I have a Docker container exposing port 3306 to the Internet. I would like to restrict access to certain public IP addresses. As an example, let's use 22.214.171.124.
As an additional condition, I want the rules to survive restarting the Docker daemon and rebooting the server. This allows me to use
iptables-restore) to restore the rules when the server is rebooted, without having the
dockerd startup interfering with it.
I tried the following:
iptables -I FORWARD -p tcp --dport 3306 -j REJECT iptables -I FORWARD -p tcp --dport 3306 -s 126.96.36.199 -j ACCEPT
This works when done after starting the Docker daemon. When restarting the daemon, Docker inserts additional rules at the top of the chain, and my custom rules end up being ignored.
iptables -N DOCKER # if chain does not yet exist iptables -I DOCKER -p tcp --dport 3306 -j REJECT iptables -I DOCKER -p tcp --dport 3306 -s 188.8.131.52 -j ACCEPT
This works until
dockerdis restarted. It looks like
DOCKERchain upon restart, and all the custom rules are gone.
--iptables=false. While this works in principle, this solution breaks the standard Docker forwarding features, and requires setting up the forwarding rules manually.
I would be surprised if there is no proper way to do this. Any ideas?
PS: I did some reading, to no avail (e.g. Steps for limiting outside connections to docker container with iptables?, Docker - Exposed ports accessible from outside - iptables rules ignored, but these questions don't seem to deal with the restarting issue.)