我有一个docker容器运行如下：
docker run --name some_container_1 -p 8080:80 -d some_image 哪个工作正常。 该容器公开它的端口80到8080，并可从本地主机访问。
由于某些原因，它完全忽略了INPUT iptables规则，也可以从外部访问。
我如何限制对我的Docker容器的访问，只允许IP 123.456.789.0从外部访问？
谢谢。
sudo iptables -L -n -v – 行号
Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 2 365 23380 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 4 7 788 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 5/min burst 5 LOG flags 0 level 7 prefix "iptables denied: " 5 7 788 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 24 1524 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0 2 0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 3 15 13320 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0 4 0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 204 packets, 21792 bytes) num pkts bytes target prot opt in out source destination Chain DOCKER (1 references) num pkts bytes target prot opt in out source destination 1 24 1524 ACCEPT tcp -- !docker0 docker0 0.0.0.0/0 172.17.0.2 tcp dpt:80
sudo iptables-save
# Generated by iptables-save v1.4.21 on Wed Apr 8 23:37:43 2015 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [100:16642] :DOCKER - [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 -A INPUT -j DROP -A FORWARD -o docker0 -j DOCKER -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i docker0 ! -o docker0 -j ACCEPT -A FORWARD -i docker0 -o docker0 -j ACCEPT -A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT COMMIT # Completed on Wed Apr 8 23:37:43 2015 # Generated by iptables-save v1.4.21 on Wed Apr 8 23:37:43 2015 *nat :PREROUTING ACCEPT [13:2206] :INPUT ACCEPT [1:64] :OUTPUT ACCEPT [4:268] :POSTROUTING ACCEPT [4:268] :DOCKER - [0:0] -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE -A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE -A DOCKER ! -i docker0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80 COMMIT # Completed on Wed Apr 8 23:37:43 2015
docker信息
Containers: 1 Images: 25 Storage Driver: aufs Root Dir: /var/lib/docker/aufs Backing Filesystem: extfs Dirs: 27 Execution Driver: native-0.2 Kernel Version: 3.16.0-4-amd64 Operating System: Debian GNU/Linux 8 (jessie) CPUs: 4 Total Memory: 7.746 GiB Name: nuc-001 ID: WCMU:MN3T:VFKR:IU42:6423:OEI6:IB5Q:WBNV:K75H:JZDS:UWU5:57WD WARNING: No memory limit support WARNING: No swap limit support
内部Docker使用iptables将端口8080上的泊坞窗主机的连接转发到监听容器上端口80的服务。 您的configuration中的关键是这一行 –
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80
通过插入（ -I ）新的前向线路，可以阻止连接转发到容器IP，在这种情况下为172.17.0.2。 试试这个规则 –
/sbin/iptables -I FORWARD '!' -s 123.456.789.0 -d 172.17.0.2 -p tcp --dport 80 -j DROP