0

I would like to restrict access to my docker host and containers to only be allowed from one source IP (actually I want to create more elaborate rules than this, but I need to figure out this basic task first)... how can I do this?

I tried iptables -I DOCKER-USER -i ens33 ! -s 10.0.0.100 -j DROP with my IP address being 10.0.0.100, but I can still ping the docker host from other IP addresses on my LAN.

The docker documentation (https://docs.docker.com/network/iptables/) states "Docker installs two custom iptables chains named DOCKER-USER and DOCKER, and it ensures that incoming packets are always checked by these two chains first."

The documentation has a section titled "Restrict connections to the Docker host", which is exactly what I want to do, however it does not seem to actually describe how to do just that. This section is where I got the example rule from above, but despite the section heading, this rule is described as restricting access to a docker container and not restricting access to the docker host. So how do I actually restrict access to the docker host?

sudo iptables -I INPUT -i ens33 ! -s 10.0.0.100 -j DROP does indeed restrict access to the host from other IP addresses, but it seems to go against the documentation and I am not sure if this will cause some problems with docker?

0

I think the documentation was just a little bit confusing (to me at least), upon evaluating the table/chain traversal of iptables, incoming traffic destined for the host will never hit the "DOCKER-USER" table, so it is correct to use the INPUT/OUTPUT chains for docker host restrictions:

#Ensures only 10.0.0.100 can reach the containers
iptables -I DOCKER-USER -o docker0 ! -s 10.0.0.100 -j DROP

#Ensures the containers can only reach 10.0.0.100
iptables -I DOCKER-USER -i docker0 ! -d 10.0.0.100 -j DROP

#Ensures only 10.0.0.100 can reach this host.
iptables -A INPUT ! -s 10.0.0.100 -j DROP

#Ensures this host can only reach 10.0.0.100 (if desirable)
iptables -A OUTPUT ! -d 10.0.0.100 -j DROP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.