This is the first time i address such a network "problem" to solve with docker and i need some inputs.
This is my situation:
Ubuntu 14.04 running NginX, ufw as firewall and docker containers to run a PHP backend application.
Ufw default policy is set to DROP for both INPUT and OUTPUT, as well as for FORWARD.
net.ipv4.conf.all.forwarding = 0
- a container running in daemon mode, with port 8888/tcp which accept connections from the outside but ONLY from ip 18.104.22.168 and, also, port 4444/tcp which listen from localhost
Ufw is set to accept incoming connections on port 8888/tcp ONLY from ip 22.214.171.124. Hence, basically:
sudo ufw allow in from 126.96.36.199 to any port 8888 proto tcp
Then, i run the container with:
docker run -p 8888:8888/tcp -p 127.0.0.1:4444:4444/tcp [other options ]
nmap -p 8888 188.8.131.52 from a machine which have NOT the ip = 184.108.40.206, i expect to get
Host is up (0.056s latency). PORT STATE SERVICE 8888/tcp open unknown
I have then tried to run the container again without
-p 8888:8888/tcp and then i tried to run again the nmap, and...
Host is up (0.061s latency). PORT STATE SERVICE 8888/tcp filtered unknown
Therefore, it seems that, correct me if i am wrong, docker rules override ufw's ones.
I have then searched a way to allow incoming traffic in a container only from a specific address, and i found something like:
iptables -I DOCKER -i ext_if ! -s 220.127.116.11 -j DROP
And it worked:
PORT STATE SERVICE 8888/tcp filtered unknown Nmap done: 1 IP address (1 host up) scanned in 15.05 seconds
My question is then:
is the solution above right for my case? i mean: acting like above, i am overriding ufw rule
allow in from 18.104.22.168 to any port 8888 proto tcp with a docker rule that says "expose ports only if traffic comes from ip 22.214.171.124 " ... is this the right approach?
would not be better to leave ufw do the "bad work" of drop unwanted packets and then just forward traffic from filtered ports to docker? is there a way to do this?
I would avoid this solution because being an iptable rule of the DOCKER chain, that rule involves all the containers i currently have or i will have.