0

I need to block all INPUT traffic to port 8090 on the Ubuntu server 16.04. I used Iptables but it did not work. Commands I used:

iptables -A INPUT -p tcp --dport 8090 -j DROP iptables -A INPUT -p tcp --dport 8090 -s <IP> -j ACCEPT

In NAT I have: Chain DOCKER (2 references) target prot opt source destination DNAT tcp -- anywhere <VM local IP> tcp dpt:8090 to:172.21.0.2:8080

Public interface named eth0 and docker interface named docker0

0

Because of DNAT you're now routing. Your INPUT chain isn't used anymore for this DNATed traffic and it's now the FORWARD chain that is traversed instead. The new destination is 172.21.0.2:8080 and that's what the rules should now care about, not <VM local IP>:8090 anymore.

So with DNAT in place, you should block your traffic with (in the right order: allow exception, then forbid everything else):

iptables -A FORWARD -s <IP> -d 172.21.0.2 -p tcp --dport 8080 -j ACCEPT
iptables -A FORWARD -d 172.21.0.2 -p tcp --dport 8080 -j DROP

To be sure it's actually done before any system rule, you could do:

iptables -I FORWARD 1 -s <IP> -d 172.21.0.2 -p tcp --dport 8080 -j ACCEPT
iptables -I FORWARD 2 -d 172.21.0.2 -p tcp --dport 8080 -j DROP

Those rules as is might prevent other containers to reach this container depending on configuration, so you might have to adapt them (by stating the external input interface for example). Anyway you have to find a way to integrate this nicely with the system's method of firewall.

| improve this answer | |
0

about these lines:

iptables -A INPUT -p tcp --dport 8090 -j DROP
iptables -A INPUT -p tcp --dport 8090 -s <IP> -j ACCEPT

you should change order of those, because IPTables rules overwrite each other in conflict state and it is a correct way, so first correct these and check all other roles to prevent of overwriting.

regarding NAT part of your question, it is not clear, however, on docker you should assign port while you up a container:

docker run ... -p 8090:8080 ... 
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.