4 ms·
> I learned the hard way that 3306:3306 will automatically add a rule to open the firewall on linux and make MySQL publicly accessible. Is that true? 3306:3306
by BossingAround 6y ago
> I learned the hard way that 3306:3306 will automatically add a rule to open the firewall on linux and make MySQL publicly accessible.
Is that true? 3306:3306 would bind the port on all interfaces, but I was under the assumption you'd have to explicitly enable firewall port 3306 for the machine to accept traffic to port 3306 from outside of your machine.
I'll have to test that.
- blago 6y agohttps://github.com/docker/for-linux/issues/690 https://github.com/docker/for-linux/issues/690
- isbvhodnvemrwvn 6y agoFrom memory and a quick glance at one of my servers: When an IP packet related to your container arrives (<host ip>:<host port>): - docker rewrites it to target <your container's ip address>:<your container's port> (NAT table, chain PREROUTING delegates to DOCKER chain with the relevant DNAT entry) - since the IP does not match your host, the packet is forwarded (there's a relevant routing entry pointing to docker's virtual interface) - the first thing you encounter in the FORWARD chain of the FILTER table is a few jumps to the docker-related chains, DOCKER chain in particular accepts all packets destined to <your container's ip address>:<your container's port> So a few takeaways: - your standard firewall might not be involved because its chains are plugged in after the docker chains in the FORWARD chain (e.g. ufw under Ubuntu) - if the above is true and you want your firewall to matter, you have to add stuff to DOCKER-USER chain in the FILTER table - at that point the host port and IP doesn't matter since it's already been mapped in the NAT table's PREROUTE chain at the beginning of processing - write your firewall rules to address specific containers