我有一个服务器在以下configuration中运行多个docker容器：
| DEV Env Docker | / OUTSIDE WORLD <-----|------> REVERSE PROXY DOCKER - DEV Env Docker | \ | DEV Env Docker 这个想法是，用户可以通过反向代理访问开发容器，并在该容器内运行命令。
我想阻止用户运行命令连接到外部世界白名单，他们可以连接到域。
我已经安装了squid3，并通过在configuration文件中添加以下几行来设置一个白名单：
acl whitelist dstdomain "/etc/squid3/whitelist.txt" http_access allow whitelist
我还设法使用以下iptables命令将stream量从docker容器redirect到squid iptables -t nat -A PREROUTING -i docker0 -p tcp -d 0/0 -j REDIRECT – 到端口3128
我的问题是，我只想从我的Dev Env容器传出stream量通过鱿鱼，但因为“我相信”我需要使用PREROUTING所有stream量正在通过鱿鱼，即使是传入和注定我的反向代理。
当我尝试通过networking访问我的反向代理时，我从鱿鱼中得到以下错误
ERROR The requested URL could not be retrieved The following error was encountered while trying to retrieve the URL: / Invalid URL Some aspect of the requested URL is incorrect. Some possible problems are: Missing or incorrect access protocol (should be http:// or similar) Missing hostname Illegal double-escape in the URL-Path Illegal character in hostname; underscores are not allowed. Your cache administrator is webmaster. Generated Fri, 06 Nov 2015 18:56:54 GMT by ip-10-0-1-201 (squid/3.3.8)
问题：如何让squid忽略与反向代理容器相关的所有stream量，包括stream入和stream出？
我的iptables是这样的
# Generated by iptables-save v1.4.21 on Fri Nov 6 18:54:09 2015 *nat :PREROUTING ACCEPT [30:1796] :INPUT ACCEPT [28:1680] :OUTPUT ACCEPT [37:2388] :POSTROUTING ACCEPT [46:2964] :DOCKER - [0:0] -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A PREROUTING -i docker0 -p tcp -d 0/0 -j REDIRECT --to-port 3128 -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE -A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 8000 - j MASQUERADE -A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 80 -j MASQUERADE -A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE -A DOCKER ! -i docker0 -p tcp -m tcp --dport 9000 -j DNAT --to-destination 172.17.0.3:8000 -A DOCKER ! -i docker0 -p tcp -m tcp --dport 8192 -j DNAT --to-destination 172.17.0.3:80 -A DOCKER ! -i docker0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.17.0.2:80 COMMIT # Completed on Fri Nov 6 18:54:09 2015 # Generated by iptables-save v1.4.21 on Fri Nov 6 18:54:09 2015 *filter :INPUT ACCEPT [1891:3910112] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1500:1500230] :DOCKER - [0:0] -A FORWARD -o docker0 -j DOCKER -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i docker0 ! -o docker0 -j ACCEPT -A FORWARD -i docker0 -o docker0 -j ACCEPT -A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT -A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT -A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT COMMIT # Completed on Fri Nov 6 18:54:09 2015
—-编辑—–我的Squid Conf完成后，改变http_port在注释中所示。
acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access deny !Safe_ports http_access allow localhost manager http_access deny manager acl allowed_ips src 172.17.0.0-172.17.0.254 http_access allow allowed_ips http_access allow localhost http_access deny all http_port 3128 accel vhost allow-direct coredump_dir /var/spool/squid3 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880 refresh_pattern . 0 20% 4320
我欣赏你所能提供的所有帮助。
诀窍是让iptables只redirect来自DEV Env容器的连接。 我们可以通过添加规则来接受来自反向代理的所有连接。 所以IP表规则现在将变成：
-A PREROUTING -i docker0 -s 172.17.0.2/32 -j ACCEPT -A PREROUTING -i docker0 -s 172.17.0.1/32 -j ACCEPT -A PREROUTING -i docker0 -p tcp -d 0/0 -j REDIRECT --to-port 3128
由于docker工人dynamic分配IP。 如果docker容器重新运行或服务器重新启动，则需要更新使用的IP。 我还添加了172.17.0.1这是docker0 ip的规则。
这些规则意味着源自docker0接口的所有其他stream量（反向代理容器和docker主机本身除外）都被redirect到squid。
在squid中，我们可以通过使用以下几行来将域列入白名单
acl allowed_domain dstdomain google.com http_access allow allowed_domain
完整的iptables规则是：
# Generated by iptables-save v1.4.21 on Fri Nov 6 18:54:09 2015 *nat :PREROUTING ACCEPT [30:1796] :INPUT ACCEPT [28:1680] :OUTPUT ACCEPT [37:2388] :POSTROUTING ACCEPT [46:2964] :DOCKER - [0:0] -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A PREROUTING -i docker0 -s 172.17.0.2/32 -j ACCEPT -A PREROUTING -i docker0 -s 172.17.0.1/32 -j ACCEPT -A PREROUTING -i docker0 -p tcp -d 0/0 -j REDIRECT --to-port 3128 -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE -A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 8000 -j MASQUERADE -A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 80 -j MASQUERADE -A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE -A DOCKER ! -i docker0 -p tcp -m tcp --dport 9000 -j DNAT --to-destination 172.17.0.3:8000 -A DOCKER ! -i docker0 -p tcp -m tcp --dport 8192 -j DNAT --to-destination 172.17.0.3:80 -A DOCKER ! -i docker0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.17.0.2:80 COMMIT # Completed on Fri Nov 6 18:54:09 2015 # Generated by iptables-save v1.4.21 on Fri Nov 6 18:54:09 2015 *filter :INPUT ACCEPT [1891:3910112] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1500:1500230] :DOCKER - [0:0] -A FORWARD -o docker0 -j DOCKER -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i docker0 ! -o docker0 -j ACCEPT -A FORWARD -i docker0 -o docker0 -j ACCEPT -A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT -A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT -A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT COMMIT # Completed on Fri Nov 6 18:54:09 2015
完整的鱿鱼规则是：
acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access deny !Safe_ports http_access allow localhost manager http_access deny manager acl allowed_domain dstdomain google.com http_access allow allowed_domain http_access allow localhost http_access deny all http_port 3128 accel vhost allow-direct coredump_dir /var/spool/squid3 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880 refresh_pattern . 0 20% 4320