3

I'm hosting a web app on a Ubuntu 16.04. All components of this app are inside Docker containers, most of them only need to communicate between each other but not to the outside world (like PostgreSQL or ElasticSearch). For instance ElasticSearch expose by default it's plugin interface on port 9200.

As the admin, I need to have access to these interfaces but I want to limit it to my work computer only.

I've tried following instructions to allow only a specific IP for a port, but it seems that Docker overrides my rules:

## ALLOW specific ports only on ONE IP address:
# ElasticSearch
iptables -I INPUT -p tcp -s MyWorkIP --dport 9200 -j ACCEPT
iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 9200 -j DROP
iptables -I INPUT -p tcp -s MyWorkIP --dport 9300 -j ACCEPT
iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 9300 -j DROP
iptables -I INPUT -p tcp -s MyWorkIP --dport 5601 -j ACCEPT
iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 5601 -j DROP
# PostgreSQL
iptables -I INPUT -p tcp -s MyWorkIP --dport 5432 -j ACCEPT
iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 5432 -j DROP

I'm testing everything by trying to access the specific page:port from my work computer (MyWorkIP in the script) and from my phone (dynamic IP) but any attempt grants me access from both devices. What I need is that any other IP than MyWorkIP is refused; so my phone would not get access.

I'm not very good at IPtables configuration so I'm not sure where to begin my investigation... (I have no X installed on this server: I do everything in a term)

Any thoughts / ideas ?

0

I managed to make it work with this :

drop all connections (inbound and outbound) except those from ipyouwanttoallow
    iptables -I DOCKER ! -s ipyouwanttoallow -j DROP
accept all connections from your container local IP to the world
    iptables -I DOCKER -s localipofyourcontainer -d 0.0.0.0/0 -j ACCEPT
necessary to allow external servers to answer your container requests
    iptables -I DOCKER  -m state --state ESTABLISHED,RELATED -j ACCEPT
| improve this answer | |
  • Sorry, I didn't realize I did not "solve" this question ! Indeed @mickael, your solution is pretty much what I've done on my side. Thanks for replying after so much time and giving an explicit answer: I'm sure it will help other in the same situation ! – gfd Jun 29 '17 at 15:40
0

There are two likely issues:

  • You need to enable forwarding on the interfaces or by default.
  • You will need to port forward from your phone, and possibly from your work_ip.

Consider using a firewall builder tool to build your firewall rules. I prefer using shorewall as it is well documented, has good example configurations, and is configured with files. ufw is an alternative. Both are available as Ubuntu packages.

You may be able to use a tunnel or proxy to provide your access.

| improve this answer | |
  • There's also firewalld with firewall-config GUI. – user147505 Aug 12 '16 at 8:15
  • Sorry, I realize I wasn't very clear: what I'm trying to do is limit access to these ports to only MyWorkIp : other IP requests would be dropped. So my phone is a test device: it should be refused access all the time. About the GUI, sorry but I have no X installed on this server and would prefer doing everything by script as it helps me understand what I'm doing... (I edited my question) Thanks for the fast answer ! – gfd Aug 12 '16 at 11:12
  • @gdf Limiting access is part of what a firewall does. It is trivial to specify forward port X for connections from a specific IP, list of IPs, or subnet. In your case you need to allow forwarding from your work IP. The Shorewall configuration require you specify the requirements and generate the firewall and apply policies. It is easy to display the resulting firewall or rules. However, if your work IP is on the same network, you may just need to enable forwarding with sysconfig and possibly SNAT ports. – BillThor Aug 12 '16 at 13:40
  • @BillThor My whole point was "I'm trying any idea but all my attempts are failing" so, yes, I know it's probably "trivial" and "easy" for anybody who has done this several time in the past, but that wasn't my case.... Thanks for replying though – gfd Jun 29 '17 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.