我如何通过docker配置iptables策略以阻止外部ip

Question

我正在尝试限制从外部IP访问容器。我在https://docs.docker.com/network/iptables/关注了Docker文档，但无法正常工作。

我创建了一个桥接网络：

docker network create -d bridge --subnet 172.19.0.0/24 --opt com.docker.network.bridge.name=br-mynet mynet

然后，我运行容器，将Docker-compose与先前的网络组成。比我能看到的iptables规则还多：

~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (2 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             172.19.0.2           tcp dpt:postgresql
ACCEPT     tcp  --  anywhere             172.19.0.3           tcp dpt:omniorb
ACCEPT     tcp  --  anywhere             172.19.0.3           tcp dpt:8086
ACCEPT     tcp  --  anywhere             172.19.0.6           tcp dpt:https
ACCEPT     tcp  --  anywhere             172.19.0.7           tcp dpt:https
ACCEPT     tcp  --  anywhere             172.19.0.9           tcp dpt:8888
ACCEPT     tcp  --  anywhere             172.19.0.12          tcp dpt:https
ACCEPT     tcp  --  anywhere             172.19.0.8           tcp dpt:3000
ACCEPT     tcp  --  anywhere             172.19.0.5           tcp dpt:9092
ACCEPT     tcp  --  anywhere             172.19.0.4           tcp dpt:http-alt

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

在此步骤中，所有外部IP都可以连接到位于172.19.0.x的所有主机容器。然后我按照文档中所述应用docker规则，以仅接受来自10.223.20.173的连接：

iptables -I DOCKER-USER -i br-mynet ! -s 10.223.20.173 -j DROP

这意味着只有外部10.223.20.173可以连接到容器。 iptables规则变为：

~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (2 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             172.19.0.2           tcp dpt:postgresql
ACCEPT     tcp  --  anywhere             172.19.0.3           tcp dpt:omniorb
ACCEPT     tcp  --  anywhere             172.19.0.3           tcp dpt:8086
ACCEPT     tcp  --  anywhere             172.19.0.6           tcp dpt:https
ACCEPT     tcp  --  anywhere             172.19.0.7           tcp dpt:https
ACCEPT     tcp  --  anywhere             172.19.0.9           tcp dpt:8888
ACCEPT     tcp  --  anywhere             172.19.0.12          tcp dpt:https
ACCEPT     tcp  --  anywhere             172.19.0.8           tcp dpt:3000
ACCEPT     tcp  --  anywhere             172.19.0.5           tcp dpt:9092
ACCEPT     tcp  --  anywhere             172.19.0.4           tcp dpt:http-alt

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
DROP       all  -- !10.223.20.173        anywhere
RETURN     all  --  anywhere             anywhere

但是使用此配置，ip 10.223.20.173无法连接到容器。总的来说，当我应用不带负号！的规则时，该ip连接成功。但这应该是另一回事。

感谢任何帮助！

Answer 1

我认为接下来会发生什么。您有一个“盒子”，其接口连接到外部网络，例如eth0，而您的接口连接到docker网络，即br-mynet：

                +---------------------------+
[internet]<---> | (eth0) <-> (br-mynet)     |
                |                ⇵          |
                |            [docker hosts] |
                +---------------------------+

您正在尝试从图像中的左到右阻止来自Internet到Docker主机的数据包。他们正在输入eth0并转发到br-mynet。

您正在添加一个匹配的规则：

• 来源！ 10.223.20.173
• 传入接口：br-mynet

因此，您实际上匹配的是来自docker的数据包，其源地址不同于10.223.20.173（即任何数据包），并且正在阻止这些响应。

请尝试：

iptables -I DOCKER-USER -i eth0 -o br-mynet ! -s 10.223.20.173 -j DROP