Added Optional Routing

Author: jiriteach

README.md

@@ -5,9 +5,9 @@ This image packages the Linux `cloudflare-warp` client for running a Cloudflare
 It is designed for:
 
 - headless `warp-cli` connector enrollment
-- bidirectional mesh traffic
-- subnet routing through the container
-- routed return traffic by enabling forwarding and disabling reverse path filtering
+- plain node connectivity by default
+- optional subnet routing through the container
+- optional routed return traffic by enabling forwarding and disabling reverse path filtering
 - network troubleshooting with `ping` and `traceroute`
 
 ## What is included
@@ -18,9 +18,9 @@ It is designed for:
 - an entrypoint that:
   - starts `warp-svc`
   - streams `warp-svc` logs into `docker logs`
-  - enables IPv4 forwarding
-  - disables `rp_filter` to avoid dropping asymmetric return traffic
-  - accepts forwarded traffic in the `FORWARD` chain
+  - optionally enables IPv4 forwarding for subnet routing
+  - optionally disables `rp_filter` to avoid dropping asymmetric return traffic
+  - optionally accepts forwarded traffic in the `FORWARD` chain
   - optionally runs `warp-cli connector new <TOKEN>`
   - optionally runs `warp-cli connect`
   - periodically logs `warp-cli status` changes
@@ -45,7 +45,15 @@ Set your connector token first:
 export WARP_CONNECTOR_TOKEN='your-cloudflare-mesh-token'
 ```
 
-If you are using `network_mode: host`, apply the routing sysctls on the Docker host before starting the container:
+By default the container behaves like a WARP Mesh node and does not enable subnet forwarding.
+
+To turn on subnet routing and reverse-path handling, set:
+
+```bash
+export WARP_ENABLE_SUBNET_ROUTING=true
+```
+
+If subnet routing is enabled and you are using `network_mode: host`, apply the routing sysctls on the Docker host before starting the container:
 
 ```bash
 sudo sysctl -w net.ipv4.ip_forward=1
@@ -66,6 +74,8 @@ If you want to manage forwarding policy outside the container, set:
 export WARP_MANAGE_FORWARD_CHAIN=false
 ```
 
+`WARP_MANAGE_FORWARD_CHAIN` only matters when `WARP_ENABLE_SUBNET_ROUTING=true`.
+
 The container also supports periodic status logging. The default interval is 15 seconds, and only changed status snapshots are emitted:
 
 ```bash
@@ -96,7 +106,9 @@ docker exec -it cf-warp-cli traceroute 1.1.1.1
 
 ## Routing notes
 
-For subnet routing to work end to end, the surrounding network must send the target CIDR back through this container's host. The container enables forwarding and avoids reverse path filtering drops, but upstream route tables still need to point the advertised subnet toward the Docker host running this container.
+When `WARP_ENABLE_SUBNET_ROUTING=false`, this container just joins Mesh as a node and does not try to route third-party subnet traffic.
+
+When `WARP_ENABLE_SUBNET_ROUTING=true`, the surrounding network must send the target CIDR back through this container's host. The container enables forwarding and avoids reverse path filtering drops, but upstream route tables still need to point the advertised subnet toward the Docker host running this container.
 
 If this is deployed in a cloud VPC, also make sure the instance or VM is allowed to forward traffic and that any source/destination checking is disabled where required by the platform.
 

docker-compose.yml

@@ -12,6 +12,7 @@ services:
     environment:
       WARP_CONNECTOR_TOKEN: "${WARP_CONNECTOR_TOKEN}"
       WARP_AUTOCONNECT: "true"
+      WARP_ENABLE_SUBNET_ROUTING: "${WARP_ENABLE_SUBNET_ROUTING:-false}"
       WARP_MANAGE_FORWARD_CHAIN: "true"
       WARP_STATUS_INTERVAL_SECONDS: "${WARP_STATUS_INTERVAL_SECONDS:-15}"
     volumes:

docker/entrypoint.sh

@@ -6,6 +6,13 @@ log() {
   printf '[%s] %s\n' "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" "$*"
 }
 
+is_true() {
+  case "${1,,}" in
+    1|true|yes|on) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 log_command_output() {
   local prefix="$1"
 
@@ -42,6 +49,11 @@ set_sysctl_if_present() {
 }
 
 configure_forwarding() {
+  if ! is_true "${WARP_ENABLE_SUBNET_ROUTING:-false}"; then
+    log "WARP_ENABLE_SUBNET_ROUTING is disabled; skipping forwarding and reverse-path configuration"
+    return 0
+  fi
+
   set_sysctl_if_present net.ipv4.ip_forward 1
   set_sysctl_if_present net.ipv4.conf.all.forwarding 1
 
@@ -51,15 +63,17 @@ configure_forwarding() {
 }
 
 configure_firewall() {
+  if ! is_true "${WARP_ENABLE_SUBNET_ROUTING:-false}"; then
+    log "WARP_ENABLE_SUBNET_ROUTING is disabled; leaving iptables FORWARD chain unchanged"
+    return 0
+  fi
+
   local manage_forward_chain="${WARP_MANAGE_FORWARD_CHAIN:-true}"
 
-  case "${manage_forward_chain,,}" in
-    1|true|yes|on) ;;
-    *)
-      log "WARP_MANAGE_FORWARD_CHAIN is disabled; leaving iptables FORWARD chain unchanged"
-      return 0
-      ;;
-  esac
+  if ! is_true "${manage_forward_chain}"; then
+    log "WARP_MANAGE_FORWARD_CHAIN is disabled; leaving iptables FORWARD chain unchanged"
+    return 0
+  fi
 
   if command -v iptables >/dev/null 2>&1; then
     iptables -C FORWARD -j ACCEPT >/dev/null 2>&1 || iptables -A FORWARD -j ACCEPT
@@ -158,15 +172,12 @@ enroll_connector_if_requested() {
 connect_if_requested() {
   local autoconnect="${WARP_AUTOCONNECT:-true}"
 
-  case "${autoconnect,,}" in
-    1|true|yes|on)
-      log "Connecting WARP"
-      warp-cli --accept-tos connect 2>&1 | log_command_output "[warp-cli] "
-      ;;
-    *)
-      log "WARP_AUTOCONNECT is disabled; leaving the client disconnected"
-      ;;
-  esac
+  if is_true "${autoconnect}"; then
+    log "Connecting WARP"
+    warp-cli --accept-tos connect 2>&1 | log_command_output "[warp-cli] "
+  else
+    log "WARP_AUTOCONNECT is disabled; leaving the client disconnected"
+  fi
 }
 
 status_snapshot() {