1

I have a difficult situation here, i have setup many containers on my docker host, running different applications like mailserver, databases, redis, and certain html applications using other containers as dependencies. All have been setup using -p flag with hostport:containerport , ports are not bind to host machine, they can be listened on the internet.

When setting up the dependent application I used docker bridge IP (not the public IP) of the host to link. example: piwik container connects to mysql database container using 172.17.42.1:port IP which is default IP of docker bridge used for container networking. Then i used nginx (on host) to setup a dns based proxy on localhost (127.0.0.1:port) to route to application running inside containers. Initially when setting up the system, i thought to DROP all traffic except the ports required to be open (80, 443, etc.) and ACCEPT lo interface would do the job. But docker interface uses FORWARD chain to route to docker0 bridge. That forward chain uses indivisual rules to forward to container IP:PORT

What i want is to use app from sub.domin.com but should not be accessable from IP:PORT or domain:PORT. Now i flushed all the iptables

iptables -F
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -A FORWARD -i docker0 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o docker0 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 22,53,80,443,25,465,587,993,995 -j ACCEPT
iptables -A INPUT -p udp -m multiport --dports 53 -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --sports 22,53,80,443,25,465,587,993,995 -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --sports 53 -j ACCEPT

After the iptables implementation nginx failed to route (sub.domain.com), and gave nginx 504 error (which confirmed that DNS was resolving to correct IP). apps were accessable through IP:PORT, all ports including those of container apps were open to the Internet, as were earlier. so i rebooted server to reset to defaults. I notices iptables records arn't present in the beginning but start to appear as we spin up containers. I am really confused to how to hide ports from the internet in such a way that nginx proxy routing still works. IP addresses of containers is accessable.

0

0

You must log in to answer this question.

Browse other questions tagged .