I try to use Docker to run 2 containers (the issue is not specific to them):

  • MySQL (official container)
  • Redmine (official container)

Each container has a forwarded port:

  • MySQL: -> 3000/tcp
  • Redmine: -> 3306/tcp

As you can see, the goal is to make them accessible only within the host.

A Nginx server (not installed via Docker) listens to the port 80 and redirects any request to the Redmine container port (using proxy functionnalities: proxy_pass etc.).

All works perfectly at this point, when I go to the server ip, I can access to Redmine.

But, I'd want to add some security using iptables. So, the goal is to:

  • DROP all by default (this point is ok)
  • Allow Docker to make its business only within the local host
  • Allow the containers to access the Internet (to download dependencies, updates...)
  • Allow the access to SSH and Nginx (ok too)

First, I tried to add the --iptables=false option to stop docker messing with my iptables. After a reboot, I thought that, with clean iptables (all politics are set to ACCEPT by default, so nothing is done yet), all would work well. But that's not the case, I get a "502 Bad Gateway" response from Nginx. I don't really understand why Docker is unable to work without adding additional rules (if all is open, it should work... No?).

I tried to read the docs about advanced networking in Docker, I also tried multiple tutorials, but I can't find what is blocking Docker:

I'm not a Linux/Docker/SysAdmin expert so maybe, it will be obvious for some of you (at least, I wish!).

Don't hesitate to ask me more details if needed.

Thanks in advance for your answer.


Docker by default adds iptables rules so that ports exposed to the host can be accessed. You can try adding this to the DOCKER-USER chain:

iptables -I DOCKER-USER -i eth0 ! -s -j DROP

This will drop all packets that are coming from the external interface (in this case eth0) and have no loopback origin. This might need to be executed after you start the docker service.

Update: As Luca said you probably only need either

iptables -I DOCKER-USER -i eth0 -j DROP


iptables -I DOCKER-USER ! -s -j DROP
  • how can packets with source ip == 127/8 possibly reach eth0? – Luca Gibelli Apr 7 '18 at 13:51
  • True, you probably need only one of those conditions, not both. – Martin Apr 8 '18 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.