Ipscriptables

family :inet do
  table :nat do
    inherit(:DOCKER)
    inherit(:PREROUTING, :OUTPUT) { |rule| rule.target == 'DOCKER' }
    inherit(:POSTROUTING) { |rule| rule.target == 'MASQUERADE' }
  end

  table :filter do
    inherit(:INPUT) { |rule| rule.target == 'FWR' || rule.target == 'LXC' }
    inherit(:FORWARD) { |rule| rule[:i] == 'docker0' || rule[:o] == 'docker0' }
    inherit(:LXC)
    chain :FWR do
      rule :i => ['lo', 'docker0'], :j => 'ACCEPT'
      rule '-m state --state RELATED,ESTABLISHED -j ACCEPT'
      rule '-p icmp -j ACCEPT'
      rule '-p tcp -m tcp --dport', [22, 80, 443], '-j ACCEPT'
      rule '-p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable'
      rule '-p udp -j REJECT --reject-with icmp-port-unreachable'
    end
  end
end