I have a Docker swarm cluster with a Prometheus container running on one node, Prometheus is configured to scrape all the Swarm nodes by their public IP addresses on port 9100 (Node exporter), all these IPs are collected dynamically.
I'm also using a basic
iptables configuration like this on all the nodes:
# Accept loopback interface traffic -A INPUT -i lo -j ACCEPT -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Allow ICMP traffic -4 -A INPUT -p icmp -j ACCEPT -6 -A INPUT -p icmpv6 -j ACCEPT # Allow SSH traffic -A INPUT -p tcp --dport 22 -j ACCEPT # Allow HTTP and HTTPS traffic -A INPUT -p tcp --dport 80 -j ACCEPT -A INPUT -p tcp --dport 443 -j ACCEPT # Allow all traffic from the swarm nodes -A INPUT -s <OTHER_SWARM_NODE_IP> -j ACCEPT -A INPUT -s <OTHER_SWARM_NODE_IP> -j ACCEPT -A INPUT -s <OTHER_SWARM_NODE_IP> -j ACCEPT # Also this host's public IP is listed here (Created dynamically) -A INPUT -s <HOST_PUBLIC_IP> -j ACCEPT # Set the default INPUT policy to DROP -P INPUT DROP
Currently the Prometheus container cannot connect to the host that it's running on because of my
iptables rules, I logged the dropped packets and here's what I got:
Jul 27 13:21:40 node01 kernel: [60855.199560] IPTables-Dropped: IN=docker_gwbridge OUT= PHYSIN=vethe5b3d1e MAC=<MAC_ADDR> SRC=172.18.0.9 DST=<PUBLIC_HOST_IP> LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=57363 DF PROTO=TCP SPT=52882 DPT=9100 WINDOW=29200 RES=0x00 SYN URGP=0
So the source IP address is
172.18.0.9 which is part of the
docker_gwbridge network, this IP range is not accepted in my
My question is, should I add a rule to accept all the traffic from the
172.18.0.0/16? Of course this subnet might change on each host.
Should I add rules to allow all private IP addresses? Or should I allow all traffic incoming from the
-A INPUT -i docker_gwbridge -j ACCEPT
Which solution is better from a security perspective?