We have a linux root server which primarily just is a docker server. Hosting containers and a CI runner.
To protect this server the basic idea for now is to
- block all traffic
- except for one (or more) IP(s) that are allowed.
I added a rich rules yesterday with for ip4
- blocking 0.0.0.0/0
- explicitly allowing our static IP
This resulted in me being blocked from access. Docker container where still accessible. The containers generate a new interface, as far as I understand these interfaces should only be responsible for the communication from the host to the container. I hope at least, that the firewalld filters traffic before the traffic is forwarded from e.g. eth0 to dockerinterface1234.
My research so far suggests. Leaving out interface information in a zone makes the zone responsible for all traffic. However, my own test suggest that I either configured it wrong or my research was wrong.