I'd like to restrict access to a docker container to only a few ip adresses. There are two interfaces on the server : the public (eth0) and the private (eth1 : 192.168.0.1). I only want the IPs on the private interface to access the container so I've blocked all traffic from the public interface. I've tried to add a rule to authorize the specific IP to access the container but this does not work. My iptables look like so :
sudo iptables -vL DOCKER-USER
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- eth1 any 192.168.0.2 192.168.0.1 tcp dpt:XXXX
0 0 ACCEPT all -- eth1 any 192.168.0.1 192.168.0.2 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- eth1 any anywhere anywhere ctstate RELATED,ESTABLISHED
38824 2328K DROP all -- eth1 any anywhere anywhere
14596 678K ACCEPT all -- eth0 any anywhere anywhere ctstate RELATED,ESTABLISHED
12337 657K DROP all -- eth0 any anywhere anywhere
770K 1335M RETURN all -- any any anywhere anywhere
I can't manage to access the port XXXX from the ip 192.168.0.2, the port is exposed on the host like so :
0.0.0.0:XXXX->YYYY/tcp