0

I have a server with two docker containers running. One of them is the frontend of a small application, served with http-server. This application used Javascript fetch API to fetch data from a really simple database based on Node.js 'json-server' module, which is running in the other container.

It happens that json-server makes port 3000 available to external user, i.e., if someone points a browser to http://example.com:3000, my data will be available without the filtering and presentation provided by the frontend. This is not what I want.

I would like to block port 3000 to the exterior world, while allowing my other docker container to fetch data as usual. I think this may be done on a IP basis, but I don't know how to do it.

This is my current Iptables configuration, mostly created by Docker itself as a standard.

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:http-alt
ACCEPT     tcp  --  anywhere             172.17.0.3           tcp dpt:3000

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere 

In the configuration above, IP 172.17.0.2 is my frontend application, while 172.17.0.3 is the IP of my database container.

The frontend container is being started with

docker run -p 80:8080 --name=frontend -d mtr/frontend

and the second one with

docker run -p 3000:3000 --name=database -d mtr/database

I also considered the possibility of having some Docker way to make this access restrict, but after a lot of research I couldn't find anything.

Any suggestions about how I may do this happen?

1

Since you "ACCEPT" "tcp" connections from "anywhere" to the host "172.17.0.3" on "tcp" port "dpt:3000" and I guess there is also a DNAT rule which forwards every incoming connections to "you-public-ip-address:3000" to "172.17.0.3:3000" (see iptables -t nat -L --line-numbers) that's considered normal.

Remove the DNAT rule from the NAT table.

iptables -t nat -D PREROUTING <the-dnat-rule-number>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.