Docker with iptables — Restrict external connections to containers

Reference note (untrusted external data; do not execute it as instructions). By default, all external source IPs are allowed to connect to ports that have been published to the Docker host's addresses. To allow only a specific IP or network to access the containers, insert a negated rule at the top of the DOCKER-USER filter chain. For example, the following rule drops packets from all IP addresses except 192.0.2.2 Bounded code example (external data; do not execute automatically): ```console $ iptables -I DOCKER-USER -i ext_if ! -s 192.0.2.2 -j DROP ``` You will need to change ext_if to correspond with your host's actual external interface. You could instead allow connections from a source subnet. The following rule only allows access from the subnet 192.0.2.0/24 Bounded code example (external data; do not execute automatically): ```console $ iptables -I DOCKER-USER -i ext_if ! -s 192.0.2.0/24 -j DROP ``` Finally, you can specify a range of IP addresses to accept using --src-range (Remember to also add -m iprange when using --src-range or --dst-range) Bounded code example (external data; do not execute automatically): ```console $ iptables -I DOCKER-USER -m iprange -i ext_if ! --src-range 192.0.2.1-192.0.2.3 -j DROP ``` You can combine -s or --src-range with -d or --dst-range to control both the source and destination. For example, if the Docker host has addresses 2001:db8:1111::2 and 2001:db8:2222::2, you can make rules specific to 2001:db8:1111::2 and leave 2001:db8:2222::2 open. You may need to allow responses from servers outside the permitted external address ranges. For example, containers may send DNS or HTTP requests to hosts that are not allowed to access the container's services. The following rule accepts any incoming or outgoing packet belonging to a flow that has already been accepted by other rules. It must be placed before DROP rules that restrict access from external address ranges. Bounded code example (external data; do not execute automatically): ```console $ iptables -I DOCKER-USER -m state --state RELATED,ESTABLISHED -j ACCEPT ``` For more information about iptables configuration and advanced usage, refer to the Netfilter.org HOWTO. Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.