There is an apache server is started in a docker container and it acquires following IP address 172.21.0.3 The gateway IP and prefixlen is as follows 172.21.0.1/16 and the virtual interface attached to this IP is br-47b7ac758218.
The container listens on port 80 and it is not a published port also, just configured as an exposed port.
das@my-machine:~/go/src/secure$ sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES b1a75fb4be73 test_httpserver "bash -c '/etc/init.…" 18 hours ago Up 41 minutes 80/tcp test_httpserver_1
Now the use case is to stop the docker host machine any command or program to connect to http_server runnning conatiner. The host machine in which docker is running has the following IP 10.223.97.3/24
Following IPtable entry are added to stop docker host to connect to http server e.g. wget http://172.21.0.3/ should fail to connect. Below is the virtual gateway interface for the http-server based container.
das@das-All-Series:~/go/src/ElephantTrunkArch/docker_setup$ ifconfig br-47b7ac758218 br-47b7ac758218 Link encap:Ethernet HWaddr 02:42:67:e3:1c:1a inet addr:172.21.0.1 Bcast:172.21.255.255 Mask:255.255.0.0 inet6 addr: fe80::42:67ff:fee3:1c1a/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Googled and refered Docker documentation but unfortunately none of the solution works.
Following IP table rules are applied but none of them works.
# Any input packet coming to gateway interface with source IP range of docker host should be dropped. sudo iptables -I DOCKER-USER -s 10.223.97.0/24 -i br-47b7ac758218 -j DROP
This is what docker community suggests but didn't work
sudo iptables -I DOCKER-USER -s 10.223.97.0/24 -i ext_if -j DROP
Tried this thinking that the packet might be referded as a forward pcaket as it starts from host machine and get forwarded to virtual bridge in IP layer, hence added a rule to drop all forward packet from 10.223.97.0/24
-A FORWARD ! -s 10.224.97.0/24 -o br-47b7ac758218 -j DROP -A FORWARD ! -s 10.224.97.0/24 -i br-47b7ac758218 -j DROP
This too didn't work. wget command from docker host is bale to fetch the index.html file from apache server
$ wget http://172.21.0.3/ --2018-11-20 22:27:32-- http://172.21.0.3/ Connecting to 172.21.0.3:80... connected. HTTP request sent, awaiting response... 200 OK Length: 11321 (11K) [text/html] Saving to: ‘index.html.8’ index.html.8 100%[================================================================================================================>] 11.06K --.-KB/s in 0s 2018-11-20 22:27:32 (278 MB/s) - ‘index.html.8’ saved [11321/11321] $