There is an apache server is started in a docker container and it acquires following IP address The gateway IP and prefixlen is as follows and the virtual interface attached to this IP is br-47b7ac758218.

The container listens on port 80 and it is not a published port also, just configured as an exposed port.

das@my-machine:~/go/src/secure$ sudo docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
b1a75fb4be73        test_httpserver     "bash -c '/etc/init.…"   18 hours ago        Up 41 minutes       80/tcp              test_httpserver_1

Now the use case is to stop the docker host machine any command or program to connect to http_server runnning conatiner. The host machine in which docker is running has the following IP

Following IPtable entry are added to stop docker host to connect to http server e.g. wget should fail to connect. Below is the virtual gateway interface for the http-server based container.

das@das-All-Series:~/go/src/ElephantTrunkArch/docker_setup$ ifconfig br-47b7ac758218                                                                                                                         
br-47b7ac758218 Link encap:Ethernet  HWaddr 02:42:67:e3:1c:1a  
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::42:67ff:fee3:1c1a/64 Scope:Link

Googled and refered Docker documentation but unfortunately none of the solution works.

Following IP table rules are applied but none of them works.

# Any input packet coming to gateway interface with source IP range of docker host should be dropped.
sudo iptables -I DOCKER-USER -s -i br-47b7ac758218 -j DROP

This is what docker community suggests but didn't work

sudo iptables -I DOCKER-USER  -s -i ext_if -j DROP

Tried this thinking that the packet might be referded as a forward pcaket as it starts from host machine and get forwarded to virtual bridge in IP layer, hence added a rule to drop all forward packet from

-A FORWARD ! -s -o br-47b7ac758218 -j DROP
-A FORWARD ! -s -i br-47b7ac758218 -j DROP

This too didn't work. wget command from docker host is bale to fetch the index.html file from apache server

$ wget
--2018-11-20 22:27:32--
Connecting to connected.
HTTP request sent, awaiting response... 200 OK
Length: 11321 (11K) [text/html]
Saving to: ‘index.html.8’

index.html.8                                        100%[================================================================================================================>]  11.06K  --.-KB/s    in 0s      

2018-11-20 22:27:32 (278 MB/s) - ‘index.html.8’ saved [11321/11321]

  • Intention here is to stop traffic to reach certain docker container which is originated from host machine (docker host) itself. – lalatendu das Nov 21 '18 at 6:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.