gpproton/docker-cloudflare-firewall repository overview
Firewall rules to whitelist Cloudflare IP addresses on ports 80 and 443 (based on confd-firewall).
Background
This image allows firewall rules to be managed by a docker container which blocks traffic to the public interface from non-whitelisted addresses. Iptable rules are added to the mangle table.
Environment Variables
- FW_DISABLE - If set to 1, disables the firewall (removes the firewall table rules)
Usage
Run with:
$ docker run -d --name docker-cloudflare-firewall --restart=always --cap-add=NET_ADMIN --net=host gpproton/docker-cloudflare-firewall
Or with docker-compose.yml:
version: '3.3'
services:
firewall:
restart: always
image: virtusai/docker-cloudflare-firewall
container_name: docker-cloudflare-firewall
environment:
FW_DISABLE: 1
cap_add:
- NET_ADMIN
network_mode: host
For docker swarm:
version: '3.9'
services:
cloudflare:
image: gpproton/docker-cloudflare-firewall
deploy:
mode: global
restart_policy:
condition: on-failure
update_config:
parallelism: 1
delay: 30s
resources:
limits:
cpus: '0.2'
memory: 128M
reservations:
memory: 10M
environment:
FW_DISABLE: 0
cap_add:
- NET_ADMIN
# network_mode: host
networks:
- net
networks:
net:
external: true
name: host
List affected rules:
Raw
$ sudo iptables-save -t mangle
Formatted
$ sudo iptables -L -n -v -t mangle
To persist the firewall rules, just run the container with the --restart=always option.
Credits
Tag summary
Content type
Image
Digest
Size
29.8 MB
Last updated
about 5 years ago
docker pull gpproton/docker-cloudflare-firewall