How can I use iptables on top of docker to be able to connect to the internet from the containers?

Question

we have a system which has been migrated from a traditional service to docker. We only want to have a firewall in production, therefore we want to have the iptables config only in the server, not inside the config of docker.

We had the following requierments:

• The servers can communicate with each other.
• You can ping the server
• You can SSH
• You can access the server to some web service thorugh some ports.

After reading for some hours/days I came to the following config:

# Delete old entries if any
iptables -F INPUT
iptables -F DOCKER-USER
iptables -F OUTPUT

# Set firewall 
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Allow established connections
iptables -A INPUT -i lo -j ACCEPT # Allow localhost communication
iptables -A OUTPUT -o lo -j ACCEPT # Allow output to the internet from localhost
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT # Allow ICMP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # Allow SSH
iptables -A INPUT -j DROP # Drop eveything else

# Docker specific, allow connections to the ports of the web services:
iptables -A DOCKER-USER -i ens192 -s 192.168.69.0/24 -p tcp -m conntrack --ctorigdstport 8080 --ctdir ORIGINAL -j ACCEPT
iptables -A DOCKER-USER -i ens192 -s 192.168.69.0/24 -p tcp -m conntrack --ctorigdstport 9000 --ctdir ORIGINAL -j ACCEPT
iptables -A DOCKER-USER -i ens192 -s 192.168.69.0/24 -p tcp -m conntrack --ctorigdstport 19900 --ctdir ORIGINAL -j ACCEPT
iptables -A DOCKER-USER -i docker0 -j ACCEPT # Allow input from other containers
iptables -A DOCKER-USER -i ens192 -j DROP # Drop all access to the containers through default interface

At this point:

• I can not access the web services if I'm not in that subnet.
• I can ping and I can connect thorugh ssh.
• The containers can comunicate with each other. So most of the requierments where fullfilled.

But now when we try to access the internet from a container it has not access. (e.g. ping to google, or local network). But from localhost it works.

I have tried many options like multiple combinations of the followings:

iptables -A DOCKER-USER -o docker0 -j ACCEPT
iptables -A OUTPUT -o docker0 -j ACCEPT
iptables -A DOCKER-USER -o ens192 -j ACCEPT

But none of them seem to allow me to ping from a docker container.

Answer 1

In my opinion you're overthinking this a bit since docker comes with some sane default configuration which it also manages automatically. E.g. in the default setup containers are not accessible via external network but they can connect to the internet themselves.

Therefore you should just EXPOSE the relevant ports of your containers on the host's external IP or bind to the host's loopback interface and then simply think of the containers as ordinary services running on the host!

I.e. if you are running a web service with docker bind it to the respective host ports:

docker run -p 80:80 -p 443:443 ...

Then configure your iptables to whitelist the required ports and DROP everything else:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Allow established connections
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT # Allow ICMP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # Allow SSH
iptables -A INPUT -p tcp --dport 80 -j ACCEPT # Allow HTTP
iptables -A INPUT -p tcp --dport 443 -j ACCEPT # Allow HTTPS
iptables -A INPUT -j DROP # Drop eveything else

Everything else regarding the setup of the internal networking, allowing/blocking connections from/to the containers and forwarding the exposed ports docker is already taking care of for you.

This especially means what you should definitely NOT do is to mess with the DOCKER chains in iptables because these are automatically managed by the docker daemon!

As said above the defaults are in most cases already what you want anyways. If you need more control for a custom configuration you would need to disable the iptables management in docker and manage the network configuration manually - generally this is not what you want to do.

You can see a bit more in the docker networking documentation.

Answer 2

I think I found a working solution, but I'm not sure if there is a better way.

With the things I tried I had to also declare the established connections for the DOCKER-USER set adding this two lines in comparison with my question:

iptables -A DOCKER-USER -i docker0 -j ACCEPT
> iptables -A DOCKER-USER -o docker0 -j ACCEPT
> iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A DOCKER-USER -i ens192 -j DROP

Answer 3

From your question, I assume that these iptables-rules are supposed to be installed on the docker-host.

You a missing a central point here: the firewall-rules are only valid for the host itself, not the containers!

Let's assume, your docker0 interface has the ip range 172.16.0.0/16. The host interface address is 172.16.0.1, and your first container might have the address 172.16.0.2.

But any outgoing traffic from the container to the internet needs to be send out from your host's main network interface, which is ens192. So, any firewall rule meant for a container must reside inside the FORWARD chain! (and don't forget leave ip_forwarding enabled for the host)