Htykuut

Hi I am trying to integrate some docker container in my existing server infrastructure. For not messing up with my firewall rules I start docker with:

ExecStart=/usr/bin/docker daemon -H fd:// --iptables=false 

Unfortunately since I've setup docker like that i am not able to communicate with my containers anymore. So I tried to adjust my Iptables rules manually.

ip link show gave me the following interfaces:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

2: enp0s31f6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000

    link/ether 90:1b:0e:e1:83:6e brd ff:ff:ff:ff:ff:ff

3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default 

    link/ether 02:42:df:a4:5b:4d brd ff:ff:ff:ff:ff:ff

4: br-ea97abf1e807: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default 

    link/ether 02:42:56:2f:85:81 brd ff:ff:ff:ff:ff:ff

13: br-ddc6c480b078: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default 

    link/ether 02:42:c8:4e:cf:6e brd ff:ff:ff:ff:ff:ff

297: veth3226e3d@if296: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-ddc6c480b078 state UP mode DEFAULT group default 

    link/ether 7e:38:14:2d:c7:1d brd ff:ff:ff:ff:ff:ff link-netnsid 0

299: veth465d694@if298: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-ddc6c480b078 state UP mode DEFAULT group default 

    link/ether e6:62:ff:dc:df:43 brd ff:ff:ff:ff:ff:ff link-netnsid 1

301: veth76234de@if300: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-ddc6c480b078 state UP mode DEFAULT group default 

    link/ether 66:94:bb:98:c3:4f brd ff:ff:ff:ff:ff:ff link-netnsid 2

303: veth0a28ac4@if302: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-ddc6c480b078 state UP mode DEFAULT group default 

    link/ether c2:7a:23:af:e2:6a brd ff:ff:ff:ff:ff:ff link-netnsid 3

305: veth22096a7@if304: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-ddc6c480b078 state UP mode DEFAULT group default 

    link/ether ae:e4:fe:c8:aa:4b brd ff:ff:ff:ff:ff:ff link-netnsid 4

307: veth1849fa8@if306: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-ddc6c480b078 state UP mode DEFAULT group default 

    link/ether 36:f3:fa:cf:1c:1e brd ff:ff:ff:ff:ff:ff link-netnsid 5

"sudo brctl show br-ddc6c480b078" revealed that this is the bridging interface of my docker containers:

bridge name bridge id       STP enabled interfaces

br-ddc6c480b078     8000.0242c84ecf6e   no      veth0a28ac4

                            veth1849fa8

                            veth22096a7

                            veth3226e3d

                            veth465d694

                            veth76234de

docker0 therefore is empty:

bridge name bridge id       STP enabled interfaces

docker0     8000.0242dfa45b4d   no  

So I adjusted my iptables rules like the following

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:Always - [0:0]

:Allow - [0:0]

:Bogus - [0:0]

:Enemies - [0:0]

:Friends - [0:0]



-A INPUT -j Bogus

-A INPUT -j Always

-A INPUT -j Enemies

-A INPUT -j Allow



-A FORWARD -j Bogus

-A FORWARD -j Always

-A FORWARD -j Enemies

-A FORWARD -j Allow



-A Bogus -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

-A Bogus -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP

-A Bogus -s 169.254.0.0/16 -j DROP

-A Bogus -s 172.16.0.0/12 -j DROP

-A Bogus -s 192.0.2.0/24 -j DROP

-A Bogus -s 192.168.0.0/16 -j DROP

-A Bogus -s 10.0.0.0/8 -j DROP

-A Bogus -s 127.0.0.0/8 ! -i lo -j DROP



-A Always -p udp --dport 123 -j ACCEPT

-A Always -m state --state ESTABLISHED,RELATED -j ACCEPT

-A Always -i lo -j ACCEPT



-A Friends -s 194.xxx.xxx.xxx -j ACCEPT

-A Friends -j DROP



-A Enemies  -m recent --name psc --update --seconds 60 -j DROP

-A Enemies ! -i lo -m tcp -p tcp --dport 1433  -m recent --name psc --set -j DROP

-A Enemies ! -i lo -m tcp -p tcp --dport 3306  -m recent --name psc --set -j DROP

-A Enemies ! -i lo -m tcp -p tcp --dport 8086  -m recent --name psc --set -j DROP

-A Enemies ! -i lo -m tcp -p tcp --dport 10000 -m recent --name psc --set -j DROP

-A Enemies -s 99.99.99.99 -j DROP



-A Allow -p icmp --icmp-type echo-request -j Friends

-A Allow -p icmp --icmp-type any -m limit --limit 1/second -j ACCEPT

-A Allow -p icmp --icmp-type any -j DROP

-A Allow -p tcp -m state --state NEW -m tcp --dport 22 -j Friends

-A Allow -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT

-A Allow -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

-A Allow -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

-A Allow -p tcp -m state --state NEW -m tcp --dport 8448 -j ACCEPT

-A Allow -p udp -m state --state NEW -m udp --dport 3478 -j ACCEPT



# Docker Rule Set

-A Allow -i br-ddc6c480b078 -o enp0s31f6 -j ACCEPT

-A Allow -i enp0s31f6 -o br-ddc6c480b078 -j ACCEPT

-A Allow -p tcp -m state --state NEW -m tcp --dport 8082 -j ACCEPT

-A Allow -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7

-A Allow -j DROP



COMMIT

unfortunatly without luck.... I get the following messages in /var/log/kern.log

IPTables Packet Dropped: IN=enp0s31f6 OUT= MAC=90:1b:0e:e1:83:6e:30:b6:4f:3f:ec:59:08:00 SRC=171.250.66.169 DST=78.46.75.155 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=7400 DF PROTO=TCP SPT=58948 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0

My ports in docker-compose.yml are defined like that:

ports:

  - 8082:3000

My nginx redirect looks like the following:

location / {

        proxy_pass http://localhost:8082;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection 'upgrade';

        proxy_set_header Host $host;

        proxy_cache_bypass $http_upgrade;

}

My question is what i made wrong ? I think im not properly understanding the docker bridging mechanism. Can someone help me to correct these rules without using dockerised nginx or automatic generation of iptables by docker ?