2

I'm facing the following problem: I want to block the port 8000 being accessed from the network (block all connections except the ones from 127.0.0.1). So to simplify my problem and as a first step, I decided to block all access to the port 8000 by using this rule :

iptables -A INPUT -p tcp --dport 8000 -j DROP

Now, I know that I should take the reverse approch wich is drop all connections except the trusted ones but I decided to make this for educational purpose.

iptables -L shows me this output:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8000

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           ctstate RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            172.17.0.1          tcp dpt:80

Unfortunately, I still succeed to access the server from port 8000. Can you tell me what I have to do? I didn't do anything after executing the drop rule command.

  • 1
    What's your question? I don't see any. – Oldskool Apr 26 '16 at 14:06
  • Sorry for not being clear. My rule doesn't work. I still succeed to access the server with the port 8000. – rsabir Apr 26 '16 at 14:07
  • 1
    Did you reload iptables after adding the rule? – Oldskool Apr 26 '16 at 14:08
  • No I didn't. I thought that the changes are taking into account immediately after executing the rule. Is it not sufficient that iptables -L show the rule that we added? – rsabir Apr 26 '16 at 14:11
  • are you sure it is TCP not RDP? – Sverre Apr 26 '16 at 14:38
4

Looks like you are using Docker. When exposing a container port Docker will create rules to forward packets to your container. These packets never go through the INPUT chain. See: http://www.faqs.org/docs/iptables/traversingoftables.html

You can filter using the FORWARD chain.

iptables -I FORWARD -p tcp -d 172.17.0.1 --dport 80 -j DROP

Note, this will not drop connections from localhost and you have to use the rewritten destination (ie listen port in the container.)

If you want more control you can run the Docker daemon with --iptables=false, but you will have to manage the packet forwarding to your containers manually.

  • Thank you! Indeed I didn't know that we bypass all Input rules if there's a prerouting rule that make a forward. – rsabir Apr 26 '16 at 15:00
  • Though I have a question: Why the rule of forward doesn't apply when I use a reverse proxy (apache with mod_proxy)? I can only guess that apache doesn't use forwarding rules for forwarding the packets. – rsabir Apr 26 '16 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.