防火墙规则不限制对Docker Web应用程序的访问

Question

我遇到了一个问题，尽管iptables配置旨在限制访问，但端口暴露在我们系统上的码头容器中运行的应用程序仍然向世界开放。

在我看来，这个问题可能与在启动时向iptables添加规则的docker守护进程有关。我也知道标志--icc=true|false、--ip-forward=true|false和--iptables=true|false，但我不确定这些标志的哪个组合应该应用。我试过--icc=false和--ip-forward=false，但都没有达到预期的效果。我不喜欢使用--iptables=false，因为停靠守护进程显然添加了许多规则，如果仍然需要这些规则，我必须手动配置它们。

这是该停靠守护进程启动之前的规则状态：

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
    0     0 REJECT     all  --  !lo    any     anywhere             loopback/8           reject-with icmp-port-unreachable
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcpflags:! FIN,SYN,RST,ACK/SYN state NEW
    0     0 DROP       all  -f  any    any     anywhere             anywhere            
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE
   82  8831 ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             multiport dports ssh
    0     0 ACCEPT     tcp  --  any    any     <IP ADDRESS RANGE 1>  anywhere             multiport dports ssh,http,https,7990,7999,tproxy,8090,8095,18080
    0     0 ACCEPT     tcp  --  any    any     <IP ADDRESS RANGE 2>  anywhere             multiport dports ssh,http,https,7990,7999,tproxy,8090,8095,18080
    0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   24  2489 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   77 10080 ACCEPT     all  --  any    any     anywhere             anywhere  

这就是正在运行的docker守护进程的情况：

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
    0     0 REJECT     all  --  !lo    any     anywhere             loopback/8           reject-with icmp-port-unreachable
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcpflags:! FIN,SYN,RST,ACK/SYN state NEW
    0     0 DROP       all  -f  any    any     anywhere             anywhere            
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE
 1335  230K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
    1    32 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request
    7   380 ACCEPT     tcp  --  any    any     anywhere             anywhere             multiport dports ssh
    0     0 ACCEPT     tcp  --  any    any     <IP ADDRESS RANGE 1>  anywhere             multiport dports ssh,http,https,7990,7999,tproxy,8090,8095,18080
    0     0 ACCEPT     tcp  --  any    any     <IP ADDRESS RANGE 2>  anywhere             multiport dports ssh,http,https,7990,7999,tproxy,8090,8095,18080
   35  2016 LOG        all  --  any    any     anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
   62  3672 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
54492   21M DOCKER     all  --  any    docker0  anywhere             anywhere            
51882   20M ACCEPT     all  --  any    docker0  anywhere             anywhere             ctstate RELATED,ESTABLISHED
58371 9122K ACCEPT     all  --  docker0 !docker0  anywhere             anywhere            
    0     0 DROP       all  --  docker0 docker0  anywhere             anywhere            
 1186  121K REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2090  263K ACCEPT     all  --  any    any     anywhere             anywhere            

Chain DOCKER (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   86  7048 ACCEPT     tcp  --  !docker0 docker0  anywhere             172.17.0.2           tcp dpt:7990
 1639  395K ACCEPT     tcp  --  !docker0 docker0  anywhere             172.17.0.2           tcp dpt:7999
  791  151K ACCEPT     tcp  --  !docker0 docker0  anywhere             172.17.0.3           tcp dpt:http-alt
   20  1898 ACCEPT     tcp  --  !docker0 docker0  anywhere             172.17.0.4           tcp dpt:8090
   49  4561 ACCEPT     tcp  --  !docker0 docker0  anywhere             172.17.0.5           tcp dpt:18080
   25  3642 ACCEPT     tcp  --  !docker0 docker0  anywhere             172.17.0.6           tcp dpt:8095

还有许多POSTROUTING &伪装规则，这些规则仅在使用iptables -L时才会在iptables-save中显示。我也不确定这些东西有什么意义。

我怀疑前向链中的DOCKER目标规则是问题的根源，但是我看不出如何解决这个问题，因为它似乎是由在链开始时的docker守护进程插入的。

因此，有人能告诉我，我需要做些什么，以确保港口7990,8090等在运行码头时不会暴露在世界上？

谢谢

理查德

Answer 1

所以，这将是一个评论，但没有..。服务器故障代表。

你试过在这里发布的解决方案了吗：http://blog.viktorpetersson.com/post/101707677489/the-dangers-of-ufw-docker

使用这个标志--iptables=false像这样的DOCKER_OPTS="--dns 8.8.8.8 --dns 8.8.4.4 --iptables=false"？