0

Im Trying to deploy a system using docker compose which contains mysql server. The server is shared between the docker containers in the same network.

I need to access the mysql db from a specific external server in our network, so i published the mysql port (3306) within the docker compose file.

But as a security concern I wan to block any other ip who tries to access this port.

I tried many iptables rules and all of them either blocked containers within the docker-compose or allowed other servers to access the port.

p.s. I will all change the user permissions within the mysql server, but blocking the port is the first thing we want to do.

New contributor
kaki gadol is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
0

You may configure the iptables entries in the DOCKER-USER table. This is done outside of docker. E.g. if you are worried about requests on the eth0 interface to port 3306 from any network other than 10.0.0.0/24:

iptables -I DOCKER-USER -i eth0 ! -s 10.0.0.0/24 -p tcp \
  -m conntrack --ctorigdstport 3306 -j DROP

Note that conntrack and the conn track original destination port are needed rather than a normal tcp port rule to handle the NAT rules and port mapping.

  • This rule didn't work because the rule docker adds within DOCKER catches packets from other servers before the suggested rule. I am pretty sure this rule was added by docker when I set it to publish the 3306 port – kaki gadol Aug 15 at 6:48
  • I managed to solved it using the two following rules: iptables -I FOWARD -i eth0 -p tcp -m tcp --dport 3306 -j DROP iptables -I FOWARD -i eth0 -s 10.0.0.0/24 -p tcp -m tcp --dport 3306 -j ACCEPT iptables -I FOWARD -i docker0 -p tcp -m tcp --dport 3306 -j ACCEPT The only problem is when I restart the docker it puts its own rules again and they are located before my rules.. – kaki gadol Aug 15 at 7:11

Your Answer

kaki gadol is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.