by Devin Yang
(This article was automatically translated.)

Published - 2 years ago ( Updated - 2 years ago )

First of all, in the Linux environment, Docker uses iptables rules to provide network isolation.
However, in the environment of Docker swarm mode, we cannot identify the connection port under 127.0.0.1 of the host.
At this time, we can customize the rules through the DOCKER-USER chain in iptables.

Docker installs two custom iptables chains named DOCKER-USER and DOCKER, which ensures that incoming packets are always inspected first by these two chains.

All iptables rules for Docker are added to the DOCKER chain. Do not manipulate this chain manually.

If you need to add rules that load before Docker rules,

use the DOCKER-USER chain. These rules are enabled before any rules created automatically by Docker.

For example, my nginx has opened port 8081, which represents the input host's ip, adding port 8081 can access the host.

cyh3692mbacl   dlaravel_web          replicated   4/4        nginx:latest      *:8081->80/tcp

But in fact, I prefer to access the host through HAProyx, instead of opening the host's ip and port 8081 to access it. The solution is to adjust iptables.

We can use the following command to view the previous rules

iptables -nL DOCKER-USER
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Basically it is completely open, we can write a bash as follows, please note that this is just an example, please adjust it according to your own needs.
This example includes different network segments or specific IP and network card.

#!/bin/bash
iptables -F DOCKER-USER
#全檔只能用本機的ip存取
iptables -I DOCKER-USER -p tcp -m multiport --dports 8025,8084,30001,30020 -j DROP
#鎖區網在可以連
iptables -I DOCKER-USER -i eno1 ! -s 10.0.0.26 -p tcp -m multiport --dports 8080,8081 -j DROP
iptables -I DOCKER-USER -i eno2 ! -s 192.168.88.0/24 -p tcp -m multiport --dports 3306,2222,1024 -j DROP
iptables -A DOCKER-USER -j RETURN
#列出規則
iptables -nL DOCKER-USER

At the beginning I cleared all rules first

iptables -F DOCKER-USER

I won't say much about the rest, I believe everyone can guess it.

 

 

Tags: docker

Devin Yang

Feel free to ask me, if you don't get it.:)

No Comment

Post your comment

Login is required to leave comments

Similar Stories


dlaravel,docker

D-Laravel learning three stages

Chat about the three stages of using D-Laravel, why use D-Laravel. Because the configuration files used by D-Laravel are quite simple, it is very suitable for beginners of Docker to learn, And users who do not know how to use Docker can also use the two commands ./console and ./create to create a project.

docker, d-laravel, docker-compose, laravel

docker-compose loads multiple configuration files

We will use docker --network to establish multiple container interconnections, but if there are four containers, Is it necessary to issue docker run instructions for different containers four times, kill me, This article introduces the establishment of multiple containers at one time through the yaml file definition of docker-compose. Learn how to load multiple configuration files with the dokcer-compose -f parameter.  

docker

How to start HAProxy with Docker on Raspberry

Raspberry is very cheap and has quite a lot of applications, for example, some people use it as a Wi-Fi router, For game consoles, monitors and many other IoT-related applications, I use it as a HAProxy. Long story short, since I have an old Windows server running old versions of PHP and Apache, and can't set up HTTPS certificates, I wanted to say Help through HAProxy. Let this old server also have https URL, So to share my docker-compose.yml configuration.