FirewallD and docker: block a port from being publicly accessible

Question

I am having some issues trying to restrict access to 2 docker containers I am currently running using Centos8 and Firewalld. First of all, the containers have the following configuration:

services:
  service1:
    ports:
      - 1234:1234
  service2:
    ports:
      - 6969:6969

The docker zone has the following (default)configuration:

docker (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: br-b2ef50b272a2 docker0
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:

When leaving things like this, if I run docker-compose up, the apps are running and there is communication between them but their ports are also accessible through the public internet. My end goal is to have intra communication between the apps, but block access to their ports from the public and only allow specific IPs. What I have done so far and did not work:

1. First of all I tried changing the target of the docker zone to default That only broke the communication between the 2 applications, and nothing else
2. Added a rich rule: rule family="ipv4" source NOT address="X.X.X.X" port port="6969" protocol="tcp" reject The rule gets ignored.

Is there a way to block access to those ports using FirewallD and docker zone, while at the same the 2 services can communicate with each other?

Answer 1

You can add a reverse proxy service to your setup, then stop exposing the service1 & service2 ports and let the reverse proxy filter the traffic.

If you don't expose the ports the containers can still talk to each other (in the same docker network) and resolve the IPs by service names via the built-in docker DNS. (Ex. service1, service2).

In that case your compose file would roughly look like this:

services:
  service1:

  service2:

  proxy:
    ports:
      - 80:80
      - 443:443
      - <extra ports>:<extra ports>

For example you can use an nginx container with the extra config: (just make sure the proxy is configured to listen on the external ports you specify under it's service.):

location /service1 {
    allow X.X.X.X;
    deny  all;
    proxy_pass http://service1:1234;
}

location /service2 {
    allow X.X.X.X;
    deny  all;
    proxy_pass http://service2:6969;
}

Alternatively you can create two "server" directives under the nginx config each listening on one of the service ports and then passing traffic via the root location ("/") if you don't want to add a path to the URL.

This will additionally allow you to run multiple copies of you services, all listening on the same ports while still being able to expose them (and filter traffic) via the reverse proxy.