I have Ubuntu server with Docker to serve MySQL and SSH/SFTP and I need all ports except 3306 and 22 to be firewalled, pretty standard and trivial requirement, right?
Now, I managed to find a sort of solution but it doesn't work fully for me as after applying it, either:
- I can't access any of the mentioned services (by default)
- I can't access the internet from within containers (if I put
iptables: falsein Docker's daemon.json config file)
I tried a number of other search results but they're mostly so complex that I don't understand what they're doing or they're heavily scripted making me, an iptables layman, an impossible task to take something from it.
Proposed solution looks rather simple and easy to comprehend but entire Docker networking complexity makes it much harder to debug.
Can someone please share their working iptables rules for Docker hosts or at least guide me in right direction?
I use docker-compose to launch services and this is my yaml:
version: '3.7' services: mysql: container_name: 'mysql' image: mysql:8.0.13 command: --default-authentication-plugin=mysql_native_password user: 1000:1000 ports: - "3306:3306" volumes: - ./data:/var/lib/mysql - ./config/custom.cnf:/etc/mysql/conf.d/custom.cnf networks: - database restart: always networks: database: driver: bridge
Edit: What I found is that allowing Docker to manage iptables rules is recommended and less demanding, at least in a long term and its okay to let Docker open required ports even though I didn't do that in a way I prefer, its still valid. What I want at this point is to find out is it possible to use iptables to block the ports opened by Docker and how (via mangle prerouting perhaps?). Any suggestions? Thanks a ton!