3 ms·

Is there any additional information on this? Assuming I add a rule via `iptables -I INPUT -s 123.123.123.123 -p tcp --dport 8080 -j DROP` and on interface:po

Is there any additional information on this? Assuming I add a rule via `iptables -I INPUT -s 123.123.123.123 -p tcp --dport 8080 -j DROP` and on interface:port 0.0.0.0:8080 of the host is a container listening which got run as `docker run -d -p 0.0.0.0:8080:8080 some/server:latest` Will that container still be accessible to 123.123.123.132?

l33tman 5y ago
I think so, this has been discussed in many HN threads and it always surprises a lot of people how big of a hole this is. I was certainly not aware of it the first time I read about it. Docker inserts its own iptables rules before your drop rule I think to handle its virtual interfaces.
malka 5y ago
Yes. Docker will create specific rules for the lifetime of the container. I was bit by this once. Be very careful with docker. Do not rely blindly on your firewall of it runs on the same machine.
remram 5y ago
The Docker container is using a separate network namespace with a separate virtual interface that packets are routed to. The "PREROUTING" chain runs before the "INPUT" chain so yes, the rules you put in "INPUT" won't apply.
- rzzzt 5y ago
  Its rules also go into the "nat" table instead of the "filter" table. Use "iptables -L -t nat" to display them.
  - remram 5y ago
    Or iptables-save (note the nat and filter sections)
michaelcampbell 5y ago
Well, trick question since you typo'd the IP, but "yes" to the spirit. I ran into exactly the case described https://www.techrepublic.com/article/how-to-fix-the-docker-and-ufw-security-flaw/ https://www.techrepublic.com/article/how-to-fix-the-docker-a..., albeit with mysql instead of mongo.