Deployed 6ac0c67 with MkDocs version: 1.5.3

manual/kinds/bridge/index.html

@@ -34,8 +34,12 @@
 </span><span id=__span-1-2><a id=__codelineno-1-2 name=__codelineno-1-2 href=#__codelineno-1-2></a>br-clab         8000.6281eb7133d2       no              eth1
 </span><span id=__span-1-3><a id=__codelineno-1-3 name=__codelineno-1-3 href=#__codelineno-1-3></a>                                                        eth2
 </span><span id=__span-1-4><a id=__codelineno-1-4 name=__codelineno-1-4 href=#__codelineno-1-4></a>                                                        eth3
-</span></code></pre></div> <p>Containerlab automatically adds iptables rules for the referenced bridges (v4 and v6) to allow traffic ingressing to the bridges. Namely, for a given bridge named <code>br-clab</code> containerlab will attempt to create the allowing rule in the filter table, FORWARD chain like this:</p> <div class="language-text highlight"><pre><span></span><code><span id=__span-2-1><a id=__codelineno-2-1 name=__codelineno-2-1 href=#__codelineno-2-1></a>iptables -I FORWARD -i br-clab -j ACCEPT
-</span></code></pre></div> <p>This will ensure that traffic is forwarded when passing this particular bridge. Note, that once you destroy the lab, the rule will stay, if you wish to remove it, you will have to do it manually.</p> <p>Check out <a href=../../../lab-examples/ext-bridge/ >"External bridge"</a> lab for a ready-made example on how to use bridges.</p> <!-- Content footer --> <footer class="mdx-content__footer md-typeset"> <hr> <span class=twemoji> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.5.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2023 Fonticons, Inc.--><path d="M288 0H128c-17.7 0-32 14.3-32 32s14.3 32 32 32v132.8c0 11.8-3.3 23.5-9.5 33.5L10.3 406.2C3.6 417.2 0 429.7 0 442.6 0 480.9 31.1 512 69.4 512h309.2c38.3 0 69.4-31.1 69.4-69.4 0-12.8-3.6-25.4-10.3-36.4L329.5 230.4c-6.2-10.1-9.5-21.7-9.5-33.5V64c17.7 0 32-14.3 32-32S337.7 0 320 0h-32zm-96 196.8V64h64v132.8c0 23.7 6.6 46.9 19 67.1l34.5 56.1h-171l34.5-56.1c12.4-20.2 19-43.4 19-67.1z"/></svg> </span> <hr> </footer> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type=button class="md-top md-icon" data-md-component=top hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8v12Z"/></svg> Back to top </button> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <!--
+</span></code></pre></div> <p>Containerlab automatically adds iptables rules for the referenced bridges (v4 and v6) to allow traffic ingressing/egressing to/from the bridges. Namely, for a given bridge named <code>br-clab</code> containerlab will attempt to create the allowing rule in the filter table, FORWARD chain like this:</p> <div class="language-text highlight"><pre><span></span><code><span id=__span-2-1><a id=__codelineno-2-1 name=__codelineno-2-1 href=#__codelineno-2-1></a>iptables -I FORWARD -i br-clab -j ACCEPT
+</span><span id=__span-2-2><a id=__codelineno-2-2 name=__codelineno-2-2 href=#__codelineno-2-2></a>iptables -I FORWARD -o br-clab -j ACCEPT
+</span></code></pre></div> <p>This will ensure that traffic is forwarded when passing this particular bridge.</p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>Once you destroy the lab, the rules in the FORWARD chain will stay, if you wish to remove it, you will have to do it manually. For example the with the following script (for v4 family):</p> <div class="language-text highlight"><pre><span></span><code><span id=__span-3-1><a id=__codelineno-3-1 name=__codelineno-3-1 href=#__codelineno-3-1></a>sudo iptables -vL FORWARD --line-numbers -n | \
+</span><span id=__span-3-2><a id=__codelineno-3-2 name=__codelineno-3-2 href=#__codelineno-3-2></a>grep &quot;set by containerlab&quot; | awk &#39;{print $1}&#39; \
+</span><span id=__span-3-3><a id=__codelineno-3-3 name=__codelineno-3-3 href=#__codelineno-3-3></a>| sort -r | xargs -I {} sudo iptables -D FORWARD {}
+</span></code></pre></div> </div> <p>Check out <a href=../../../lab-examples/ext-bridge/ >"External bridge"</a> lab for a ready-made example on how to use bridges.</p> <!-- Content footer --> <footer class="mdx-content__footer md-typeset"> <hr> <span class=twemoji> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.5.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2023 Fonticons, Inc.--><path d="M288 0H128c-17.7 0-32 14.3-32 32s14.3 32 32 32v132.8c0 11.8-3.3 23.5-9.5 33.5L10.3 406.2C3.6 417.2 0 429.7 0 442.6 0 480.9 31.1 512 69.4 512h309.2c38.3 0 69.4-31.1 69.4-69.4 0-12.8-3.6-25.4-10.3-36.4L329.5 230.4c-6.2-10.1-9.5-21.7-9.5-33.5V64c17.7 0 32-14.3 32-32S337.7 0 320 0h-32zm-96 196.8V64h64v132.8c0 23.7 6.6 46.9 19 67.1l34.5 56.1h-171l34.5-56.1c12.4-20.2 19-43.4 19-67.1z"/></svg> </span> <hr> </footer> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type=button class="md-top md-icon" data-md-component=top hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8v12Z"/></svg> Back to top </button> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <!--
   Copyright (c) 2016-2022 Martin Donath <[email protected]>
   Permission is hereby granted, free of charge, to any person obtaining a copy
   of this software and associated documentation files (the "Software"), to

manual/network/index.html

@@ -99,9 +99,10 @@
 </span></code></pre></div> <ol> <li>Container runtime will assign IP addresses from the <code>10.20.30.128/25</code> subnet, and <code>10.20.30.0/25</code> will not be considered.</li> <li>The subnet must be specified for IP ranges to work. Also note that if the container network already exists and uses a different range, then the IP range setting won't have effect.</li> </ol> <p>With this approach, users can prevent IP address overlap with nodes deployed on the same management network by other orchestration systems.</p> <h4 id=external-access>external access<a class=headerlink href=#external-access title="Permanent link">#</a></h4> <p>Containerlab will attempt to enable external management access to the nodes by default. This means that external systems/hosts will be able to communicate with the nodes of your topology without requiring any manual iptables/nftables rules to be installed.</p> <p>To allow external communications containerlab installs a rule in the <code>DOCKER-USER</code> chain for v4 and v6, allowing all packets targeting containerlab's management network. The rule looks like follows:</p> <div class="language-shell highlight"><pre><span></span><code><span id=__span-13-1><a id=__codelineno-13-1 name=__codelineno-13-1 href=#__codelineno-13-1></a>sudo<span class=w> </span>iptables<span class=w> </span>-vnL<span class=w> </span>DOCKER-USER
 </span></code></pre></div> <div class=embed-result> <div class="language-text no-select highlight"><pre><span></span><code><span id=__span-14-1><a id=__codelineno-14-1 name=__codelineno-14-1 href=#__codelineno-14-1></a>Chain DOCKER-USER (1 references)
 </span><span id=__span-14-2><a id=__codelineno-14-2 name=__codelineno-14-2 href=#__codelineno-14-2></a> pkts bytes target     prot opt in     out     source               destination
-</span><span id=__span-14-3><a id=__codelineno-14-3 name=__codelineno-14-3 href=#__codelineno-14-3></a>    0     0 ACCEPT     all  --  *      br-a8b9fc8b33a2  0.0.0.0/0            0.0.0.0/0            /* set by containerlab */
-</span><span id=__span-14-4><a id=__codelineno-14-4 name=__codelineno-14-4 href=#__codelineno-14-4></a>12719   79M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
-</span></code></pre></div> </div> <ol> <li>The <code>br-a8b9fc8b33a2</code> bridge interface is the interface that backs up the containerlab's management network (<code>clab</code> docker network).</li> </ol> <p>The rule will be removed together with the management network.</p> <div class="admonition tip"> <p class=admonition-title>RHEL 9 users</p> <p>By default RHEL 9 (and it's derivatives) will use <code>firewalld</code> as the <a href=https://access.redhat.com/solutions/7046655>default firewall</a>, containerlab's <code>iptables</code> and <code>nftables</code> rules will not work in this case and you will not have external access to your labs.</p> <p>To fix this you must disable <code>firewalld</code> and enable the <code>nftables</code> service. </p> <p><strong>Take caution when disabling firewalls, you may be exposing things you shouldn't</strong></p> <div class="language-text highlight"><pre><span></span><code><span id=__span-15-1><a id=__codelineno-15-1 name=__codelineno-15-1 href=#__codelineno-15-1></a>systemctl disable firewalld
+</span><span id=__span-14-3><a id=__codelineno-14-3 name=__codelineno-14-3 href=#__codelineno-14-3></a>    0     0 ACCEPT     0    --  br-1351328e1855 *       0.0.0.0/0            0.0.0.0/0            /* set by containerlab */
+</span><span id=__span-14-4><a id=__codelineno-14-4 name=__codelineno-14-4 href=#__codelineno-14-4></a>    0     0 ACCEPT     0    --  *      br-1351328e1855  0.0.0.0/0            0.0.0.0/0            /* set by containerlab */
+</span><span id=__span-14-5><a id=__codelineno-14-5 name=__codelineno-14-5 href=#__codelineno-14-5></a>    0     0 RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0
+</span></code></pre></div> </div> <ol> <li>The <code>br-1351328e1855</code> bridge interface is the interface that backs up the containerlab's management network (<code>clab</code> docker network).</li> </ol> <p>The rule will be removed together with the management network.</p> <div class="admonition tip"> <p class=admonition-title>RHEL 9 users</p> <p>By default RHEL 9 (and it's derivatives) will use <code>firewalld</code> as the <a href=https://access.redhat.com/solutions/7046655>default firewall</a>, containerlab's <code>iptables</code> and <code>nftables</code> rules will not work in this case and you will not have external access to your labs.</p> <p>To fix this you must disable <code>firewalld</code> and enable the <code>nftables</code> service. </p> <p><strong>Take caution when disabling firewalls, you may be exposing things you shouldn't</strong></p> <div class="language-text highlight"><pre><span></span><code><span id=__span-15-1><a id=__codelineno-15-1 name=__codelineno-15-1 href=#__codelineno-15-1></a>systemctl disable firewalld
 </span><span id=__span-15-2><a id=__codelineno-15-2 name=__codelineno-15-2 href=#__codelineno-15-2></a>systemctl stop firewalld
 </span><span id=__span-15-3><a id=__codelineno-15-3 name=__codelineno-15-3 href=#__codelineno-15-3></a>systemctl mask firewalld
 </span><span id=__span-15-4><a id=__codelineno-15-4 name=__codelineno-15-4 href=#__codelineno-15-4></a>