Iptables – Forward one IP to a docker container

dockeriptablesnetworking

As far as I understood, docker run containers with their own IPs, and fully open ports, on the bridge interface docker0.

Let's say I launch a container, and it has its own IP: 172.17.0.11, and I have a virtual ethernet interface, eth0.1, with public IP 93.x.x.x

How do I forward eth0.1 to the docker container, so that I can reach the container via eth0.1 IP?

Can I forward all ports at once? (maybe with a script)

How do I disable docker default behavior, so that each container only gets an IP on docker0 interface, and I manually setup forwarding?

@Xavierlucas

I linked it because I thought it was explained better over there. If you check the debian config, I add to the /etc/net/interfaces file this:

post-up /sbin/ifconfig eth0:X IP.OF.FAIL.OVER netmask 255.255.255.255 broadcast IP.OF.FAIL.OVER
post-down /sbin/ifconfig eth0:X down

this way I have a virtual interface (eth0:0), which has a public IP forwarded by my provider. I think the routing is done by the provider,as there are no additional routes or configs on my server

Note:

There is a followup question

why port forwarding is not working in this setup?

Best Answer

Firstly you wouldn't want to forward all ports at once, as then you wouldn't necessarily still have access to the host. This should definitely be a manual process.

I expect that you have a web service running in your Docker container, so if you wish to forward, for example port 80 from your eth0.1 IP address to the Docker container's IP address you could use the following iptables rule;

iptables -A PREROUTING -t nat -i eth0.1 -p tcp --dport 80 -j DNAT --to 172.17.0.11:80
iptables -A FORWARD -p tcp -d 172.17.0.11 --dport 80 -j ACCEPT

These rules can then be modified for any other ports/docker containers as required.

Related Solutions

Limit Outside Connections to Docker Container with Iptables

Two things to bear in mind when working with docker's firewall rules:

To avoid your rules being clobbered by docker, use the DOCKER-USER chain
Docker does the port-mapping in the PREROUTING chain of the nat table. This happens before the filter rules, so --dest and --dport will see the internal IP and port of the container. To access the original destination, you can use -m conntrack --ctorigdstport.

For example:

iptables -A DOCKER-USER -i eth0 -s 8.8.8.8 -p tcp -m conntrack --ctorigdstport 3306 --ctdir ORIGINAL -j ACCEPT
iptables -A DOCKER-USER -i eth0 -s 4.4.4.4 -p tcp -m conntrack --ctorigdstport 3306 --ctdir ORIGINAL -j ACCEPT
iptables -A DOCKER-USER -i eth0 -p tcp -m conntrack --ctorigdstport 3306 --ctdir ORIGINAL -j DROP

NOTE: Without --ctdir ORIGINAL, this would also match the reply packets coming back for a connection from the container to port 3306 on some other server, which is almost certainly not what you want! You don't strictly need this if like me your first rule is -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT, as that will deal with all the reply packets, but it would be safer to still use --ctdir ORIGINAL anyway.

Iptables – Route outgoing connections from a docker container through a specific IP

eth0 -> 192.168.0.1

eth0:1 -> 192.168.0.2

eth0:2 -> 192.168.0.3

eth0:3 -> 192.168.0.4

docker run --name=web01 -p 192.168.0.1:80:80 ....

docker run --name=web02 -p 192.168.0.2:80:80 ....

docker run --name=web03 -p 192.168.0.3:80:80 ....

docker run --name=web04 -p 192.168.0.4:80:80 ....

They will be created DNAT rules:

Chain DOCKER (2 references) pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- !docker0 * 0.0.0.0/0 192.168.0.1 tcp dpt:80 to:172.17.0.1:80

pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- !docker0 * 0.0.0.0/0 192.168.0.2 tcp dpt:80 to:172.17.0.2:80

...

traffic generated container falls under the rule:

Chain POSTROUTING (policy ACCEPT 430M packets, 26G bytes) pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0

p.s.

In linux we can use many ip without alias

ip a a 192.168.0.1/24 dev eth0

ip a a 192.168.0.2/24 dev eth0 ....

Best Answer

Related Solutions

Limit Outside Connections to Docker Container with Iptables

Iptables – Route outgoing connections from a docker container through a specific IP

Related Topic