Iptables – How to restrict external access to ports exposed by Docker containers, while still allowing links to work

dockerdocker-composeiptableslinux-networkingnetworking

I have a couple services running on a machine in docker containers that need to be available to a specific IP address, and need to be available to containers with links (as defined in a docker-compose file). I've tried these commands, but this seems to also drop packets from containers on the same docker network:

iptables -I DOCKER-USER ! -s 8.8.8.8/32 -p tcp -m tcp --dport 1234 -j DROP

iptables -I DOCKER-USER ! -s 8.8.8.8/32 -p tcp -m tcp --dport 12345 -j DROP

How can I set up iptables to drop packets going to ports 1234 and 12345 from all ip addresses, except 8.8.8.8 and any container with links (as defined in a docker-compose file)?

docker-compose seems to create a bridge interface, and a lot of virtual interfaces with random names (one for each container?).

Here is the docker-compose.yml file I'm using:

version: '3'
services:
    django:
        build: .
        image: django
        depends_on:
            - mysql-db
            - sel
        ports:
            - "80:54321"
        links:
            - mysql-db
            - sel
            - rabbit
            - redis
        volumes:
            - vol1:/media/DataRaid1/vol1
            - /etc/secret_key.txt:/etc/secret_key.txt
            - django-media:/var/www/media
        environment:
            - DJANGO_SETTINGS_MODULE=a_project.settings_production
            - COMMIT
        command: httpd-foreground"
    mysql-db:
        image: mysql:5.7.18
        environment:
            - MYSQL_ROOT_PASSWORD=APASSWORD
        volumes:
            - mysql-data:/var/lib/mysql
            - ./custom-mysql.cnf:/etc/mysql/conf.d/custom-mysql.cnf
    sel:
        image: "selenium/standalone-chrome"
        volumes: #Fixes bug https://github.com/elgalu/docker-selenium/issues/20
            - /dev/shm:/dev/shm
    # Redis
    redis:
        image: redis:4.0.9
        hostname: redis
        ports:
            - "1234:1234"

    # RabbitMQ
    rabbit:
        hostname: rabbit
        image: rabbitmq
        environment:
            - RABBITMQ_DEFAULT_USER=AUSER
            - RABBITMQ_DEFAULT_PASS=APASSWORD
        ports:
            - "12345:12345"
    # Celery worker
    worker:
        build: .
        command: bash -c "sleep 10 && celery worker -A a_project.celeryconf -Q default -n default@%h"
        volumes:
          - .:/var/www
        links:
          - mysql-db
          - rabbit
          - redis
        depends_on:
          - rabbit
        environment:
            - DJANGO_SETTINGS_MODULE=a_project.settings_production
            - C_FORCE_ROOT=true
volumes:
    vol1:
    mysql-data:
    django-media:

Best Answer

  1. Use Network mode for each container:

    network_mode: "host"

  2. Use ports with binding to 127.0.0.1 + some proxy container:

    ports:
  - "127.0.0.1:12345:12345"

  3. Do not use ports at all + some proxy container

  4. Add iptables rule to appropriate docker chain, not sure which one right now ...
Related Topic