Skip to content

Instantly share code, notes, and snippets.

@junjuew

junjuew/docker-firewall.sh

Last active August 19, 2019 05:12
Show Gist options
  • Save junjuew/7ad1f84465b9ed9623e1db4f0473e211 to your computer and use it in GitHub Desktop.
Save junjuew/7ad1f84465b9ed9623e1db4f0473e211 to your computer and use it in GitHub Desktop.
Download ZIP
Set up firewalls for docker container to allow internal/CMU IPs only
Raw
docker-firewall.sh
# in Docker >v17, DOCKER-USER chain is introduced. It is a
# iptable chain in FILTER table, called before DOCKER chain.
# By default, it accepts all connections.
# delete default return rule
sudo iptables -D DOCKER-USER -j RETURN
# allow default container and private subnet
sudo iptables -C DOCKER-USER -s 172.16.0.0/12 -j ACCEPT || sudo iptables -I DOCKER-USER 1 -s 172.16.0.0/12 -j ACCEPT
sudo iptables -C DOCKER-USER -s 192.168.0.0/16 -j ACCEPT || sudo iptables -I DOCKER-USER 1 -s 192.168.0.0/16 -j ACCEPT
sudo iptables -C DOCKER-USER -s 10.0.0.0/8 -j ACCEPT || sudo iptables -I DOCKER-USER 1 -s 10.0.0.0/8 -j ACCEPT
# allow CMU ips
sudo iptables -C DOCKER-USER -s 128.2.0.0/16 -j ACCEPT || sudo iptables -I DOCKER-USER 1 -s 128.2.0.0/16 -j ACCEPT
sudo iptables -C DOCKER-USER -s 128.237.0.0/16 -j ACCEPT || sudo iptables -I DOCKER-USER 1 -s 128.237.0.0/16 -j ACCEPT
# allow established connections
sudo iptables -C DOCKER-USER -m state --state ESTABLISHED,RELATED -j ACCEPT || sudo iptables -A DOCKER-USER -m state --state ESTABLISHED,RELATED -j ACCEPT
# reject all other ips
sudo iptables -C DOCKER-USER -j DROP || sudo iptables -A DOCKER-USER -j DROP
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment