5 ms·

Even if you've firewalled you machine, Docker will happily open up the ports to the world, you have to run it with "--iptables=false" to stop it. I accidentall

Even if you've firewalled you machine, Docker will happily open up the ports to the world, you have to run it with "--iptables=false" to stop it. I accidentally opened up a Redis test-instance to the world like this.

qwertox 5y ago
Is there any additional information on this? Assuming I add a rule via `iptables -I INPUT -s 123.123.123.123 -p tcp --dport 8080 -j DROP` and on interface:port 0.0.0.0:8080 of the host is a container listening which got run as `docker run -d -p 0.0.0.0:8080:8080 some/server:latest` Will that container still be accessible to 123.123.123.132?
- l33tman 5y ago
  I think so, this has been discussed in many HN threads and it always surprises a lot of people how big of a hole this is. I was certainly not aware of it the first time I read about it. Docker inserts its own iptables rules before your drop rule I think to handle its virtual interfaces.
- malka 5y ago
  Yes. Docker will create specific rules for the lifetime of the container. I was bit by this once. Be very careful with docker. Do not rely blindly on your firewall of it runs on the same machine.
- remram 5y ago
  The Docker container is using a separate network namespace with a separate virtual interface that packets are routed to. The "PREROUTING" chain runs before the "INPUT" chain so yes, the rules you put in "INPUT" won't apply.
  - rzzzt 5y ago
    Its rules also go into the "nat" table instead of the "filter" table. Use "iptables -L -t nat" to display them.
    - remram 5y ago
      Or iptables-save (note the nat and filter sections)
- michaelcampbell 5y ago
  Well, trick question since you typo'd the IP, but "yes" to the spirit. I ran into exactly the case described https://www.techrepublic.com/article/how-to-fix-the-docker-and-ufw-security-flaw/ https://www.techrepublic.com/article/how-to-fix-the-docker-a..., albeit with mysql instead of mongo.
wiredfool 5y ago
Even better, docker-compose doesn't do IPV6 (well). But if you have an IPV6 address, it will NAT all the incoming IPV6 traffic on the open ports to IPV4 using the internal network gateway address. So, if you're doing any filtering for internal network addresses == internal traffic, congratulations, now your inbound external IPV6 traffic is recognized as internal.
- withinboredom 5y ago
  And even better 0.0.0.0 isn’t the default on Docker For Mac, leading devs to a false sense of security who develop on Macs.
efdee 5y ago
Strange, I've never seen this before. I've been running Docker for years on one of my pet project machines, but while Docker is exposing the ports on 0.0.0.0 my iptables firewall blocks all of them. I'm not using --iptables=false but I'm not discounting the possibility that maybe I've configured this on a more global level somewhere.
- tluyben2 5y ago
  That is still strange ; as you can read from others, docker refreshes it’s own iptable rules which then can mess with your own. Maybe you were lucky but seems unlikely to have that much luck. Be careful anyway; if you opened a port, it’ll be on 0.0.0.0 and docker does rearrange your iptables when the container(s) start. Especially default redis and mongo are good foot-shooters.
  - efdee 5y ago
    I don't quite understand it either. I just triple checked though, the ports are filtered from the outside. I do have a bunch of "docker network isolation" things going on in my iptables setup, so maybe that's why.
sethammons 5y ago
We unknowingly did this at work. We had firewalls in place and docker was more than happy to open up redis to the world. Big lesson learned.

qwertox 5y ago

Is there any additional information on this? Assuming I add a rule via `iptables -I INPUT -s 123.123.123.123 -p tcp --dport 8080 -j DROP` and on interface:port 0.0.0.0:8080 of the host is a container listening which got run as `docker run -d -p 0.0.0.0:8080:8080 some/server:latest` Will that container still be accessible to 123.123.123.132?

l33tman 5y ago
I think so, this has been discussed in many HN threads and it always surprises a lot of people how big of a hole this is. I was certainly not aware of it the first time I read about it. Docker inserts its own iptables rules before your drop rule I think to handle its virtual interfaces.
malka 5y ago
Yes. Docker will create specific rules for the lifetime of the container. I was bit by this once. Be very careful with docker. Do not rely blindly on your firewall of it runs on the same machine.
remram 5y ago
The Docker container is using a separate network namespace with a separate virtual interface that packets are routed to. The "PREROUTING" chain runs before the "INPUT" chain so yes, the rules you put in "INPUT" won't apply.
- rzzzt 5y ago
  Its rules also go into the "nat" table instead of the "filter" table. Use "iptables -L -t nat" to display them.
  - remram 5y ago
    Or iptables-save (note the nat and filter sections)
michaelcampbell 5y ago
Well, trick question since you typo'd the IP, but "yes" to the spirit. I ran into exactly the case described https://www.techrepublic.com/article/how-to-fix-the-docker-and-ufw-security-flaw/ https://www.techrepublic.com/article/how-to-fix-the-docker-a..., albeit with mysql instead of mongo.

wiredfool 5y ago

Even better, docker-compose doesn't do IPV6 (well). But if you have an IPV6 address, it will NAT all the incoming IPV6 traffic on the open ports to IPV4 using the internal network gateway address. So, if you're doing any filtering for internal network addresses == internal traffic, congratulations, now your inbound external IPV6 traffic is recognized as internal.

withinboredom 5y ago
And even better 0.0.0.0 isn’t the default on Docker For Mac, leading devs to a false sense of security who develop on Macs.

efdee 5y ago

Strange, I've never seen this before. I've been running Docker for years on one of my pet project machines, but while Docker is exposing the ports on 0.0.0.0 my iptables firewall blocks all of them. I'm not using --iptables=false but I'm not discounting the possibility that maybe I've configured this on a more global level somewhere.

tluyben2 5y ago
That is still strange ; as you can read from others, docker refreshes it’s own iptable rules which then can mess with your own. Maybe you were lucky but seems unlikely to have that much luck. Be careful anyway; if you opened a port, it’ll be on 0.0.0.0 and docker does rearrange your iptables when the container(s) start. Especially default redis and mongo are good foot-shooters.
- efdee 5y ago
  I don't quite understand it either. I just triple checked though, the ports are filtered from the outside. I do have a bunch of "docker network isolation" things going on in my iptables setup, so maybe that's why.

sethammons 5y ago

We unknowingly did this at work. We had firewalls in place and docker was more than happy to open up redis to the world. Big lesson learned.