-5

Let's consider a server running MySQL server, listening on 127.0.0.1:3306.

I would now like to give Docker containers running on the same host access to the MySQL server. MySQL would reject incoming connections, since they don't originate from 127.0.0.1, but from the container's IP. I could change the binding address of MySQL to '*', but then I would rely entirely on the firewall to prevent access from other networks. Therefore, I would prefer to keep MySQL listening on 127.0.0.1, and use iptables to "white list" the containers. I am not an iptables expert, so I just tried different combinations, using -t nat INPUT, PREROUTING, POSTROUTING, but couldn't get it to work so far. I also set "net.ipv4.conf.docker0.route_localnet" to 1, since that looks necessary.

How can I make iptables set the source address to 127.0.0.1 for all packets coming on the docker0 interface (or a specific IP or network), and handle the following address translation?

  • 1
    If you NAT the source address to the loopback address, you could never send a reply back to a request because anything sent to the loopback address for a reply will loop right back into the server. Loopback addresses, by definition, are not allowed to be routed. – Ron Maupin Nov 13 '16 at 16:59
  • @RonMaupin isn't that the point of the route_localnet option? "route_localnet - BOOLEAN Do not consider loopback addresses as martian source or destination while routing. This enables the use of 127/8 for local routing purposes. default FALSE" – ocroquette Nov 13 '16 at 17:49
  • Can someone tell me why my question is downvoted? – ocroquette Nov 13 '16 at 17:51
  • Then that doesn't follow RFC 6890, which says that anything in the 127.0.0.0/8 range is not forwardable. – Ron Maupin Nov 13 '16 at 17:58
  • 1
    I have noticed that many things in Linux don't really follow the RFCs. It may be that Linux allows loopback addresses to be routed internally, but that could break some things in other RFCs, e.g. detecting MPLS data plane failures and BFD, which depend on those addresses to not be routable. Loopback addresses should not get sent to a routing process. Anything sent to a loopback address should immediately be sent right back into the host, bypassing the routing process. – Ron Maupin Nov 13 '16 at 18:16
0

Answering my own question: it looks like iptables is the wrong tool for the job. I installed rinetd and configured it like this:

# bindadress    bindport    connectaddress  connectport
172.17.0.1      3308        127.0.0.1       3306

rinetd binds only to the Docker address (172.17.0.1), and forwards connection from the containers to the MySQL server running on the host. From MySQL's perspective, the connections are coming from 127.0.0.1, so it happily accepts them.

It would be much easier if MySQL would support multiple bind addresses, but since the corresponding feature request have been open for 11 years, I guess it is not going to be implemented any time soon (https://bugs.mysql.com/bug.php?id=14979).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.