My goal is to limit access to docker containers to just a few public IP addresses. Is there a simple, repeatable process to accomplish my goal? Understanding only the basics of iptables while using Docker's default options, I'm finding it very difficult.
I'd like to run a container, make it visible to the public Internet, but only allow connections from select hosts. I would expect to set a default INPUT policy of REJECT and then only allow connections from my hosts. But Docker's NAT rules and chains get in the way and my INPUT rules are ignored.
Can somebody provide an example of how to accomplish my goal given the following assumptions?
- Host public IP 22.214.171.124 on eth0
- Host private IP 192.168.1.10 on eth1
docker run -d -p 3306:3306 mysql
- Block all connection to host/container 3306 except from hosts 126.96.36.199 and 188.8.131.52
I'm happy to bind the container to only the local ip address but would need instructions on how to set up the iptables forwarding rules properly which survive docker process and host restarts.