mirror of
https://github.com/moby/moby.git
synced 2026-07-15 12:01:27 +00:00
0aba67203a
Same as "nat" mode, there's masquerading and port mapping from the host - but no port/protocol filtering for direct access to the container's address from remote hosts. This is the old default behaviour for IPv4 when the filter-FORWARD chain's default policy was "ACCEPT" (the daemon would only set it to "DROP" when it set sysctl "ip_forward" itself, but it didn't set up DROP rules for unpublished ports). Now, port filtering doesn't depend on the filter-FORWARD policy. So, this mode is added as a way to restore the old/surprising/insecure behaviour for anyone who's depending on it. Networks will need to be re-created with this new gateway mode. Signed-off-by: Rob Murray <rob.murray@docker.com>