Restrict access to Docker host with iptables?

Question

I would like to restrict access to my docker host and containers to only be allowed from one source IP (actually I want to create more elaborate rules than this, but I need to figure out this basic task first)... how can I do this?

I tried iptables -I DOCKER-USER -i ens33 ! -s 10.0.0.100 -j DROP with my IP address being 10.0.0.100, but I can still ping the docker host from other IP addresses on my LAN.

The docker documentation (https://docs.docker.com/network/iptables/) states "Docker installs two custom iptables chains named DOCKER-USER and DOCKER, and it ensures that incoming packets are always checked by these two chains first."

The documentation has a section titled "Restrict connections to the Docker host", which is exactly what I want to do, however it does not seem to actually describe how to do just that. This section is where I got the example rule from above, but despite the section heading, this rule is described as restricting access to a docker container and not restricting access to the docker host. So how do I actually restrict access to the docker host?

sudo iptables -I INPUT -i ens33 ! -s 10.0.0.100 -j DROP does indeed restrict access to the host from other IP addresses, but it seems to go against the documentation and I am not sure if this will cause some problems with docker?

Answer 1

I think the documentation was just a little bit confusing (to me at least), upon evaluating the table/chain traversal of iptables, incoming traffic destined for the host will never hit the "DOCKER-USER" table, so it is correct to use the INPUT/OUTPUT chains for docker host restrictions:

#Ensures only 10.0.0.100 can reach the containers
iptables -I DOCKER-USER -o docker0 ! -s 10.0.0.100 -j DROP

#Ensures the containers can only reach 10.0.0.100
iptables -I DOCKER-USER -i docker0 ! -d 10.0.0.100 -j DROP

#Ensures only 10.0.0.100 can reach this host.
iptables -A INPUT ! -s 10.0.0.100 -j DROP

#Ensures this host can only reach 10.0.0.100 (if desirable)
iptables -A OUTPUT ! -d 10.0.0.100 -j DROP