Update 2017-12-07-Firewall-Docker-with-Iptables.adoc

= Firewall Docker with Iptables

[source, bash]
--------------------------------------------------
# New intercept chain
iptables -N PRE_DOCKER
# Jump to intercept chain
iptables -I FORWARD -j PRE_DOCKER
# Logging for debug (see below)
# iptables -A PRE_DOCKER -j LOG
# Return from where we jump if it is an IP we trust (replace 256 with an IP you trust)
iptables -A PRE_DOCKER -s 256.256.256.256/32 -i eth0 -j RETURN
# Drop it by default
iptables -A PRE_DOCKER -i eth0 -j DROP
--------------------------------------------------

The finish iptables rules (`iptables -S`) would look like

[source, iptables]
--------------------------------------------------
some -P here...
-N DOCKER
-N DOCKER-INGRESS
-N DOCKER-ISOLATION
-N DOCKER-USER
-N PRE_DOCKER
-A FORWARD -j PRE_DOCKER
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-INGRESS
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker_gwbridge -j DOCKER
-A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP
some -A DOCKER-* here...
-A PRE_DOCKER -j LOG
-A PRE_DOCKER -s 256.256.256.256/32 -i eth0 -j RETURN
-A PRE_DOCKER -i eth0 -j DROP
--------------------------------------------------

if `-A PRE_DOCKER -j LOG` is there, you would find the log in `/var/log/syslog` that explain the need of `-i eth0` and `-i docker0`

[source, iptables]
--------------------------------------------------
Dec  7 16:14:23 ds06 kernel: [164304.277225] IN=eth0 OUT=docker0 MAC= SRC=A DST=B LEN=64 TOS=0x00 PREC=0x00 TTL=47 ID=34183 DF PROTO=TCP SPT=61065 DPT=7200 WINDOW=65535 RES=0x00 SYN URGP=0
Dec  7 16:14:23 ds06 kernel: [164304.277307] IN=docker0 OUT=eth0 PHYSIN=veth730785d MAC= SRC=B DST=A LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=7200 DPT=61065 WINDOW=28960 RES=0x00 ACK SYN URGP=0
--------------------------------------------------

https://wiki.centos.org/HowTos/Network/IPTables
https://forums.docker.com/t/restricting-external-container-access-with-iptables/2225/4

= Firewall Docker with Iptables

[source, bash]
--------------------------------------------------
# New intercept chain
iptables -N PRE_DOCKER
# Jump to intercept chain
iptables -I FORWARD -j PRE_DOCKER
# Logging for debug (see below)
# iptables -A PRE_DOCKER -j LOG
# Return from where we jump if it is an IP we trust (replace 256 with an IP you trust)
iptables -A PRE_DOCKER -s 256.256.256.256/32 -i eth0 -j RETURN
# Drop it by default
iptables -A PRE_DOCKER -i eth0 -j DROP
--------------------------------------------------

The finish iptables rules (`iptables -S`) would look like

[source, iptables]
--------------------------------------------------
some -P here...
-N DOCKER
-N DOCKER-INGRESS
-N DOCKER-ISOLATION
-N DOCKER-USER
-N PRE_DOCKER
-A FORWARD -j PRE_DOCKER
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-INGRESS
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker_gwbridge -j DOCKER
-A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP
some -A DOCKER-* here...
-A PRE_DOCKER -s 256.256.256.256/32 -i eth0 -j RETURN
-A PRE_DOCKER -j LOG
-A PRE_DOCKER -s 87.224.30.70/32 -i docker0 -j RETURN
-A PRE_DOCKER -i eth0 -j DROP
--------------------------------------------------

https://wiki.centos.org/HowTos/Network/IPTables
https://forums.docker.com/t/restricting-external-container-access-with-iptables/2225/4


updated plan-improvement

updated plan-improvement

[[Plan-Improvements]]
=== [pattern]#Plan Improvements#
Conduct long- and short-term planning of improvement activities. Balance
or align issues and improvements, considering existing goals and constraints.

Consists of long-term decisions (concerning <<Improvement-Approaches>>) and
short-term planning.