0

I have a postgreSQL database inside of Docker that I don't want to expose it to the host network as it causes all users to see the exposed database port. (For now I don't have a pfsense or anything like that).

The whole configuration of iptables is as below:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  0.0.0.0/0            0.0.0.0/0
DOCKER-ISOLATION-STAGE-1  all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
Chain DOCKER (2 references)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.2           tcp dpt:15672
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.18          tcp dpt:8081
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.19          tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.19          tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.8           tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.13          tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.11          tcp dpt:5432
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target     prot opt source               destination
DROP       all  --  0.0.0.0/0            0.0.0.0/0
DROP       all  --  0.0.0.0/0            0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
Chain DOCKER-USER (1 references)
target     prot opt source               destination  

What I did was to expose database inside of docker to the host on the same port:

0.0.0.0:5432:5432

And in iptables I dropped all the connections and just added ACCEPT for my ip addresses 111.111.111.111 and 222.222.222.222. it was explained in the link below:

So I issued the commands below:

iptables -I DOCKER-USER -s 111.111.111.111 -p tcp --dport 5432 -j ACCEPT
iptables -I DOCKER-USER -s 222.222.222.222 -p tcp --dport 5432 -j ACCEPT
iptables -I DOCKER-USER -p tcp --dport PORT_X -j REJECT --reject-with icmp-port-unreachable

With the above configuration I could not telnet from 222.222.222.222 to port 5432.

Please do note that I've added the rules to docker chains.

I could not understand why this has happened and I could not telnet to the port from first and the second IP address. Is there something wrong in my configuration?

  • Can you add an explanation of what you are trying to achieve (Now how). I think you are over complicating it. – ctrl-alt-delor Apr 15 at 10:54
  • @ctrl-alt-delor I have a port for postgreSQL: 5432 - I want to expose this port to 2 ip addresses not to public internet. That's all I want to do. Just be aware that postgreSQL is inside of docker and docker uses the iptables to handle its networking. – ALH Apr 15 at 10:57
  • By default, nothing running in a Docker container is accessible from anywhere except the host. When you attach the container port to a host port, then anyone who has access to the host ip address can generally access the port. Once you have attached the container port to the host port, you would use iptables to restrict access to the port normally in the INPUT chain. – GracefulRestart Apr 15 at 19:37
  • @GracefulRestart how should I do that? – ALH Apr 16 at 5:07
0

White-listing IP addresses is not very secure: IP spooking can easily be used to get around it.

Manually configuring IPTables is over engineering the problem, and not necessary.

Configure your container to use a Unix-socket (in place of the IP-socket). This gives you more control over permissions. You can then use ssh to securely tunnel in and forward the port to you local machine (to another Unix-socket, or to an IP-socket).

  • So for each IP I should issue a command for ssh tunneling to that specific ip address and put it inside of a tmux? Are we on the same page? – ALH Apr 15 at 11:15
  • No have the user/machine that wants to connect to the server tunnel in. – ctrl-alt-delor Apr 15 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.