Re:I discovered thousands of open databases on AWS
by l33tman on Tuesday March 15, 2022 @06:30AM
(#30683659)
I think so, this has been discussed in many HN threads and it always surprises a lot of people how big of a hole this is. I was certainly not aware of it the first time I read about it. Docker inserts its own iptables rules before your drop rule I think to handle its virtual interfaces.
Re:I discovered thousands of open databases on AWS
by remram on Tuesday March 15, 2022 @09:11AM
(#30684778)
The Docker container is using a separate network namespace with a separate virtual interface that packets are routed to. The "PREROUTING" chain runs before the "INPUT" chain so yes, the rules you put in "INPUT" won't apply.
Re:I discovered thousands of open databases on AWS
by rzzzt on Tuesday March 15, 2022 @10:15AM
(#30685562)
Its rules also go into the "nat" table instead of the "filter" table. Use "iptables -L -t nat" to display them.
Re:I discovered thousands of open databases on AWS
by remram on Wednesday March 16, 2022 @11:23AM
(#30699936)
Or iptables-save (note the nat and filter sections)
Re:I discovered thousands of open databases on AWS
by malka on Tuesday March 15, 2022 @08:50AM
(#30684589)
Yes. Docker will create specific rules for the lifetime of the container.
I was bit by this once. Be very careful with docker. Do not rely blindly on your firewall of it runs on the same machine.
Re:I discovered thousands of open databases on AWS
by michaelcampbell on Tuesday March 15, 2022 @09:13AM
(#30684799)
Well, trick question since you typo'd the IP, but "yes" to the spirit. I ran into exactly the case described https://www.techrepublic.com/article/how-to-fix-the-docker-a..., albeit with mysql instead of mongo.
Assuming I add a rule via
`iptables -I INPUT -s 123.123.123.123 -p tcp --dport 8080 -j DROP`
and on interface:port 0.0.0.0:8080 of the host is a container listening which got run as
`docker run -d -p 0.0.0.0:8080:8080 some/server:latest`
Will that container still be accessible to 123.123.123.132?