Might seem a silly question but i'm trying to get the following to work:
- I have a correctly configured UFW for only allowing certain source IPs access to my local service
- after migrating this service into a docker container with a published port the port is publicly published
Thus every host can now access the published port from anywhere.
How can I restrict access via UFW to this published docker port?
The specific port this service is using is 3333
.
I've tried to get it to work using -p 127.0.0.1:3333:3333
in order to bind the port to localhost. But then I'd need a proxy to go from the UFW-restricted public port to localhost:3333
. I also tried to use iptables -j REDIRECT
, but I couldn't get it to work.
So it's not a problem of the container restricting access to outside, it outside getting to the container.
I'd like to keep my current UFW setup with explicit whitelisting for Dockerized serviced.
-P 3333:3333
or-P 127.0.0.1:3333:3333
both dont really work. I can fix it by prepending my UFW rules manually after starting the containeriptables -I FORWARD 1 -p tcp -i eth0 -s [allowedsourceIP] --dport 3333 -j ACCEPT
but this breaks after restarting / stop+starting the container...