464" tcp dport 8191 counter packets 0 bytes 0 xt target "DNAT" # handle 220
|
||||
iifname != "br-c50ccbc5e464" tcp dport 8265 counter packets 0 bytes 0 xt target "DNAT" # handle 221
|
||||
iifname != "br-c50ccbc5e464" tcp dport 8787 counter packets 0 bytes 0 xt target "DNAT" # handle 222
|
||||
iifname != "br-c50ccbc5e464" tcp dport 8888 counter packets 0 bytes 0 xt target "DNAT" # handle 223
|
||||
iifname != "br-c50ccbc5e464" tcp dport 8989 counter packets 0 bytes 0 xt target "DNAT" # handle 224
|
||||
iifname != "br-c50ccbc5e464" tcp dport 9696 counter packets 0 bytes 0 xt target "DNAT" # handle 225
|
||||
iifname != "br-c50ccbc5e464" tcp dport 5030 counter packets 0 bytes 0 xt target "DNAT" # handle 226
|
||||
iifname != "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 xt target "DNAT" # handle 229
|
||||
iifname != "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 xt target "DNAT" # handle 231
|
||||
iifname != "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 xt target "DNAT" # handle 237
|
||||
ip daddr 127.0.0.1 iifname != "br-9891a93b5e9c" tcp dport 8945 counter packets 0 bytes 0 xt target "DNAT" # handle 239
|
||||
}
|
||||
|
||||
chain PREROUTING { # handle 2
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
xt match "addrtype" counter packets 12868 bytes 773053 jump DOCKER # handle 3
|
||||
}
|
||||
|
||||
chain OUTPUT { # handle 4
|
||||
type nat hook output priority dstnat; policy accept;
|
||||
ip daddr != 127.0.0.0/8 xt match "addrtype" counter packets 0 bytes 0 jump DOCKER # handle 5
|
||||
}
|
||||
|
||||
chain POSTROUTING { # handle 6
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
ip saddr 172.31.0.0/16 oifname != "br-9891a93b5e9c" counter packets 3 bytes 180 xt target "MASQUERADE" # handle 238
|
||||
ip saddr 10.9.0.0/16 oifname != "br-8200b83f03e9" counter packets 2 bytes 120 xt target "MASQUERADE" # handle 236
|
||||
ip saddr 10.18.0.0/16 oifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 232
|
||||
ip saddr 10.17.0.0/16 oifname != "br-28584d053169" counter packets 1 bytes 60 xt target "MASQUERADE" # handle 230
|
||||
ip saddr 10.16.0.0/16 oifname != "br-618855db6757" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 227
|
||||
ip saddr 10.19.0.0/16 oifname != "br-c50ccbc5e464" counter packets 4 bytes 378 xt target "MASQUERADE" # handle 213
|
||||
ip saddr 172.30.0.0/16 oifname != "br-71bcae37092b" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 211
|
||||
ip saddr 10.13.0.0/16 oifname != "br-a35cbfd37253" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 209
|
||||
ip saddr 10.10.0.0/16 oifname != "br-bca9ecea74f1" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 206
|
||||
ip saddr 172.27.0.0/16 oifname != "br-4efe811b8402" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 204
|
||||
ip saddr 10.41.0.0/16 oifname != "br-051bbcfc21d8" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 201
|
||||
ip saddr 10.32.0.0/16 oifname != "br-59ca07fbf200" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 199
|
||||
ip saddr 10.24.0.0/16 oifname != "br-f9343d8383ac" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 197
|
||||
ip saddr 172.26.0.0/16 oifname != "br-fea0382ed10b" counter packets 12 bytes 3156 xt target "MASQUERADE" # handle 191
|
||||
ip saddr 10.26.0.0/16 oifname != "br-263c8508de6f" counter packets 17780 bytes 1459511 xt target "MASQUERADE" # handle 189
|
||||
ip saddr 10.31.0.0/16 oifname != "br-f3f5c7cfa74e" counter packets 87 bytes 5220 xt target "MASQUERADE" # handle 183
|
||||
ip saddr 172.28.0.0/16 oifname != "br-03ee8c9e4bea" counter packets 43 bytes 2580 xt target "MASQUERADE" # handle 180
|
||||
ip saddr 10.20.0.0/16 oifname != "br-527a7cd84ff6" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 176
|
||||
ip saddr 10.28.0.0/16 oifname != "br-ed1bb1cc9d39" counter packets 1 bytes 60 xt target "MASQUERADE" # handle 174
|
||||
ip saddr 10.27.0.0/16 oifname != "br-87e08370adff" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 167
|
||||
ip saddr 10.29.0.0/16 oifname != "br-f10b040acc46" counter packets 28 bytes 1680 xt target "MASQUERADE" # handle 164
|
||||
ip saddr 172.24.0.0/16 oifname != "br-eeee48934935" counter packets 1 bytes 60 xt target "MASQUERADE" # handle 162
|
||||
ip saddr 10.30.0.0/16 oifname != "br-dc41f9983a47" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 160
|
||||
ip saddr 172.23.0.0/16 oifname != "br-2d50ca7a8f5d" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 157
|
||||
ip saddr 172.22.0.0/16 oifname != "br-6caddd639b0b" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 155
|
||||
ip saddr 10.40.0.0/16 oifname != "br-8b881e367322" counter packets 3 bytes 180 xt target "MASQUERADE" # handle 152
|
||||
ip saddr 10.4.0.0/16 oifname != "br-f63e542ab28c" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 150
|
||||
ip saddr 172.20.0.0/16 oifname != "br-cfae917b997e" counter packets 9 bytes 1092 xt target "MASQUERADE" # handle 144
|
||||
ip saddr 172.18.0.0/16 oifname != "br-b7976abb6e55" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 143
|
||||
ip saddr 10.2.0.0/16 oifname != "br-68e2ed0ec6ac" counter packets 492 bytes 40183 xt target "MASQUERADE" # handle 142
|
||||
ip saddr 10.3.0.0/16 oifname != "br-9aea00f5a485" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 140
|
||||
ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 46
|
||||
ip saddr 172.25.0.0/16 oifname != "br-875fced92cd0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 41
|
||||
ip saddr 10.99.0.0/16 oifname != "br-e02b7c89a2d3" counter packets 4000 bytes 239992 xt target "MASQUERADE" # handle 37
|
||||
ip saddr 10.1.0.0/16 oifname != "br-5a9988b94efd" counter packets 7 bytes 420 xt target "MASQUERADE" # handle 21
|
||||
ip saddr 172.29.0.0/16 oifname != "br-dee363d4e0c6" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 10
|
||||
ip saddr 10.55.0.0/16 oifname != "br-11ceaf8736f5" counter packets 10 bytes 600 xt target "MASQUERADE" # handle 8
|
||||
}
|
||||
}
|
||||
# Warning: table ip6 nat is managed by iptables-nft, do not touch!
|
||||
table ip6 nat { # handle 4
|
||||
chain DOCKER { # handle 1
|
||||
ip6 saddr != fe80::/10 iifname != "br-dc41f9983a47" tcp dport 9098 counter packets 0 bytes 0 xt target "DNAT" # handle 40
|
||||
ip6 saddr != fe80::/10 iifname != "br-f9343d8383ac" tcp dport 8383 counter packets 0 bytes 0 xt target "DNAT" # handle 48
|
||||
ip6 saddr != fe80::/10 iifname != "br-5a9988b94efd" tcp dport 7778 counter packets 0 bytes 0 xt target "DNAT" # handle 49
|
||||
ip6 saddr != fe80::/10 iifname != "br-5a9988b94efd" tcp dport 8016 counter packets 0 bytes 0 xt target "DNAT" # handle 52
|
||||
ip6 saddr != fe80::/10 iifname != "br-bca9ecea74f1" tcp dport 8090 counter packets 0 bytes 0 xt target "DNAT" # handle 54
|
||||
ip6 saddr != fe80::/10 iifname != "br-bca9ecea74f1" tcp dport 444 counter packets 0 bytes 0 xt target "DNAT" # handle 55
|
||||
ip6 saddr != fe80::/10 iifname != "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 xt target "DNAT" # handle 58
|
||||
ip6 saddr != fe80::/10 iifname != "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 xt target "DNAT" # handle 60
|
||||
ip6 saddr != fe80::/10 iifname != "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 xt target "DNAT" # handle 64
|
||||
}
|
||||
|
||||
chain PREROUTING { # handle 2
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
xt match "addrtype" counter packets 2 bytes 112 jump DOCKER # handle 3
|
||||
}
|
||||
|
||||
chain OUTPUT { # handle 4
|
||||
type nat hook output priority dstnat; policy accept;
|
||||
ip6 daddr != ::1 xt match "addrtype" counter packets 0 bytes 0 jump DOCKER # handle 5
|
||||
}
|
||||
|
||||
chain POSTROUTING { # handle 6
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
ip6 saddr fd00:9::/64 oifname != "br-8200b83f03e9" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 63
|
||||
ip6 saddr fd00:18::/64 oifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 61
|
||||
ip6 saddr fd00:17::/64 oifname != "br-28584d053169" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 59
|
||||
ip6 saddr fd00:16::/64 oifname != "br-618855db6757" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 56
|
||||
ip6 saddr fd00:10::/64 oifname != "br-bca9ecea74f1" counter packets 1 bytes 80 xt target "MASQUERADE" # handle 53
|
||||
ip6 saddr fd00:41::/64 oifname != "br-051bbcfc21d8" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 50
|
||||
ip6 saddr fd00:24::/64 oifname != "br-f9343d8383ac" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 47
|
||||
ip6 saddr fd00:26::/64 oifname != "br-263c8508de6f" counter packets 5 bytes 400 xt target "MASQUERADE" # handle 46
|
||||
ip6 saddr fd00:31::/64 oifname != "br-f3f5c7cfa74e" counter packets 60 bytes 4800 xt target "MASQUERADE" # handle 45
|
||||
ip6 saddr fd00:20::/64 oifname != "br-527a7cd84ff6" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 44
|
||||
ip6 saddr fd00:28::/64 oifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 43
|
||||
ip6 saddr fd00:27::/64 oifname != "br-87e08370adff" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 42
|
||||
ip6 saddr fd00:29::/64 oifname != "br-f10b040acc46" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 41
|
||||
ip6 saddr fd00:30::/64 oifname != "br-dc41f9983a47" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 39
|
||||
ip6 saddr fd00:40::/64 oifname != "br-8b881e367322" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 38
|
||||
ip6 saddr fd00:4::/64 oifname != "br-f63e542ab28c" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 37
|
||||
ip6 saddr fd00:3::/64 oifname != "br-9aea00f5a485" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 36
|
||||
ip6 saddr fd00:1::/64 oifname != "br-5a9988b94efd" counter packets 2 bytes 160 xt target "MASQUERADE" # handle 12
|
||||
}
|
||||
}
|
||||
table ip raw { # handle 5
|
||||
chain PREROUTING { # handle 1
|
||||
type filter hook prerouting priority raw; policy accept;
|
||||
ip daddr 10.1.0.17 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 4
|
||||
ip daddr 10.1.0.20 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 7
|
||||
ip daddr 10.99.0.18 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 8
|
||||
ip daddr 10.1.0.9 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 9
|
||||
ip daddr 10.1.0.12 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 18
|
||||
ip daddr 10.1.0.19 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 19
|
||||
ip daddr 10.1.0.22 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 20
|
||||
ip daddr 172.17.0.2 iifname != "docker0" counter packets 0 bytes 0 drop # handle 27
|
||||
ip daddr 172.17.0.3 iifname != "docker0" counter packets 0 bytes 0 drop # handle 32
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3307 counter packets 0 bytes 0 drop # handle 39
|
||||
ip daddr 172.17.0.4 iifname != "docker0" counter packets 0 bytes 0 drop # handle 48
|
||||
ip daddr 10.55.0.2 iifname != "br-11ceaf8736f5" counter packets 0 bytes 0 drop # handle 53
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 5434 counter packets 0 bytes 0 drop # handle 66
|
||||
ip daddr 10.55.0.3 iifname != "br-11ceaf8736f5" counter packets 0 bytes 0 drop # handle 85
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3005 counter packets 0 bytes 0 drop # handle 104
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 7001 counter packets 0 bytes 0 drop # handle 118
|
||||
ip daddr 10.99.0.2 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 251
|
||||
ip daddr 10.99.0.3 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 252
|
||||
ip daddr 10.3.0.2 iifname != "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 253
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8440 counter packets 0 bytes 0 drop # handle 254
|
||||
ip daddr 172.18.0.2 iifname != "br-b7976abb6e55" counter packets 0 bytes 0 drop # handle 255
|
||||
ip daddr 172.20.0.2 iifname != "br-cfae917b997e" counter packets 0 bytes 0 drop # handle 256
|
||||
ip daddr 10.2.255.254 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 257
|
||||
ip daddr 10.2.0.2 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 258
|
||||
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" counter packets 0 bytes 0 drop # handle 259
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8088 counter packets 0 bytes 0 drop # handle 260
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8443 counter packets 0 bytes 0 drop # handle 261
|
||||
ip daddr 10.2.0.3 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 262
|
||||
ip daddr 10.2.0.4 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 263
|
||||
ip daddr 172.20.0.3 iifname != "br-cfae917b997e" counter packets 0 bytes 0 drop # handle 264
|
||||
ip daddr 10.2.0.5 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 265
|
||||
ip daddr 10.2.0.6 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 266
|
||||
ip daddr 10.2.0.7 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 267
|
||||
ip daddr 10.2.0.8 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 268
|
||||
ip daddr 10.4.0.2 iifname != "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 269
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8017 counter packets 0 bytes 0 drop # handle 270
|
||||
ip daddr 172.22.0.2 iifname != "br-6caddd639b0b" counter packets 0 bytes 0 drop # handle 275
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8765 counter packets 0 bytes 0 drop # handle 276
|
||||
ip daddr 172.23.0.2 iifname != "br-2d50ca7a8f5d" counter packets 0 bytes 0 drop # handle 277
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 1935 counter packets 0 bytes 0 drop # handle 278
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8086 counter packets 0 bytes 0 drop # handle 279
|
||||
ip daddr 10.30.0.2 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 280
|
||||
ip daddr 10.30.0.3 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 281
|
||||
ip daddr 10.1.0.2 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 282
|
||||
ip daddr 10.99.0.5 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 283
|
||||
ip daddr 10.30.0.4 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 284
|
||||
ip daddr 172.24.0.2 iifname != "br-eeee48934935" counter packets 0 bytes 0 drop # handle 285
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 7576 counter packets 0 bytes 0 drop # handle 286
|
||||
ip daddr 10.29.0.2 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 287
|
||||
ip daddr 10.99.0.6 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 288
|
||||
ip daddr 10.29.0.3 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 290
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3000 counter packets 0 bytes 0 drop # handle 291
|
||||
ip daddr 10.99.0.7 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 292
|
||||
ip daddr 10.27.0.2 iifname != "br-87e08370adff" counter packets 0 bytes 0 drop # handle 295
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 2244 counter packets 0 bytes 0 drop # handle 296
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3006 counter packets 0 bytes 0 drop # handle 297
|
||||
ip daddr 10.28.0.2 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 298
|
||||
ip daddr 10.28.0.3 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 299
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8181 counter packets 0 bytes 0 drop # handle 300
|
||||
ip daddr 10.99.0.8 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 301
|
||||
ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 302
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8097 counter packets 0 bytes 0 drop # handle 303
|
||||
ip daddr 172.28.0.2 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 304
|
||||
ip daddr 10.99.0.9 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 305
|
||||
ip daddr 172.28.0.3 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 306
|
||||
ip daddr 172.28.0.4 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 307
|
||||
ip daddr 172.28.0.5 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 308
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 1236 counter packets 0 bytes 0 drop # handle 309
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8536 counter packets 0 bytes 0 drop # handle 310
|
||||
ip daddr 10.31.0.2 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 311
|
||||
ip daddr 10.31.0.3 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 312
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 9201 counter packets 0 bytes 0 drop # handle 313
|
||||
ip daddr 10.99.0.10 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 314
|
||||
ip daddr 10.99.0.11 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 315
|
||||
ip daddr 10.99.0.12 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 316
|
||||
ip daddr 10.31.0.4 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 319
|
||||
ip daddr 10.31.0.5 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 320
|
||||
ip daddr 10.31.0.6 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 321
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3001 counter packets 0 bytes 0 drop # handle 322
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 4001 counter packets 0 bytes 0 drop # handle 323
|
||||
ip daddr 10.26.0.2 iifname != "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 324
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 6167 counter packets 0 bytes 0 drop # handle 325
|
||||
ip daddr 172.26.0.2 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 326
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 5280 counter packets 0 bytes 0 drop # handle 327
|
||||
ip daddr 172.26.0.3 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 328
|
||||
ip daddr 172.26.0.4 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 329
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8002 counter packets 0 bytes 0 drop # handle 330
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 9090 counter packets 0 bytes 0 drop # handle 331
|
||||
ip daddr 172.26.0.5 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 332
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8001 counter packets 0 bytes 0 drop # handle 333
|
||||
ip daddr 172.26.0.6 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 334
|
||||
ip daddr 10.24.0.2 iifname != "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 335
|
||||
ip daddr 10.32.0.2 iifname != "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 336
|
||||
ip daddr 10.1.0.3 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 337
|
||||
ip daddr 10.1.0.4 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 338
|
||||
ip daddr 10.99.0.13 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 339
|
||||
ip daddr 10.99.0.14 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 340
|
||||
ip daddr 10.32.0.3 iifname != "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 341
|
||||
ip daddr 10.32.0.4 iifname != "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 342
|
||||
ip daddr 10.41.0.2 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 343
|
||||
ip daddr 10.41.0.3 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 344
|
||||
ip daddr 10.1.0.5 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 345
|
||||
ip daddr 10.99.0.15 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 346
|
||||
ip daddr 172.27.0.2 iifname != "br-4efe811b8402" counter packets 0 bytes 0 drop # handle 347
|
||||
ip daddr 10.99.0.16 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 348
|
||||
ip daddr 172.27.0.3 iifname != "br-4efe811b8402" counter packets 0 bytes 0 drop # handle 349
|
||||
ip daddr 10.10.0.2 iifname != "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 350
|
||||
ip daddr 10.13.0.2 iifname != "br-a35cbfd37253" counter packets 0 bytes 0 drop # handle 351
|
||||
ip daddr 172.30.0.2 iifname != "br-71bcae37092b" counter packets 0 bytes 0 drop # handle 352
|
||||
ip daddr 172.30.0.3 iifname != "br-71bcae37092b" counter packets 0 bytes 0 drop # handle 355
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 7676 counter packets 0 bytes 0 drop # handle 356
|
||||
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 357
|
||||
ip daddr 10.19.0.3 iifname != "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 358
|
||||
ip daddr 10.19.0.4 iifname != "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 359
|
||||
ip daddr 10.16.0.2 iifname != "br-618855db6757" counter packets 0 bytes 0 drop # handle 360
|
||||
ip daddr 10.1.0.6 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 361
|
||||
ip daddr 10.99.0.17 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 362
|
||||
ip daddr 10.17.0.2 iifname != "br-28584d053169" counter packets 0 bytes 0 drop # handle 363
|
||||
ip daddr 10.18.0.2 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 366
|
||||
ip daddr 10.18.0.3 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 367
|
||||
ip daddr 10.18.0.4 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 368
|
||||
ip daddr 10.9.0.2 iifname != "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 370
|
||||
ip daddr 172.31.0.2 iifname != "br-9891a93b5e9c" counter packets 0 bytes 0 drop # handle 371
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8945 counter packets 0 bytes 0 drop # handle 372
|
||||
}
|
||||
}
|
||||
table ip6 raw { # handle 6
|
||||
chain PREROUTING { # handle 1
|
||||
type filter hook prerouting priority raw; policy accept;
|
||||
ip6 daddr fd00:1::11 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 3
|
||||
ip6 daddr fd00:1::14 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 4
|
||||
ip6 daddr fd00:1::9 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 5
|
||||
ip6 daddr fd00:1::c iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 7
|
||||
ip6 daddr fd00:1::13 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 8
|
||||
ip6 daddr fd00:1::16 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 9
|
||||
ip6 daddr fd00:3::2 iifname != "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 38
|
||||
ip6 daddr fd00:4::2 iifname != "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 39
|
||||
ip6 daddr fd00:30::2 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 41
|
||||
ip6 daddr fd00:30::3 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 42
|
||||
ip6 daddr fd00:1::2 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 43
|
||||
ip6 daddr fd00:30::4 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 44
|
||||
ip6 daddr fd00:29::2 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 45
|
||||
ip6 daddr fd00:29::3 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 46
|
||||
ip6 daddr fd00:27::2 iifname != "br-87e08370adff" counter packets 0 bytes 0 drop # handle 47
|
||||
ip6 daddr fd00:28::2 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 48
|
||||
ip6 daddr fd00:28::3 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 49
|
||||
ip6 daddr fd00:20::2 iifname != "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 50
|
||||
ip6 daddr fd00:31::2 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 51
|
||||
ip6 daddr fd00:31::3 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 52
|
||||
ip6 daddr fd00:31::4 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 53
|
||||
ip6 daddr fd00:31::5 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 54
|
||||
ip6 daddr fd00:31::6 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 55
|
||||
ip6 daddr fd00:26::2 iifname != "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 56
|
||||
ip6 daddr fd00:24::2 iifname != "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 57
|
||||
ip6 daddr fd00:1::3 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 58
|
||||
ip6 daddr fd00:1::4 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 59
|
||||
ip6 daddr fd00:41::2 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 60
|
||||
ip6 daddr fd00:41::3 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 61
|
||||
ip6 daddr fd00:1::5 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 62
|
||||
ip6 daddr fd00:10::2 iifname != "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 63
|
||||
ip6 daddr fd00:16::2 iifname != "br-618855db6757" counter packets 0 bytes 0 drop # handle 64
|
||||
ip6 daddr fd00:1::6 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 65
|
||||
ip6 daddr fd00:17::2 iifname != "br-28584d053169" counter packets 0 bytes 0 drop # handle 66
|
||||
ip6 daddr fd00:18::2 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 67
|
||||
ip6 daddr fd00:18::3 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 68
|
||||
ip6 daddr fd00:18::4 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 69
|
||||
ip6 daddr fd00:9::2 iifname != "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 71
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
2026-07-12T20:24:21-04:00
|
||||
TITANSERVER
|
||||
Linux TITANSERVER 7.1.3-zen1-2-zen #1 ZEN SMP PREEMPT_DYNAMIC Thu, 09 Jul 2026 20:39:38 +0000 x86_64 GNU/Linux
|
||||
|
||||
=== user@1200 ===
|
||||
LoadState=loaded
|
||||
ActiveState=inactive
|
||||
SubState=dead
|
||||
FragmentPath=/usr/lib/systemd/system/user@.service
|
||||
DropInPaths=/usr/lib/systemd/system/user@.service.d/10-login-barrier.conf
|
||||
Result=success
|
||||
|
||||
=== linger ===
|
||||
linger=absent
|
||||
|
||||
=== UID 1200 processes ===
|
||||
none
|
||||
|
||||
=== runtime directory/socket ===
|
||||
stat: cannot statx '/run/user/1200': No such file or directory
|
||||
stat: cannot statx '/run/user/1200/docker.sock': No such file or directory
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
docker 1:29.6.1-1
|
||||
containerd 2.3.2-1
|
||||
docker-compose 5.3.1-1
|
||||
rootlesskit 3.0.1-1
|
||||
slirp4netns 1.3.4-1
|
||||
libslirp 4.9.3-1
|
||||
openai-codex 0.144.1-2
|
||||
Client:
|
||||
Version: 29.6.1
|
||||
API version: 1.55
|
||||
Go version: go1.26.4-X:nodwarf5
|
||||
Git commit: 8900f1d330
|
||||
Built: Sun Jun 28 16:44:00 2026
|
||||
OS/Arch: linux/amd64
|
||||
Context: default
|
||||
|
||||
Server:
|
||||
Engine:
|
||||
Version: 29.6.1
|
||||
API version: 1.55 (minimum version 1.40)
|
||||
Go version: go1.26.4-X:nodwarf5
|
||||
Git commit: 8ec5ab355a
|
||||
Built: Sun Jun 28 16:44:00 2026
|
||||
OS/Arch: linux/amd64
|
||||
Experimental: false
|
||||
containerd:
|
||||
Version: v2.3.2
|
||||
GitCommit: fff62f14765df376e5fc36f5a8f8e795b5670f61.m
|
||||
nvidia:
|
||||
Version: 1.5.0
|
||||
GitCommit:
|
||||
docker-init:
|
||||
Version: 0.19.0
|
||||
GitCommit: de40ad0
|
||||
rootlesskit version 3.0.1
|
||||
slirp4netns version 1.3.4
|
||||
commit: unknown
|
||||
libslirp: 4.9.3
|
||||
SLIRP_CONFIG_VERSION_MAX: 6
|
||||
libseccomp: 2.6.0
|
||||
codex-cli 0.144.1
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
user::rwx
|
||||
group::r-x
|
||||
other::---
|
||||
|
||||
user::rwx
|
||||
group::---
|
||||
other::---
|
||||
|
||||
user::rwx
|
||||
group::---
|
||||
other::---
|
||||
|
||||
user::r-x
|
||||
group::r-x
|
||||
other::---
|
||||
|
||||
user::rwx
|
||||
group::r-x
|
||||
other::---
|
||||
|
||||
user::rwx
|
||||
group::---
|
||||
other::---
|
||||
|
||||
user::rwx
|
||||
group::---
|
||||
other::---
|
||||
|
||||
user::rwx
|
||||
group::---
|
||||
other::---
|
||||
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
/srv/le-app-codex|uid=0|gid=1200|mode=750|type=d
|
||||
/srv/le-app-codex/home|uid=1200|gid=1200|mode=700|type=d
|
||||
/srv/le-app-codex/lasereverything.net.db|uid=1200|gid=1200|mode=700|type=d
|
||||
/srv/le-app-codex/database-source-readonly|uid=0|gid=1200|mode=550|type=d
|
||||
/srv/le-app-codex/nonproduction-secrets|uid=0|gid=1200|mode=750|type=d
|
||||
/srv/le-app-codex/container-runtime|uid=1200|gid=1200|mode=700|type=d
|
||||
/srv/le-app-codex/testing-data|uid=1200|gid=1200|mode=700|type=d
|
||||
/srv/le-app-codex/build-artifacts|uid=1200|gid=1200|mode=700|type=d
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
# Phase 2B IPv4-only public DNS; no LAN resolver exception.
|
||||
nameserver 9.9.9.9
|
||||
nameserver 149.112.112.112
|
||||
options edns0 trust-ad
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
table inet le_app_codex {
|
||||
set approved_dns4 {
|
||||
type ipv4_addr
|
||||
flags interval
|
||||
elements = { 9.9.9.9, 149.112.112.112 }
|
||||
}
|
||||
|
||||
set operator_host_public4 {
|
||||
type ipv4_addr
|
||||
flags interval
|
||||
elements = { 74.67.173.56 }
|
||||
}
|
||||
|
||||
set denied4 {
|
||||
type ipv4_addr
|
||||
flags interval
|
||||
elements = {
|
||||
0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8,
|
||||
169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24,
|
||||
192.0.2.0/24, 192.88.99.0/24, 192.168.0.0/16,
|
||||
198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24,
|
||||
224.0.0.0/4, 240.0.0.0/4
|
||||
}
|
||||
}
|
||||
|
||||
chain input {
|
||||
type filter hook input priority filter; policy accept;
|
||||
iifname "lecodex-host" ct state established,related accept
|
||||
iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
|
||||
iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
|
||||
iifname "lecodex-host" counter drop
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy accept;
|
||||
oifname "lecodex-host" ct state established,related accept
|
||||
oifname "lecodex-host" counter drop
|
||||
iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
|
||||
iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
|
||||
iifname "lecodex-host" ip daddr @operator_host_public4 counter drop
|
||||
iifname "lecodex-host" ip daddr @denied4 counter drop
|
||||
iifname "lecodex-host" meta nfproto ipv6 counter drop
|
||||
iifname "lecodex-host" tcp dport { 25, 465, 587 } counter drop
|
||||
iifname "lecodex-host" tcp dport { 80, 443 } accept
|
||||
iifname "lecodex-host" counter drop
|
||||
}
|
||||
}
|
||||
|
||||
table ip le_app_codex_nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
ip saddr 10.200.120.0/30 oifname != "lecodex-host" masquerade
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
[Unit]
|
||||
Description=Root-owned IPv4-only namespace for le_app_codex
|
||||
Before=user@1200.service
|
||||
ConditionPathExists=/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/usr/local/libexec/le-app-codex-netns up
|
||||
ExecStop=/usr/local/libexec/le-app-codex-netns down
|
||||
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
[Slice]
|
||||
CPUQuota=600%
|
||||
MemoryHigh=48G
|
||||
MemoryMax=64G
|
||||
MemorySwapMax=16G
|
||||
TasksMax=4096
|
||||
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
[Unit]
|
||||
Requires=le-app-codex-netns.service
|
||||
After=le-app-codex-netns.service
|
||||
|
||||
[Service]
|
||||
NetworkNamespacePath=/run/netns/le-app-codex
|
||||
ProtectSystem=strict
|
||||
PrivateTmp=yes
|
||||
ProtectHome=yes
|
||||
ProtectProc=invisible
|
||||
ProcSubset=all
|
||||
BindReadOnlyPaths=/etc/le-app-codex-runtime/resolv.conf:/etc/resolv.conf
|
||||
TemporaryFileSystem=/srv:ro
|
||||
BindPaths=/srv/le-app-codex:/srv/le-app-codex
|
||||
TemporaryFileSystem=/var:ro
|
||||
TemporaryFileSystem=/mnt:ro
|
||||
TemporaryFileSystem=/media:ro
|
||||
TemporaryFileSystem=/opt:ro
|
||||
InaccessiblePaths=/var/www
|
||||
InaccessiblePaths=/root
|
||||
InaccessiblePaths=/home
|
||||
InaccessiblePaths=/boot
|
||||
InaccessiblePaths=/efi
|
||||
InaccessiblePaths=/run/docker.sock
|
||||
InaccessiblePaths=/var/run/docker.sock
|
||||
InaccessiblePaths=/run/containerd/containerd.sock
|
||||
InaccessiblePaths=/run/podman
|
||||
InaccessiblePaths=/run/dbus/system_bus_socket
|
||||
InaccessiblePaths=/run/systemd/private
|
||||
InaccessiblePaths=/var/lib/docker
|
||||
InaccessiblePaths=/var/lib/containerd
|
||||
InaccessiblePaths=/var/lib/containers
|
||||
InaccessiblePaths=/etc/docker
|
||||
InaccessiblePaths=/etc/containers
|
||||
InaccessiblePaths=/etc/ssh
|
||||
InaccessiblePaths=/etc/NetworkManager/system-connections
|
||||
InaccessiblePaths=/etc/wireguard
|
||||
DevicePolicy=closed
|
||||
DeviceAllow=/dev/fuse rw
|
||||
DeviceAllow=/dev/net/tun rw
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"data-root": "/srv/le-app-codex/container-runtime/docker",
|
||||
"storage-driver": "fuse-overlayfs",
|
||||
"live-restore": false,
|
||||
"userland-proxy": false,
|
||||
"ipv6": false,
|
||||
"ip6tables": false,
|
||||
"iptables": true,
|
||||
"hosts": ["unix:///run/user/1200/docker.sock"],
|
||||
"log-driver": "local",
|
||||
"log-opts": {
|
||||
"max-size": "20m",
|
||||
"max-file": "5"
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
[Unit]
|
||||
Description=Laser Everything rootless Docker
|
||||
Documentation=https://docs.docker.com/engine/security/rootless/
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
NotifyAccess=all
|
||||
KillMode=mixed
|
||||
Environment=HOME=/srv/le-app-codex/home
|
||||
Environment=XDG_RUNTIME_DIR=/run/user/1200
|
||||
Environment=DOCKER_HOST=unix:///run/user/1200/docker.sock
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR=/run/user/1200/dockerd-rootless
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=builtin
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=65520
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX=true
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=true
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK=true
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS=false
|
||||
ExecStart=/usr/local/libexec/dockerd-rootless-29.6.1.sh
|
||||
ExecReload=/usr/bin/kill -s HUP $MAINPID
|
||||
Restart=always
|
||||
RestartSec=2
|
||||
TimeoutStartSec=0
|
||||
TimeoutStopSec=120
|
||||
LimitNOFILE=infinity
|
||||
LimitNPROC=infinity
|
||||
LimitCORE=infinity
|
||||
TasksMax=infinity
|
||||
Delegate=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{
|
||||
"currentContext": "le-app-codex"
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"Name": "le-app-codex",
|
||||
"Metadata": {},
|
||||
"Endpoints": {
|
||||
"docker": {
|
||||
"Host": "unix:///run/user/1200/docker.sock",
|
||||
"SkipTLSVerify": false
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,255 @@
|
|||
#!/bin/sh
|
||||
# dockerd-rootless.sh executes dockerd in rootless mode.
|
||||
#
|
||||
# Usage: dockerd-rootless.sh [DOCKERD_OPTIONS]
|
||||
#
|
||||
# External dependencies:
|
||||
# * newuidmap and newgidmap needs to be installed.
|
||||
# * /etc/subuid and /etc/subgid needs to be configured for the current user.
|
||||
#
|
||||
# Recognized environment variables:
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR=DIR: the rootlesskit state dir.
|
||||
# * Defaults to "$XDG_RUNTIME_DIR/dockerd-rootless".
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_NET=(slirp4netns|vpnkit|pasta|gvisor-tap-vsock|lxc-user-nic): the rootlesskit network driver.
|
||||
# * Defaults to "slirp4netns" if slirp4netns (>= v0.4.0) is installed, else "pasta", else "vpnkit", else "gvisor-tap-vsock".
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=NUM: the MTU value for the rootlesskit network driver.
|
||||
# * Defaults to 65520 for slirp4netns, pasta, and gvisor-tap-vsock. Defaults to 1500 for other rootlesskit network drivers.
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=(builtin|slirp4netns|implicit|gvisor-tap-vsock): the rootlesskit port driver.
|
||||
# * Defaults to "implicit" for "pasta", "builtin" for other rootlesskit network drivers.
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX=(auto|true|false): whether to protect slirp4netns with a dedicated mount namespace.
|
||||
# * Defaults to "auto".
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=(auto|true|false): whether to protect slirp4netns with seccomp.
|
||||
# * Defaults to "auto".
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK=(true|false): prohibit connections to 127.0.0.1 on the host (including via 10.0.2.2, in the case of slirp4netns).
|
||||
# * Defaults to "true".
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS=(true|false): whether to launch rootlesskit with the "detach-netns" mode.
|
||||
# The "detached-netns" mode accelerates `docker (pull|push|build)` and enables `docker run --net=host`
|
||||
# Defaults to "true". Set this to false only when facing a compatibility issue.
|
||||
|
||||
# To apply an environment variable via systemd, create ~/.config/systemd/user/docker.service.d/override.conf as follows,
|
||||
# and run `systemctl --user daemon-reload && systemctl --user restart docker`:
|
||||
# --- BEGIN ---
|
||||
# [Service]
|
||||
# Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_NET=pasta"
|
||||
# Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=implicit"
|
||||
# --- END ---
|
||||
|
||||
# Guide to choose the network driver and the port driver:
|
||||
#
|
||||
# Network driver | Port driver | Net throughput | Port throughput | Src IP | No SUID | Note
|
||||
# -----------------|------------------|----------------|-----------------|--------|---------|---------------------------------------------------------
|
||||
# gvisor-tap-vsock | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Default when slirp4netns is not installed
|
||||
# slirp4netns | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Default when slirp4netns is installed
|
||||
# vpnkit | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Legacy
|
||||
# gvisor-tap-vsock | gvisor-tap-vsock | Slow | Slow | ❌ | ✅ | Not recommended. Use `builtin` port driver instead.
|
||||
# slirp4netns | slirp4netns | Slow | Slow | ✅ | ✅ |
|
||||
# pasta | implicit | Slow | Fast ✅ | ✅ | ✅ | Experimental; Needs recent version of pasta (2023_12_04)
|
||||
# lxc-user-nic | builtin | Fast ✅ | Fast ✅ | ✅ (*) | ❌ | Experimental
|
||||
# (bypass4netns) | (bypass4netns) | Fast ✅ | Fast ✅ | ✅ | ✅ | (Not integrated to RootlessKit)
|
||||
#
|
||||
# (*) Applicable since RootlessKit v3.0. Also requires userland-proxy to be disabled.
|
||||
|
||||
# See the documentation for the further information: https://docs.docker.com/go/rootless/
|
||||
|
||||
set -e -x
|
||||
case "$1" in
|
||||
"check" | "install" | "uninstall")
|
||||
echo "Did you mean 'dockerd-rootless-setuptool.sh $@' ?"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
if ! [ -w "$XDG_RUNTIME_DIR" ]; then
|
||||
echo "XDG_RUNTIME_DIR needs to be set and writable"
|
||||
exit 1
|
||||
fi
|
||||
if ! [ -d "$HOME" ]; then
|
||||
echo "HOME needs to be set and exist."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mount_directory() {
|
||||
if [ -z "$_DOCKERD_ROOTLESS_CHILD" ]; then
|
||||
echo "mount_directory should be called from the child context. Otherwise data loss is at risk" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
DIRECTORY="$1"
|
||||
if [ ! -d "$DIRECTORY" ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
# Bind mount directory: this makes this directory visible to
|
||||
# Dockerd, even if it is originally a symlink, given Dockerd does
|
||||
# not always follow symlinks. Some directories might also be
|
||||
# "copied-up", meaning that they will also be writable on the child
|
||||
# namespace; this will be the case only if they are provided as
|
||||
# --copy-up to the rootlesskit.
|
||||
DIRECTORY_REALPATH=$(realpath "$DIRECTORY")
|
||||
MOUNT_OPTIONS="${2:---bind}"
|
||||
rm -rf "$DIRECTORY"
|
||||
mkdir -p "$DIRECTORY"
|
||||
mount $MOUNT_OPTIONS "$DIRECTORY_REALPATH" "$DIRECTORY"
|
||||
}
|
||||
|
||||
rootlesskit=""
|
||||
for f in docker-rootlesskit rootlesskit; do
|
||||
if command -v $f > /dev/null 2>&1; then
|
||||
rootlesskit=$f
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [ -z "$rootlesskit" ]; then
|
||||
echo "rootlesskit needs to be installed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
: "${CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR:=$XDG_RUNTIME_DIR/containerd-rootless}"
|
||||
if [ -e "$CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR" ]; then
|
||||
# https://github.com/moby/moby/issues/52171
|
||||
echo "dockerd-rootless.sh conflicts with containerd-rootless.sh. Stop containerd-rootless.sh if it's running, and remove $CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR if it still exists."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR:=$XDG_RUNTIME_DIR/dockerd-rootless}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:=}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:=}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER:=}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX:=auto}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP:=auto}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK:=}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS:=true}"
|
||||
net=$DOCKERD_ROOTLESS_ROOTLESSKIT_NET
|
||||
port_driver=$DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER
|
||||
mtu=$DOCKERD_ROOTLESS_ROOTLESSKIT_MTU
|
||||
if [ -z "$net" ]; then
|
||||
if command -v slirp4netns > /dev/null 2>&1; then
|
||||
# If --netns-type is present in --help, slirp4netns is >= v0.4.0.
|
||||
if slirp4netns --help | grep -qw -- --netns-type; then
|
||||
net=slirp4netns
|
||||
else
|
||||
echo "slirp4netns found but seems older than v0.4.0. Checking for other network drivers."
|
||||
fi
|
||||
fi
|
||||
if [ -z "$net" ]; then
|
||||
if command -v pasta > /dev/null 2>&1; then
|
||||
net=pasta
|
||||
fi
|
||||
fi
|
||||
if [ -z "$net" ]; then
|
||||
if command -v vpnkit > /dev/null 2>&1; then
|
||||
net=vpnkit
|
||||
fi
|
||||
fi
|
||||
if [ -z "$net" ]; then
|
||||
net=gvisor-tap-vsock
|
||||
fi
|
||||
fi
|
||||
if [ "$net" = host ]; then
|
||||
echo "Unsupported RootlessKit network driver: $net"
|
||||
exit 1
|
||||
fi
|
||||
if [ -z "$mtu" ]; then
|
||||
case "$net" in
|
||||
slirp4netns | pasta | gvisor-tap-vsock)
|
||||
mtu=65520
|
||||
;;
|
||||
*)
|
||||
mtu=1500
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
if [ -z "$port_driver" ]; then
|
||||
if [ "$net" = pasta ]; then
|
||||
port_driver=implicit
|
||||
else
|
||||
port_driver=builtin
|
||||
fi
|
||||
fi
|
||||
|
||||
host_loopback="--disable-host-loopback"
|
||||
if [ "$DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK" = "false" ]; then
|
||||
host_loopback=""
|
||||
fi
|
||||
|
||||
dockerd="${DOCKERD:-dockerd}"
|
||||
|
||||
if [ -z "$_DOCKERD_ROOTLESS_CHILD" ]; then
|
||||
_DOCKERD_ROOTLESS_CHILD=1
|
||||
export _DOCKERD_ROOTLESS_CHILD
|
||||
if [ "$(id -u)" = "0" ]; then
|
||||
echo "This script must be executed as a non-privileged user"
|
||||
exit 1
|
||||
fi
|
||||
# `selinuxenabled` always returns false in RootlessKit child, so we execute `selinuxenabled` in the parent.
|
||||
# https://github.com/rootless-containers/rootlesskit/issues/94
|
||||
if command -v selinuxenabled > /dev/null 2>&1 && selinuxenabled; then
|
||||
_DOCKERD_ROOTLESS_SELINUX=1
|
||||
export _DOCKERD_ROOTLESS_SELINUX
|
||||
fi
|
||||
|
||||
case "$DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS" in
|
||||
1 | true)
|
||||
DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="--detach-netns $DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS"
|
||||
;;
|
||||
0 | false)
|
||||
# NOP
|
||||
;;
|
||||
*)
|
||||
echo "Unknown DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS value: $DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Re-exec the script via RootlessKit, so as to create unprivileged {user,mount,network} namespaces.
|
||||
#
|
||||
# --copy-up allows removing/creating files in the directories by creating tmpfs and symlinks
|
||||
# * /etc: copy-up is required so as to prevent `/etc/resolv.conf` in the
|
||||
# namespace from being unexpectedly unmounted when `/etc/resolv.conf` is recreated on the host
|
||||
# (by either systemd-networkd or NetworkManager)
|
||||
# * /run: copy-up is required so that we can create /run/docker (hardcoded for plugins) in our namespace
|
||||
exec $rootlesskit \
|
||||
--state-dir=$DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR \
|
||||
--net=$net --mtu=$mtu \
|
||||
--slirp4netns-sandbox=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX \
|
||||
--slirp4netns-seccomp=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP \
|
||||
$host_loopback --port-driver=$port_driver \
|
||||
--copy-up=/etc --copy-up=/run \
|
||||
--propagation=rslave \
|
||||
$DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS \
|
||||
"$0" "$@"
|
||||
else
|
||||
[ "$_DOCKERD_ROOTLESS_CHILD" = 1 ]
|
||||
|
||||
# remove the symlinks for the existing files in the parent namespace if any,
|
||||
# so that we can create our own files in our mount namespace.
|
||||
rm -f /run/docker /run/containerd /run/xtables.lock
|
||||
|
||||
if [ -n "$_DOCKERD_ROOTLESS_SELINUX" ]; then
|
||||
# iptables requires /run in the child to be relabeled. The actual /run in the parent is unaffected.
|
||||
# https://github.com/containers/podman/blob/e6fc34b71aa9d876b1218efe90e14f8b912b0603/libpod/networking_linux.go#L396-L401
|
||||
# https://github.com/moby/moby/issues/41230
|
||||
chcon system_u:object_r:iptables_var_run_t:s0 /run
|
||||
fi
|
||||
|
||||
if [ "$(stat -c %T -f /etc)" = "tmpfs" ] && [ -L "/etc/ssl" ]; then
|
||||
# Workaround for "x509: certificate signed by unknown authority" on openSUSE Tumbleweed.
|
||||
# https://github.com/rootless-containers/rootlesskit/issues/225
|
||||
mount_directory /etc/ssl "--rbind"
|
||||
fi
|
||||
|
||||
netns="/proc/self/ns/net"
|
||||
case "$DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS" in
|
||||
1 | true)
|
||||
netns="$ROOTLESSKIT_STATE_DIR/netns"
|
||||
;;
|
||||
esac
|
||||
# When running with --firewall-backend=nftables, IP forwarding needs to be enabled
|
||||
# because the daemon won't enable it. IP forwarding is harmless in the rootless
|
||||
# netns, there's only a single external interface and only Docker uses the netns.
|
||||
# So, always enable IPv4 and IPv6 forwarding. But ignore failure to enable IPv6
|
||||
# forwarding, for hosts with IPv6 disabled.
|
||||
nsenter -n"$netns" sysctl -w net.ipv4.ip_forward=1
|
||||
nsenter -n"$netns" sysctl -w net.ipv6.conf.all.forwarding=1 || true
|
||||
|
||||
exec "$dockerd" "$@"
|
||||
fi
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
NS=le-app-codex
|
||||
HOST_IF=lecodex-host
|
||||
NS_IF=lecodex-ns
|
||||
|
||||
down() {
|
||||
/usr/bin/nft delete table inet le_app_codex 2>/dev/null || true
|
||||
/usr/bin/nft delete table ip le_app_codex_nat 2>/dev/null || true
|
||||
/usr/bin/ip link delete "$HOST_IF" 2>/dev/null || true
|
||||
/usr/bin/ip netns delete "$NS" 2>/dev/null || true
|
||||
}
|
||||
|
||||
case "${1:-}" in
|
||||
up)
|
||||
test "$(id -u)" -eq 0
|
||||
test -r /etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
|
||||
/usr/bin/grep -q 'elements = { 9\.9\.9\.9, 149\.112\.112\.112 }' /etc/nftables.d/50-le-app-codex.nft
|
||||
/usr/bin/grep -q 'elements = { 74\.67\.173\.56 }' /etc/nftables.d/50-le-app-codex.nft
|
||||
test ! -e /run/netns/$NS
|
||||
! /usr/bin/nft list table inet le_app_codex >/dev/null 2>&1
|
||||
! /usr/bin/nft list table ip le_app_codex_nat >/dev/null 2>&1
|
||||
trap down EXIT HUP INT TERM
|
||||
/usr/bin/ip netns add "$NS"
|
||||
/usr/bin/ip link add "$HOST_IF" type veth peer name "$NS_IF"
|
||||
/usr/bin/ip link set "$NS_IF" netns "$NS"
|
||||
/usr/bin/ip address add 10.200.120.1/30 dev "$HOST_IF"
|
||||
/usr/bin/ip link set "$HOST_IF" up
|
||||
/usr/bin/ip -n "$NS" link set lo up
|
||||
/usr/bin/ip -n "$NS" address add 10.200.120.2/30 dev "$NS_IF"
|
||||
/usr/bin/ip -n "$NS" link set "$NS_IF" up
|
||||
/usr/bin/ip -n "$NS" route add default via 10.200.120.1 dev "$NS_IF"
|
||||
/usr/bin/ip netns exec "$NS" /usr/bin/sysctl -q -w net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1
|
||||
/usr/bin/nft -f /etc/nftables.d/50-le-app-codex.nft
|
||||
trap - EXIT HUP INT TERM
|
||||
;;
|
||||
down) down ;;
|
||||
*) echo 'usage: le-app-codex-netns up|down' >&2; exit 64 ;;
|
||||
esac
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
#!/bin/sh
|
||||
set -eu
|
||||
test "$(id -u)" -eq 0
|
||||
test "$(docker version --format '{{.Server.Version}}')" = 29.6.1
|
||||
test "$(sha256sum payload/usr/local/libexec/dockerd-rootless-29.6.1.sh | cut -d' ' -f1)" = 904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46
|
||||
test ! -S /run/user/1200/docker.sock
|
||||
test "$(systemctl show user@1200.service -p ActiveState --value)" = inactive
|
||||
test ! -e /var/lib/systemd/linger/le_app_codex
|
||||
test -z "$(pgrep -u 1200 || true)"
|
||||
test ! -e /run/netns/le-app-codex
|
||||
test ! -e /etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf
|
||||
test ! -e /etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf
|
||||
docker network inspect $(docker network ls -q) --format '{{.Name}} {{range .IPAM.Config}}{{.Subnet}} {{end}}'
|
||||
ip -brief address
|
||||
ip -4 route show table all
|
||||
ip -6 route show table all
|
||||
sed -n '1,120p' /etc/resolv.conf
|
||||
nft --numeric list ruleset
|
||||
systemctl cat user@1200.service
|
||||
loginctl show-user 1200 || true
|
||||
namei -om /srv/le-app-codex
|
||||
find /srv/le-app-codex -xdev -printf '%M %u:%g %p\n'
|
||||
getfacl -R -p /srv/le-app-codex
|
||||
findmnt -R /srv/le-app-codex
|
||||
grep -q 'elements = { 9\.9\.9\.9, 149\.112\.112\.112 }' payload/etc/nftables.d/50-le-app-codex.nft
|
||||
grep -q 'elements = { 74\.67\.173\.56 }' payload/etc/nftables.d/50-le-app-codex.nft
|
||||
grep -q '^nameserver 9\.9\.9\.9$' payload/etc/le-app-codex-runtime/resolv.conf
|
||||
grep -q '^nameserver 149\.112\.112\.112$' payload/etc/le-app-codex-runtime/resolv.conf
|
||||
|
|
@ -0,0 +1,101 @@
|
|||
#!/bin/sh
|
||||
|
||||
failures=0
|
||||
artifact_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." 2>/dev/null && pwd)
|
||||
|
||||
pass() { printf 'PASS: %s\n' "$1"; }
|
||||
fail() { printf 'FAIL: %s\n' "$1" >&2; failures=$((failures + 1)); }
|
||||
run_check() {
|
||||
label=$1
|
||||
shift
|
||||
if "$@"; then pass "$label"; else fail "$label"; fi
|
||||
}
|
||||
expect_stat() {
|
||||
path=$1 expected=$2
|
||||
actual=$(/usr/bin/stat -c '%u:%g:%a:%F' "$path" 2>/dev/null)
|
||||
if [ "$actual" = "$expected" ]; then pass "$path ownership/mode"; else fail "$path expected $expected, got ${actual:-missing}"; fi
|
||||
}
|
||||
expect_absent() {
|
||||
path=$1
|
||||
if [ ! -e "$path" ] && [ ! -L "$path" ]; then pass "$path absent"; else fail "$path must not already exist"; fi
|
||||
}
|
||||
|
||||
if [ "$(id -u)" = 0 ]; then pass 'running as root'; else fail 'must be run as root'; fi
|
||||
if [ -n "$artifact_root" ] && [ -d "$artifact_root/payload" ]; then pass 'artifact root resolved'; else fail 'artifact root not found'; fi
|
||||
|
||||
if (cd "$artifact_root" && /usr/bin/sha256sum -c MANIFEST.sha256); then pass 'complete artifact manifest'; else fail 'complete artifact manifest'; fi
|
||||
if (cd "$artifact_root/inventory" && /usr/bin/sha256sum -c SHA256SUMS); then pass 'original root inventory'; else fail 'original root inventory'; fi
|
||||
|
||||
run_check 'staged nftables syntax' /usr/bin/nft --check -f "$artifact_root/payload/etc/nftables.d/50-le-app-codex.nft"
|
||||
|
||||
system_unit_path="$artifact_root/payload/etc/systemd/system:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:/usr/lib/systemd/system"
|
||||
systemd_output=$(SYSTEMD_UNIT_PATH="$system_unit_path" /usr/bin/systemd-analyze verify --recursive-errors=no user@1200.service user-1200.slice le-app-codex-netns.service 2>&1)
|
||||
systemd_rc=$?
|
||||
printf '%s\n' "$systemd_output"
|
||||
systemd_unexpected=$(printf '%s\n' "$systemd_output" | /usr/bin/sed -e '\#le-app-codex-netns.service: Command /usr/local/libexec/le-app-codex-netns is not executable: No such file or directory#d')
|
||||
if [ "$systemd_rc" -eq 0 ] || [ -z "$systemd_unexpected" ]; then pass 'staged system units/drop-ins via host search path'; else fail 'staged system units/drop-ins via host search path'; fi
|
||||
|
||||
user_unit_path="$artifact_root/payload/srv/le-app-codex/home/.config/systemd/user:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/lib/systemd/user"
|
||||
user_systemd_output=$(SYSTEMD_UNIT_PATH="$user_unit_path" /usr/bin/systemd-analyze verify --recursive-errors=no docker.service 2>&1)
|
||||
user_systemd_rc=$?
|
||||
printf '%s\n' "$user_systemd_output"
|
||||
user_systemd_unexpected=$(printf '%s\n' "$user_systemd_output" | /usr/bin/sed -e '\#docker.service: Command /usr/local/libexec/dockerd-rootless-29.6.1.sh is not executable: No such file or directory#d')
|
||||
if [ "$user_systemd_rc" -eq 0 ] || [ -z "$user_systemd_unexpected" ]; then pass 'staged Docker user unit via host search path'; else fail 'staged Docker user unit via host search path'; fi
|
||||
|
||||
shell_failures=0
|
||||
for file in "$artifact_root"/tests/*.sh "$artifact_root"/payload/usr/local/libexec/*; do
|
||||
/bin/sh -n "$file" || shell_failures=$((shell_failures + 1))
|
||||
done
|
||||
if [ "$shell_failures" -eq 0 ]; then pass 'shell syntax'; else fail 'shell syntax'; fi
|
||||
|
||||
json_failures=0
|
||||
for file in "$artifact_root"/payload/srv/le-app-codex/home/.config/docker/daemon.json \
|
||||
"$artifact_root"/payload/srv/le-app-codex/home/.docker/config.json \
|
||||
"$artifact_root"/payload/srv/le-app-codex/home/.docker/contexts/meta/1b645e55bd6af77d420732b143423e7a27b12fbb5a71497e5d89c52481b6a535/meta.json \
|
||||
"$artifact_root"/inventory/docker-networks.json; do
|
||||
/usr/bin/jq empty "$file" || json_failures=$((json_failures + 1))
|
||||
done
|
||||
if [ "$json_failures" -eq 0 ]; then pass 'JSON syntax'; else fail 'JSON syntax'; fi
|
||||
|
||||
expect_stat /srv/le-app-codex '0:1200:750:directory'
|
||||
expect_stat /srv/le-app-codex/home '1200:1200:700:directory'
|
||||
expect_stat /srv/le-app-codex/lasereverything.net.db '1200:1200:700:directory'
|
||||
expect_stat /srv/le-app-codex/database-source-readonly '0:1200:550:directory'
|
||||
expect_stat /srv/le-app-codex/nonproduction-secrets '0:1200:750:directory'
|
||||
expect_stat /srv/le-app-codex/container-runtime '1200:1200:700:directory'
|
||||
expect_stat /srv/le-app-codex/testing-data '1200:1200:700:directory'
|
||||
expect_stat /srv/le-app-codex/build-artifacts '1200:1200:700:directory'
|
||||
|
||||
project_mounts=$(/usr/bin/findmnt -rn -o TARGET | /usr/bin/awk '$0 == "/srv/le-app-codex" || index($0, "/srv/le-app-codex/") == 1 { print }')
|
||||
if [ -z "$project_mounts" ]; then pass 'no project-rooted mounts'; else fail "unexpected project-rooted mounts: $project_mounts"; fi
|
||||
|
||||
expect_absent /etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
|
||||
expect_absent /etc/le-app-codex-runtime/resolv.conf
|
||||
expect_absent /etc/nftables.d/50-le-app-codex.nft
|
||||
expect_absent /etc/systemd/system/le-app-codex-netns.service
|
||||
expect_absent /etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf
|
||||
expect_absent /etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf
|
||||
expect_absent /usr/local/libexec/dockerd-rootless-29.6.1.sh
|
||||
expect_absent /usr/local/libexec/le-app-codex-netns
|
||||
expect_absent /srv/le-app-codex/home/.config/systemd/user/docker.service
|
||||
expect_absent /srv/le-app-codex/home/.config/docker/daemon.json
|
||||
expect_absent /srv/le-app-codex/home/.docker/config.json
|
||||
expect_absent /srv/le-app-codex/home/.docker/contexts/meta/1b645e55bd6af77d420732b143423e7a27b12fbb5a71497e5d89c52481b6a535/meta.json
|
||||
expect_absent /srv/le-app-codex/phase2b-tests/00-root-preinstall-validate.sh
|
||||
expect_absent /srv/le-app-codex/phase2b-tests/00-read-only-preflight.sh
|
||||
expect_absent /srv/le-app-codex/phase2b-tests/10-inert-containment.sh
|
||||
expect_absent /srv/le-app-codex/phase2b-tests/20-rootless-docker.sh
|
||||
expect_absent /srv/le-app-codex/phase2b-tests/run-inert-without-user-manager.sh
|
||||
|
||||
active_state=$(/usr/bin/systemctl show user@1200.service -p ActiveState --value 2>/dev/null)
|
||||
if [ "$active_state" = inactive ]; then pass 'user@1200.service inactive'; else fail "user@1200.service state is ${active_state:-unknown}"; fi
|
||||
if [ ! -e /var/lib/systemd/linger/le_app_codex ] && [ ! -e /var/lib/systemd/linger/1200 ]; then pass 'linger absent'; else fail 'linger present'; fi
|
||||
uid_processes=$(/usr/bin/pgrep -u 1200 2>/dev/null)
|
||||
if [ -z "$uid_processes" ]; then pass 'UID 1200 has no processes'; else fail "UID 1200 processes found: $uid_processes"; fi
|
||||
if [ ! -S /run/user/1200/docker.sock ]; then pass 'rootless Docker socket absent'; else fail 'rootless Docker socket exists'; fi
|
||||
|
||||
public_ipv4=$(/usr/bin/curl -4fsS --max-time 10 https://api.ipify.org 2>/dev/null)
|
||||
if [ "$public_ipv4" = 74.67.173.56 ]; then pass 'public/NAT IPv4 unchanged'; else fail "public/NAT IPv4 drift or lookup failure: ${public_ipv4:-unavailable}"; fi
|
||||
|
||||
printf 'root pre-install validation failures=%s\n' "$failures"
|
||||
[ "$failures" -eq 0 ]
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
#!/bin/sh
|
||||
set -eu
|
||||
fail=0
|
||||
expect_denied() { if "$@" >/dev/null 2>&1; then echo "UNEXPECTED SUCCESS: $*" >&2; fail=1; fi; }
|
||||
|
||||
test "$(id -u)" -eq 1200
|
||||
test "$DOCKER_HOST" = unix:///run/user/1200/docker.sock
|
||||
touch /srv/le-app-codex/tmp/phase2b-write-test
|
||||
rm /srv/le-app-codex/tmp/phase2b-write-test
|
||||
expect_denied ls /var/www
|
||||
expect_denied ls /root
|
||||
expect_denied ls /home
|
||||
expect_denied ls /srv/directus-archive
|
||||
expect_denied ls /srv/codex-work
|
||||
expect_denied stat /run/docker.sock
|
||||
expect_denied stat /var/run/docker.sock
|
||||
expect_denied stat /run/containerd/containerd.sock
|
||||
expect_denied stat /dev/sda
|
||||
expect_denied stat /proc/1/root
|
||||
expect_denied sh -c 'echo x > /etc/phase2b-write-test'
|
||||
expect_denied sh -c 'echo x > /srv/phase2b-write-test'
|
||||
expect_denied curl -4fsS --connect-timeout 2 http://127.0.0.1
|
||||
expect_denied curl -4fsS --connect-timeout 2 http://10.200.120.1
|
||||
expect_denied curl -4fsS --connect-timeout 2 http://192.168.10.151
|
||||
expect_denied nc -w2 -z 192.168.10.1 53
|
||||
expect_denied curl -4fsS --connect-timeout 2 http://10.98.0.2
|
||||
expect_denied curl -4fsS --connect-timeout 2 http://74.67.173.56
|
||||
expect_denied curl -4fsS --connect-timeout 2 http://169.254.169.254/latest/meta-data/
|
||||
expect_denied curl -6fsS --connect-timeout 2 https://[::1]/
|
||||
expect_denied nc -w2 -z 1.1.1.1 25
|
||||
expect_denied nc -w2 -z 1.1.1.1 465
|
||||
expect_denied nc -w2 -z 1.1.1.1 587
|
||||
test "$(ps -e --no-headers | wc -l)" -lt 32
|
||||
test -w /dev/fuse
|
||||
test -w /dev/net/tun
|
||||
grep -q '^nameserver 9\.9\.9\.9$' /etc/resolv.conf
|
||||
grep -q '^nameserver 149\.112\.112\.112$' /etc/resolv.conf
|
||||
getent ahostsv4 example.com >/dev/null
|
||||
test -r /sys/fs/cgroup/cpu.max
|
||||
test -r /sys/fs/cgroup/memory.max
|
||||
exit "$fail"
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
#!/bin/sh
|
||||
set -eu
|
||||
fail=0
|
||||
export HOME=/srv/le-app-codex/home
|
||||
export DOCKER_HOST=unix:///run/user/1200/docker.sock
|
||||
ALPINE='docker.io/library/alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659'
|
||||
NGINX='docker.io/library/nginx:1.29.4-alpine@sha256:4870c12cd2ca986de501a804b4f506ad3875a0b1874940ba0a2c7f763f1855b2'
|
||||
test "$(id -u)" -eq 1200
|
||||
test -S /run/user/1200/docker.sock
|
||||
test "$(docker context show)" = le-app-codex
|
||||
test "$(docker context inspect le-app-codex --format '{{.Endpoints.docker.Host}}')" = unix:///run/user/1200/docker.sock
|
||||
docker info --format '{{json .SecurityOptions}}' | grep -q rootless
|
||||
test "$(docker info --format '{{.DockerRootDir}}')" = /srv/le-app-codex/container-runtime/docker
|
||||
docker run --rm --network none "$ALPINE" true
|
||||
docker run --rm "$ALPINE" wget -qO- https://example.com >/dev/null
|
||||
for target in 127.0.0.1 10.200.120.1 192.168.10.1 192.168.10.151 10.98.0.2 74.67.173.56 169.254.169.254; do
|
||||
if docker run --rm "$ALPINE" wget -T2 -qO- "http://$target" >/dev/null 2>&1; then
|
||||
echo "UNEXPECTED CONTAINER ACCESS: $target" >&2; fail=1
|
||||
fi
|
||||
done
|
||||
if docker run --rm "$ALPINE" sh -c 'nc -w2 -z 1.1.1.1 25 || nc -w2 -z 1.1.1.1 465 || nc -w2 -z 1.1.1.1 587'; then
|
||||
echo 'UNEXPECTED CONTAINER SMTP ACCESS' >&2; fail=1
|
||||
fi
|
||||
cid=$(docker run -d --rm -p 18080:80 "$NGINX")
|
||||
trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
|
||||
sleep 2
|
||||
for host in 127.0.0.1 192.168.10.151 10.98.0.2; do
|
||||
if curl -fsS --connect-timeout 2 "http://$host:18080" >/dev/null 2>&1; then
|
||||
echo "UNEXPECTED PUBLISHED PORT: $host" >&2; fail=1
|
||||
fi
|
||||
done
|
||||
docker rm -f "$cid" >/dev/null
|
||||
trap - EXIT
|
||||
test ! -S /run/docker.sock || ! docker -H unix:///run/docker.sock info >/dev/null 2>&1
|
||||
exit "$fail"
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
#!/bin/sh
|
||||
set -eu
|
||||
test "$(id -u)" -eq 0
|
||||
test "$(systemctl is-active user@1200.service || true)" = inactive
|
||||
systemd-run --wait --pipe --collect --unit=le-app-codex-inert-test \
|
||||
--uid=1200 --gid=1200 \
|
||||
--setenv=DOCKER_HOST=unix:///run/user/1200/docker.sock \
|
||||
--property=NetworkNamespacePath=/run/netns/le-app-codex \
|
||||
--property=ProtectSystem=strict --property=PrivateTmp=yes \
|
||||
--property=ProtectHome=yes --property=ProtectProc=invisible \
|
||||
--property=TemporaryFileSystem=/srv:ro \
|
||||
--property=BindPaths=/srv/le-app-codex:/srv/le-app-codex \
|
||||
--property=TemporaryFileSystem=/var:ro \
|
||||
--property=TemporaryFileSystem=/mnt:ro \
|
||||
--property=TemporaryFileSystem=/media:ro \
|
||||
--property=TemporaryFileSystem=/opt:ro \
|
||||
--property=DevicePolicy=closed --property='DeviceAllow=/dev/fuse rw' \
|
||||
--property='DeviceAllow=/dev/net/tun rw' \
|
||||
/srv/le-app-codex/phase2b-tests/10-inert-containment.sh
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue