Cấu hình Iptables với Docker Container
Cấu hình Iptables với Docker Container
Để hiểu cách thức hoạt động của Iptables các bạn có thể đọc hướng dẫn link:
https://fixloinhanh.com/tim-hieu-iptables/
1./ Ví dụ: Restrict connections to the Docker host
By default, all external source IPs are allowed to connect to the Docker host. To allow only a specific IP or network to access the containers, insert a negated rule at the top of the DOCKER-USER filter chain. For example, the following rule restricts external access from all IP addresses except 192.168.1.1:
iptables -I DOCKER-USER -i ext_if ! -s 192.168.1.1 -j DROP
Please note that you will need to change ext_if to correspond with your host’s actual external interface. You could instead allow connections from a source subnet. The following rule only allows access from the subnet 192.168.1.0/24:
iptables -I DOCKER-USER -i ext_if ! -s 192.168.1.0/24 -j DROP
Finally, you can specify a range of IP addresses to accept using --src-range (Remember to also add -m iprange when using --src-range or --dst-range):
iptables -I DOCKER-USER -m iprange -i ext_if ! --src-range 192.168.1.1-192.168.1.3 -j DROP
You can combine -s or --src-range with -d or --dst-range to control both the source and destination. For instance, if the Docker daemon listens on both 192.168.1.99 and 10.1.2.3, you can make rules specific to 10.1.2.3 and leave 192.168.1.99 open.
iptables is complicated and more complicated rules are out of scope for this topic. See the Netfilter.org HOWTO for a lot more information.
2./ Ví dụ 2: Docker on a router
Docker also sets the policy for the FORWARD chain to DROP. If your Docker host also acts as a router, this will result in that router not forwarding any traffic anymore. If you want your system to continue functioning as a router, you can add explicit ACCEPT rules to the DOCKER-USER chain to allow it:
$ iptables -I DOCKER-USER -i src_if -o dst_if -j ACCEPT
ví dụ khác với các chain cho container
# FORWARD chain
-A FORWARD -o br-b8e25922a2fa xxx
-A FORWARD -o docker0 xxx# DOCKER's chains
-A DOCKER xxx
-A DOCKER-ISOLATION-STAGE-1 xxx
-A DOCKER-ISOLATION-STAGE-2 xxx
-A DOCKER -d 172.18.0.2/32 xxx# NAT
-A POSTROUTING -s -s 172.18.0.2/32 xxx
3./ Ví dụ: Allow range IP 172.16.0.0/26 kết nối đến port 443 state connection tcp new
iptables -A INPUT -p tcp --dport 443 -s 172.16.0.0/26 -m state --state NEW,ESTABLISHED
Tất nhiên là cần 1 Rule deny all đặt ở cuối cùng
iptables -A INPUT -j DROP
Với docker container
iptables -A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp — dport 443 -j ACCEPT
4./ Chặn mọi kết nối ngoại trừ local đến 1 cổng trên container.
chặn mọi kết nối từ bên ngoài đến cổng 9272 giao thức tcp.
-I DOCKER-USER -i ens160 ! -s 127.0.0.1 -p tcp --dport 9272 -j DROP
Lưu ý: Interface bị chặn là Interface vật lý.
5./ Tham khảo
https://fixloinhanh.com
https://docs.docker.com/network/iptables/
https://medium.com/@ebuschini/iptables-and-docker-95e2496f0b45
https://medium.com/swlh/manage-iptables-firewall-for-docker-kubernetes-daa5870aca4d
https://www.jeffgeerling.com/blog/2020/be-careful-docker-might-be-exposing-ports-world
