Created
December 26, 2018 21:46
-
-
Save gdm/053a3f786cee5e4d688ac056ec7c4bb7 to your computer and use it in GitHub Desktop.
iptables modified by docker when nginx container is running
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [root@bigben audit]# iptables --line-numbers -n -L -t nat | |
| Chain PREROUTING (policy ACCEPT) | |
| num target prot opt source destination | |
| 1 DOCKER all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL | |
| Chain INPUT (policy ACCEPT) | |
| num target prot opt source destination | |
| Chain OUTPUT (policy ACCEPT) | |
| num target prot opt source destination | |
| 1 DOCKER all -- 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL | |
| Chain POSTROUTING (policy ACCEPT) | |
| num target prot opt source destination | |
| 1 MASQUERADE all -- 172.17.0.0/16 0.0.0.0/0 | |
| 2 MASQUERADE tcp -- 172.17.0.2 172.17.0.2 tcp dpt:80 | |
| Chain DOCKER (2 references) | |
| num target prot opt source destination | |
| 1 RETURN all -- 0.0.0.0/0 0.0.0.0/0 | |
| 2 DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:172.17.0.2:80 | |
| [root@bigben audit]# iptables --line-numbers -n -L | |
| Chain INPUT (policy ACCEPT) | |
| num target prot opt source destination | |
| Chain FORWARD (policy DROP) | |
| num target prot opt source destination | |
| 1 DOCKER-ISOLATION all -- 0.0.0.0/0 0.0.0.0/0 | |
| 2 DOCKER all -- 0.0.0.0/0 0.0.0.0/0 | |
| 3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED | |
| 4 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 | |
| 5 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 | |
| Chain OUTPUT (policy ACCEPT) | |
| num target prot opt source destination | |
| Chain DOCKER (1 references) | |
| num target prot opt source destination | |
| 1 ACCEPT tcp -- 0.0.0.0/0 172.17.0.2 tcp dpt:80 | |
| Chain DOCKER-ISOLATION (1 references) | |
| num target prot opt source destination | |
| 1 RETURN all -- 0.0.0.0/0 0.0.0.0/0 | |
| [root@bigben audit]# docker ps | |
| CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES | |
| ba58a2b3e168 nginx "nginx -g 'daemon ..." 43 minutes ago Up 22 minutes 0.0.0.0:80->80/tcp mynginx1 |
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
https://serverfault.com/questions/704643/steps-for-limiting-outside-connections-to-docker-container-with-iptables
https://docs.docker.com/network/iptables/#restrict-connections-to-the-docker-daemon