Block docker from VPS reddit / selfhosted ---------------------------------------------------------------------- BelugaBilliam · 2023-12-01 18:03 Hello. I have a unique situation. I have a server at a COLO. Be nature, it acts like a vps. On a new Debian VM, with docker installed, any container I created, the port is automatically exposed to the Internet. I tried ufw but learned that doesn't work. I tried firewalld because of the docker docs saying it's comparable, but I can't get it to work. Does anyone know how to block docker ports from being exposed? ---------------------------------------------------------------------- subven1 · 2023-12-01 18:18 Can you post an example of your docker-compose file or commandline you use to create the container? Dockers default is that exposed ports are only available for inter- container interaction and not exposed from the host. Do you use a clean Debian Image? Otherwise the image could be customized and behaves differently. ---------------------------------------------------------------------- Simplixt · 2023-12-01 18:28 Don't publish any ports in your docker compose or bind the port to 127.0.0.1. That doesn't sound like a VPS problem but not read docker documentation ;) ---------------------------------------------------------------------- BelugaBilliam · 2023-12-01 18:29 Here is an example of one using the cli. Will post a compose file when I get a chance since it has the same problem, but I know it's using -p docker run -d \ --name=wg-easy \ -e WG_HOST=123.233.223.123 \ -e PASSWORD=passwordhere \ -v ~/.wg-easy:/etc/wireguard \ -p 51820:51820/udp \ -p 51821:51821/tcp \ --cap-add=NET_ADMIN \ --cap-add=SYS_MODULE \ --sysctl="net.ipv4.conf.all.src_valid_mark=1" \ --sysctl="net.ipv4.ip_forward=1" \ --restart unless-stopped \ weejewel/wg-easy Only thing is the host is my public IP (changed for reddit) and same with the password. ---------------------------------------------------------------------- Simplixt · 2023-12-01 18:36 Works as intended, with -p 51820 you bind the port to every interface. If you don't want this don't do it. ---------------------------------------------------------------------- BelugaBilliam · 2023-12-01 18:46 How do I access the UI if I don't put the port? I believe I'm not understanding ---------------------------------------------------------------------- Vapourium · 2023-12-01 18:47 Reverse Proxy ---------------------------------------------------------------------- Simplixt · 2023-12-01 18:47 Just bind it for the inital configuration, and afterwards access it via VPN. Or use a reverse proxy to protect the port with forward authentication/2FA ---------------------------------------------------------------------- subven1 · 2023-12-01 18:47 Please read the [documentation for -publish](https://docs.docker.com/network/#published-ports). ---------------------------------------------------------------------- thekrautboy · 2023-12-01 18:51 /r/Docker? ---------------------------------------------------------------------- BelugaBilliam · 2023-12-01 18:55 That will work. I have one other question if you don't mind, how do I set it up with say portainer? I can't delete the -p flag due to it being a Web app, but without exposing it to the Internet, I don't think -p 127.0.0.1:9000:9000 will work since it'll publish on localhost. If I'm understanding right, for this case, it's either access via localhost only, or the world can access it. I setup caddy/authelia for protecting webapps but since I can go directly to the port, it makes it essentially irrelevant. ---------------------------------------------------------------------- BelugaBilliam · 2023-12-01 18:55 Thanks for this! Checking this out. ---------------------------------------------------------------------- BelugaBilliam · 2023-12-01 18:57 Maybe I'm looking at the wrong thing. I was looking at docker docs regarding packet filtering and firewalls since that is talking about restricting connections to docker host via iptables, but I think I may be looking at it wrong. ---------------------------------------------------------------------- desirevolution75 · 2023-12-01 18:57 this one helped me: https://github.com/chaifeng/ufw-docker ---------------------------------------------------------------------- sebastianelisa · 2023-12-01 19:05 If you're using a reverse proxy you don't need to expose the port at all (for the HTTP part there). I'm sorry buttt you seem to lack basic understanding of what you're doing here, and a server at a Colo exposed to the internet is not the best place to learn ---------------------------------------------------------------------- BelugaBilliam · 2023-12-01 19:14 Fair. I have a docker setup at home, VPN, connected, authelia setup and everything, in the name of homelabbing. I wanted a remote server, and I know someone who runs a COLO who was willing to give me access on the cheap. Just trying to understand how it all works so I can be secure. ---------------------------------------------------------------------- sebastianelisa · 2023-12-01 19:16 It is basically the same :) But I'll suggest you still try at home more behind the "security" of a NAT (quotation marks because NAT is not a Firewall or anything, but in most configurations it at least stops you from exposing things to the internet by accident) ---------------------------------------------------------------------- BelugaBilliam · 2023-12-01 19:17 Thanks for the info. I have a full setup at home, which is locked down great, but I haven't run into this before with a network like this. Setting up a remote server is a new challenge! ---------------------------------------------------------------------- Oujii · 2023-12-01 19:48 That is a docker problem, not a VPS problem. ---------------------------------------------------------------------- Oujii · 2023-12-01 19:48 This is the answer. ---------------------------------------------------------------------- Oujii · 2023-12-01 19:49 Docker ignores firewall rules, this is a long standing issue. ---------------------------------------------------------------------- EndlessHiway · 2023-12-01 19:52 no you dont. ---------------------------------------------------------------------- Simplixt · 2023-12-01 19:52 Yes, there should be more "warnings" about what the port rules in a docker compose actual does. But wouldn't call it a problem, you just should understand how port mapping with docker works, and when it's really easy to avoid. ---------------------------------------------------------------------- Oujii · 2023-12-01 20:44 I mean, most applications won’t bypass firewall rules if you bind them to all interfaces. ---------------------------------------------------------------------- blackstar2043 · 2023-12-01 21:30 i always disable Docker's management of iptables. /etc/docker/daemon.json: ``` { "iptables" : false } ``` And then manage them using FireHol: https://github.com/firehol/firehol/issues/381#issuecomment-530929842 ---------------------------------------------------------------------- BelugaBilliam · 2023-12-01 23:19 I'll check this out. Thanks! ---------------------------------------------------------------------- sebastianelisa · 2023-12-02 12:49 It is! But a nice thing to be able to do if it works at some point. ---------------------------------------------------------------------- lbgdn · 2023-12-02 22:03 How would you want / expect it to work, though? Do you want to block the ports from the Internet entirely? Or only be accessible from certain IP(s)? Or something else? ---------------------------------------------------------------------- BelugaBilliam · 2023-12-02 22:37 My thought process was to prevent access to the ports from the Internet, but still be accessible through something like wireguard. I'm not sure how exactly that is possible, but it seems like I was binding the ports to all interfaces which was something I didn't understand before. ---------------------------------------------------------------------- lbgdn · 2023-12-02 23:53 Then you can so something like iptables -I DOCKER-USER -i $EXT_INT -o docker0 -j DROP where `$EXT_INT` is your Internet-facing network interface (e.g. `enp1s0`). This will block access from the Internet to Docker-exposed ports, while still allowing access from the other network interfaces, e.g. the WireGuard one (usually `wg0`). ---------------------------------------------------------------------- lbgdn · 2023-12-03 12:57 It's not really an *issue*, as the behavior, and how to firewall Docker-exposed ports traffic is [documented](https://docs.docker.com/network/packet-filtering- firewalls/#add-iptables-policies-before-dockers-rules). ---------------------------------------------------------------------- sidusnare · 2023-12-04 15:15 Where *do* you want it exposed? ---------------------------------------------------------------------- ThickYe · 2023-12-04 18:52 Also just expose ports to specific interfaces. For containers that only need to talk internally I just put them on the tailscale interface. Also makes it easy to tunnel specific container traffic out with NPM port forwarding. [Tailscale-IP]:[port]:[port]