I have two separate networks, one which is trusted and one which is untrusted. The trusted network contains a server.

Blue is the existing, trusted network and the big box is the server, which is connected via eth0 to the trusted network.

enter image description here

I now want to start using free resources on the server to host services, which are contained in docker containers, to the untrusted network (red).

I want everything that gets bound to the to work as usual, but not to bind to eth1 and docker1. This means that nginx should be able to communicate with all interfaces except eth1 and docker1. It should not be able to communicate with the subnet, which also includes the docker1 bridge. This goes for the sshd and samba as well, for any service. No device coming from should be able to establish a ssh session on the server or connect via samba. No routing for to and from other subnets should happen on the server.

So the server and any device on the network should be able to access containers 1 to 3, but not 4 and 5. And the containers 4 and 5 should not be able to access anything on the network.

I believe that it should be doable by using iptables. Also, how would I configure the docker bridge?

I lack experience with iptables and more so with docker networking, so a detailed explanation would be greatly appreciated.

(All communications between those two networks should only occur over a router. The router is using NAT so that subnet can access through it, but the other way around only if port forwarding on the router allows it, but that is a different (and solved) issue.)

Update: Would adding these rules this do the job?

iptables -A INPUT   -i eth1 -j DROP
iptables -A OUTPUT  -i eth1 -j DROP
iptables -A FORWARD -i eth1 -j DROP

iptables -A INPUT   -i docker1 -j DROP
iptables -A OUTPUT  -i docker1 -j DROP
iptables -A FORWARD -i docker1 -j DROP

iptables -A FORWARD -i eth1 -o docker1 -j ACCEPT
iptables -A FORWARD -i docker1 -o eth1 -j ACCEPT

If so, how could for example container1 connect to a HTTP server running on container4, if it doesn't know that to reach it must first exit via eth0 because trying to contact directly will result in the packets getting dropped.

  • You really should use a (another!) virtual machine for this. While you can make the firewall work to maintain some isolation, you lose if the firewall comes down for some reason. – Michael Hampton Feb 23 '17 at 23:13
  • Wouldn't the VM (running on the same server) then also require some iptables to create isolation? That server is relatively weak (Intel Celeron N3150), so I doubt that putting a VM on it would be a good thing. It wouldn't really be critical if the firewall comes down, just undesired. – Daniel F Feb 23 '17 at 23:33
  • In the case of a VM, the virtual network itself would provide isolation. You can go to all the trouble to set up a software defined network just for this, but you most likely ought to have had the existing docker in a VM already. – Michael Hampton Feb 23 '17 at 23:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.