diff --git a/_modules/paas_docker.py b/_modules/paas_docker.py
--- a/_modules/paas_docker.py
+++ b/_modules/paas_docker.py
@@ -27,3 +27,24 @@
         image += ":" + str(args['version'])
 
     return image
+
+
+def get_subnets():
+    """
+    A function to get the Docker subnets list.
+
+    CLI Example:
+
+        salt * paas_docker.get_subnets
+    """
+    try:
+        networks = __pillar__['docker_networks'][__grains__['id']]
+    except KeyError:
+        networks = {}
+
+    # Defined Docker subnet
+    subnets = [network["subnet"] for network in networks.values()]
+    # Default Docker subnet
+    subnets.append("172.17.0.0/16")
+
+    return subnets
diff --git a/_tests/data/paas_docker.yaml b/_tests/data/paas_docker.yaml
new file mode 100644
--- /dev/null
+++ b/_tests/data/paas_docker.yaml
@@ -0,0 +1,7 @@
+docker_networks:
+  egladil:
+    cd:
+      subnet: 172.18.1.0/24
+    ci:
+      subnet: 172.18.2.0/24
+  voidserver: {}
diff --git a/_tests/modules/test_paas_docker.py b/_tests/modules/test_paas_docker.py
--- a/_tests/modules/test_paas_docker.py
+++ b/_tests/modules/test_paas_docker.py
@@ -7,6 +7,15 @@
 
 class Testinstance(unittest.TestCase, salt_test_case.SaltTestCase):
 
+    def setUp(self):
+        self.initialize_mocks()
+        self.instance = docker
+
+        self.mock_pillar('data/paas_docker.yaml')
+
+        self.mock_grains()
+        self.grains['id'] = 'egladil'
+
     def test_get_image(self):
         container = {
             "image": "foo",
@@ -39,3 +48,15 @@
         }
 
         self.assertEqual("foo:2.5", docker.get_image("not_foo", container))
+
+    def test_get_subnets(self):
+        expected = ['172.18.1.0/24', '172.18.2.0/24', '172.17.0.0/16']
+
+        self.assertEqual(expected, docker.get_subnets())
+
+    def test_get_subnets_when_none_are_defined(self):
+        # Only the default Docker one
+        expected = ['172.17.0.0/16']
+
+        self.grains['id'] = 'voidserver'
+        self.assertEqual(expected, docker.get_subnets())
diff --git a/roles/paas-docker/docker/firewall.sls b/roles/paas-docker/docker/firewall.sls
new file mode 100644