IPTables - Allow Docker port forwarding only for specific IP address

Question

I'm hosting a web app on a Ubuntu 16.04. All components of this app are inside Docker containers, most of them only need to communicate between each other but not to the outside world (like PostgreSQL or ElasticSearch). For instance ElasticSearch expose by default it's plugin interface on port 9200.

As the admin, I need to have access to these interfaces but I want to limit it to my work computer only.

I've tried following instructions to allow only a specific IP for a port, but it seems that Docker overrides my rules:

## ALLOW specific ports only on ONE IP address:
# ElasticSearch
iptables -I INPUT -p tcp -s MyWorkIP --dport 9200 -j ACCEPT
iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 9200 -j DROP
iptables -I INPUT -p tcp -s MyWorkIP --dport 9300 -j ACCEPT
iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 9300 -j DROP
iptables -I INPUT -p tcp -s MyWorkIP --dport 5601 -j ACCEPT
iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 5601 -j DROP
# PostgreSQL
iptables -I INPUT -p tcp -s MyWorkIP --dport 5432 -j ACCEPT
iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 5432 -j DROP

I'm testing everything by trying to access the specific page:port from my work computer (MyWorkIP in the script) and from my phone (dynamic IP) but any attempt grants me access from both devices. What I need is that any other IP than MyWorkIP is refused; so my phone would not get access.

I'm not very good at IPtables configuration so I'm not sure where to begin my investigation... (I have no X installed on this server: I do everything in a term)

Any thoughts / ideas ?

Answer 1

I managed to make it work with this :

drop all connections (inbound and outbound) except those from ipyouwanttoallow

    iptables -I DOCKER ! -s ipyouwanttoallow -j DROP

accept all connections from your container local IP to the world

    iptables -I DOCKER -s localipofyourcontainer -d 0.0.0.0/0 -j ACCEPT

necessary to allow external servers to answer your container requests

    iptables -I DOCKER  -m state --state ESTABLISHED,RELATED -j ACCEPT

Answer 2

There are two likely issues:

• You need to enable forwarding on the interfaces or by default.
• You will need to port forward from your phone, and possibly from your work_ip.

Consider using a firewall builder tool to build your firewall rules. I prefer using shorewall as it is well documented, has good example configurations, and is configured with files. ufw is an alternative. Both are available as Ubuntu packages.

You may be able to use a tunnel or proxy to provide your access.