0

There is an apache server is started in a docker container and it acquires following IP address 172.21.0.3 The gateway IP and prefixlen is as follows 172.21.0.1/16 and the virtual interface attached to this IP is br-47b7ac758218.

The container listens on port 80 and it is not a published port also, just configured as an exposed port.

das@my-machine:~/go/src/secure$ sudo docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
b1a75fb4be73        test_httpserver     "bash -c '/etc/init.…"   18 hours ago        Up 41 minutes       80/tcp              test_httpserver_1

Now the use case is to stop the docker host machine any command or program to connect to http_server runnning conatiner. The host machine in which docker is running has the following IP 10.223.97.3/24

Following IPtable entry are added to stop docker host to connect to http server e.g. wget http://172.21.0.3/ should fail to connect. Below is the virtual gateway interface for the http-server based container.

das@das-All-Series:~/go/src/ElephantTrunkArch/docker_setup$ ifconfig br-47b7ac758218                                                                                                                         
br-47b7ac758218 Link encap:Ethernet  HWaddr 02:42:67:e3:1c:1a  
          inet addr:172.21.0.1  Bcast:172.21.255.255  Mask:255.255.0.0
          inet6 addr: fe80::42:67ff:fee3:1c1a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

Googled and refered Docker documentation but unfortunately none of the solution works.

Following IP table rules are applied but none of them works.

# Any input packet coming to gateway interface with source IP range of docker host should be dropped.
sudo iptables -I DOCKER-USER -s 10.223.97.0/24 -i br-47b7ac758218 -j DROP

This is what docker community suggests but didn't work

sudo iptables -I DOCKER-USER  -s 10.223.97.0/24 -i ext_if -j DROP

Tried this thinking that the packet might be referded as a forward pcaket as it starts from host machine and get forwarded to virtual bridge in IP layer, hence added a rule to drop all forward packet from 10.223.97.0/24

-A FORWARD ! -s 10.224.97.0/24 -o br-47b7ac758218 -j DROP
-A FORWARD ! -s 10.224.97.0/24 -i br-47b7ac758218 -j DROP

This too didn't work. wget command from docker host is bale to fetch the index.html file from apache server

$ wget http://172.21.0.3/
--2018-11-20 22:27:32--  http://172.21.0.3/
Connecting to 172.21.0.3:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 11321 (11K) [text/html]
Saving to: ‘index.html.8’

index.html.8                                        100%[================================================================================================================>]  11.06K  --.-KB/s    in 0s      

2018-11-20 22:27:32 (278 MB/s) - ‘index.html.8’ saved [11321/11321]

$ 
  • Intention here is to stop traffic to reach certain docker container which is originated from host machine (docker host) itself. – lalatendu das Nov 21 '18 at 6:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.