surshar / claude-code

Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.

Built by Anthropic · github.com/anthropics

feat: Add Docker DNS protection to firewall scriptBrowse files

- Extract Docker DNS NAT ports before iptables cleanup
- Restore Docker DNS NAT rules after iptables reset
- Maintains Docker container DNS functionality in network isolation
- Fixes connection refused errors to 127.0.0.11 in Docker environments

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

shota-0129 authored on Jul 29, 2025 parent 4025128 · commit 8b2cbe3f867b

1 changed file+17 -0compared with 4025128

M.devcontainer/init-firewall.sh

M.devcontainer/init-firewall.sh+17 -0

		@@ -2,6 +2,10 @@
2	2	set -euo pipefail # Exit on error, undefined vars, and pipeline failures
3	3	IFS=$'\n\t' # Stricter word splitting
4	4
	5	+# Extract Docker DNS ports before cleanup (for protection)
	6	+TCP_PORT=$(iptables -t nat -L DOCKER_OUTPUT -n 2>/dev/null \| grep 'tcp.to:127.0.0.11:' \| sed 's/.127\.0\.0\.11://g' \| cut -d' ' -f1 \|\| echo "")
	7	+UDP_PORT=$(iptables -t nat -L DOCKER_OUTPUT -n 2>/dev/null \| grep 'udp.to:127.0.0.11:' \| sed 's/.127\.0\.0\.11://g' \| cut -d' ' -f1 \|\| echo "")
	8	+
5	9	# Flush existing rules and delete existing ipsets
6	10	iptables -F
7	11	iptables -X
		@@ -11,6 +15,19 @@
11	15	iptables -t mangle -X
12	16	ipset destroy allowed-domains 2>/dev/null \|\| true
13	17
	18	+# Restore Docker DNS NAT rules if they existed
	19	+if [ -n "$TCP_PORT" ] && [ -n "$UDP_PORT" ]; then
	20	+ echo "Restoring Docker DNS with TCP:$TCP_PORT, UDP:$UDP_PORT"
	21	+ iptables -t nat -N DOCKER_OUTPUT
	22	+ iptables -t nat -N DOCKER_POSTROUTING
	23	+ iptables -t nat -A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
	24	+ iptables -t nat -A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
	25	+ iptables -t nat -A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -j DNAT --to-destination 127.0.0.11:$TCP_PORT
	26	+ iptables -t nat -A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -j DNAT --to-destination 127.0.0.11:$UDP_PORT
	27	+ iptables -t nat -A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -j SNAT --to-source :53
	28	+ iptables -t nat -A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -j SNAT --to-source :53
	29	+fi
	30	+
14	31	# First allow DNS and localhost before any restrictions
15	32	# Allow outbound DNS
16	33	iptables -A OUTPUT -p udp --dport 53 -j ACCEPT