1

I have on my system many docker-containers with their own ports. Docker doing some magic with IPTables so its difficult to define some custom rules for it.
For only http-connections its not a problem with a reverse-proxy - so I can define my own rules (like a SYN flood protection) with an nginx running on host.

But now I want to run a nameserver as a docker-container. For protection of amplification-attacks I wrote a rule, but the docker-iptables-magic bypass this rule.

So I tried to trick around. I changed the published port for the nameserver to something else (5353). My plan was to make a rule like this

# rules defined via ferm

table filter {
   chain INPUT {
      POLICY DROP;

      # drop any-query for nameserver
      proto udp dport (53) {
         mod string from 40 algo bm hex-string "|0000ff0001|" DROP;

         # my old rule would jump to ACCEPT now
         ACCEPT;

         # but I think would be nice, when can route the packet now
         # routing isn't allowed here
         REDIRECT to-ports 5353;
      }
   }
}


table nat {
   chain PREROUTING {
      # I also tried to preroute the packet
      # but then will match the docker-rule again 
      # and I cant protect the port
      proto udp dport 53 REDIRECT to-ports 5353;
   }
}


Has anyone an idea? I accept also totally other solutions - is an UDP-relay an option?

1 Answer 1

1

I made it! @preserve was the keyword. This tells ferm to keep these chains untouched. Found it here https://www.lullabot.com/articles/convincing-docker-and-iptables-play-nicely

Here is my new config

#vars
@def $WG_PORT = XXX;
@def $TCP_PORTS = (80 443 22);


table filter {

    # keep docker-chains
    chain (DOCKER DOCKER-INGRESS DOCKER-ISOLATION-STAGE-1 DOCKER-ISOLATION-STAGE-2 FORWARD KUBE-FIREWALL DOCKER-USER) @preserve;    

    chain mainRules {
        #allow local and wireguard
        interface (lo wg0 docker0 br+) ACCEPT;
        source 127.0.0.1 ACCEPT;

        #keep connected
        mod conntrack ctstate (ESTABLISHED RELATED) jump ACCEPT;

        #icmp
        proto icmp {
            mod limit limit  10/minute limit-burst 10 ACCEPT;
            DROP;
        }

        # allow wireguard-traffic instant
        proto udp dport ($WG_PORT) ACCEPT;


        # drop any-query for nameserver when udp
        proto udp dport (53) {
            mod string from 40 algo bm hex-string "|0000ff0001|" DROP;
            ACCEPT;
        }

        #tcp
        proto tcp dport ($TCP_PORTS) {

            #prevent syn-flood, but accept other
            syn {
                mod limit limit 10/sec limit-burst 10 jump PREACCEPT;
                DROP;
            }

            jump ACCEPT;
        }
    }


    chain INPUT {
        policy DROP;
        jump mainRules;
    }

    chain OUTPUT {
        policy ACCEPT;
    }

    chain FORWARD {
        policy ACCEPT;
    }
}

table nat {

    chain (DOCKER DOCKER-INGRESS PREROUTING POSTROUTING OUTPUT DOCKER-USER KUBE-POSTROUTING) @preserve;
}

Now ferm and docker play very nicely together.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .