The following configuration changes should ensure traffic flow between Docker and the Shorewall host.
Tested on Shorewall 220.127.116.11 but should apply to most recent versions:
Make sure IP forwarding is enabled (most config items are Yes/No, but this one is "On"):
Enable masquerading (NAT) for your private Docker network (if you use a different network, i.e. you launch docker with
--bip=#.#.#.#/#, then change accordingly). Change
eth0 to any interface on the host machine with external connectivity:
Add an interface entry so Shorewall knows which interface the
dock zone relates to:
#ZONE INTERFACE OPTIONS
Create a new zone; note,
docker is too long and will cause an "invalid zone name" error.
You probably want to allow Docker containers to talk to the host machine and the Internet, so this is a good starting point:
#SOURCE DEST POLICY
# ...(other policies)...
dock all ACCEPT
# ...(other policies, catch-all)...
You may also need a similar
ACCEPT policy for traffic from
dock, if you didn't already open it up with
You can tighten this up further in the policy or rules files as needed. For example, the above does not explicitly allow outside traffic to reach your Docker containers; check your other zones/policies/rules for that.