如何使用 iptables 阻止从互联网访问 docker 容器端口？答案

【问题标题】：How , with iptables, to block access to docker container port from internet?如何使用 iptables 阻止从互联网访问 docker 容器端口？
【发布时间】：2019-09-23 19:21:20
【问题描述】：

如何通过 iptables 阻止从外部互联网访问 docker 容器端口？ Ubuntu 18 我有远程服务器，在服务器 docker 容器中，我可以使用 $MY_SERVER_IP:$docker_container_port 访问该 docker 容器。如何禁用从 Internet 访问此容器并只允许在此服务器内进行本地调用？

这里是iptables -L -n 输出：

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     tcp  -- !142.93.231.42        0.0.0.0/0            tcp dpt:4467 reject-with icmp-port-unreachable
REJECT     tcp  -- !127.0.0.1            0.0.0.0/0            tcp dpt:4467 reject-with icmp-port-unreachable
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3000

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  0.0.0.0/0            0.0.0.0/0           
DOCKER-ISOLATION-STAGE-1  all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467

Chain DOCKER (2 references)
target     prot opt source               destination         
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.3           tcp dpt:4466
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0           
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target     prot opt source               destination         
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8000
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4467
DROP       all  --  0.0.0.0/0            0.0.0.0/0

【问题讨论】：

标签： docker ubuntu iptables

【解决方案1】：

iptables -D DOCKER-USER -j RETURN
iptables -A DOCKER-USER  -j DROP
iptables -I DOCKER-USER  -s 10.0.0.0/8 -j RETURN
iptables -I DOCKER-USER  -s 172.16.0.0/12 -j RETURN
iptables -I DOCKER-USER  -s 192.168.0.0/16 -j RETURN
iptables -I DOCKER-USER  -s xxx.xxx.xxx.xxx -j RETURN

【讨论】：