0

I have a couple services running on a machine in docker containers that need to be available to a specific IP address, and need to be available to containers with links (as defined in a docker-compose file). I've tried these commands, but this seems to also drop packets from containers on the same docker network:

iptables -I DOCKER-USER ! -s 8.8.8.8/32 -p tcp -m tcp --dport 1234 -j DROP

iptables -I DOCKER-USER ! -s 8.8.8.8/32 -p tcp -m tcp --dport 12345 -j DROP

How can I set up iptables to drop packets going to ports 1234 and 12345 from all ip addresses, except 8.8.8.8 and any container with links (as defined in a docker-compose file)?

docker-compose seems to create a bridge interface, and a lot of virtual interfaces with random names (one for each container?).

Here is the docker-compose.yml file I'm using:

version: '3'
services:
    django:
        build: .
        image: django
        depends_on:
            - mysql-db
            - sel
        ports:
            - "80:54321"
        links:
            - mysql-db
            - sel
            - rabbit
            - redis
        volumes:
            - vol1:/media/DataRaid1/vol1
            - /etc/secret_key.txt:/etc/secret_key.txt
            - django-media:/var/www/media
        environment:
            - DJANGO_SETTINGS_MODULE=a_project.settings_production
            - COMMIT
        command: httpd-foreground"
    mysql-db:
        image: mysql:5.7.18
        environment:
            - MYSQL_ROOT_PASSWORD=APASSWORD
        volumes:
            - mysql-data:/var/lib/mysql
            - ./custom-mysql.cnf:/etc/mysql/conf.d/custom-mysql.cnf
    sel:
        image: "selenium/standalone-chrome"
        volumes: #Fixes bug https://github.com/elgalu/docker-selenium/issues/20
            - /dev/shm:/dev/shm
    # Redis
    redis:
        image: redis:4.0.9
        hostname: redis
        ports:
            - "1234:1234"

    # RabbitMQ
    rabbit:
        hostname: rabbit
        image: rabbitmq
        environment:
            - RABBITMQ_DEFAULT_USER=AUSER
            - RABBITMQ_DEFAULT_PASS=APASSWORD
        ports:
            - "12345:12345"
    # Celery worker
    worker:
        build: .
        command: bash -c "sleep 10 && celery worker -A a_project.celeryconf -Q default -n default@%h"
        volumes:
          - .:/var/www
        links:
          - mysql-db
          - rabbit
          - redis
        depends_on:
          - rabbit
        environment:
            - DJANGO_SETTINGS_MODULE=a_project.settings_production
            - C_FORCE_ROOT=true
volumes:
    vol1:
    mysql-data:
    django-media:
0
  1. Use Network mode for each container:

    network_mode: "host"
    
  2. Use ports with binding to 127.0.0.1 + some proxy container:

    ports:
      - "127.0.0.1:12345:12345"
    
  3. Do not use ports at all + some proxy container

  4. Add iptables rule to appropriate docker chain, not sure which one right now ...
  • I'm interested in how this works. – marcelo.delta Feb 14 at 12:56
  • 1) is not a good option for me, because we depend on using different docker-compose files to use different ports for "staging" and "production" servers. Would rather not complicate things with a proxy with 2) and 3). What I'm looking for is 4), but not sure how to implement it. – user43704 Feb 14 at 17:52
  • Unfortunately 4) is not reliable way to do it, just my opinion. Because docker have a bunch of iptables rules, which added by docker daemon to rules, which initially configured by other services, so you will add another layer of not obvious customization here – aka Feb 15 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.