Permissive forwarding rule leads to unintentional exposure of containers (2021)

Re:Permissive forwarding rule leads to unintentional exposur... by 0xbadcafebee on Wednesday June 22, 2022 @03:24PM (#31840650)

Not if you have a firewall enabled on your machine, which everybody should.

edit: based on comments, added the FORWARD table, which supersedes Docker's rules and should block new connections forwarding from external interfaces.

edit 2: I'm wrong, this doesn't fix the bug. If you run `docker network create foobar`, it will move its rules up above the custom FORWARD rules. Ugh.

edit 3: Modified to add the rules to the DOCKER-USER table, which according to Docker[1], will always be evaluated first. So now it should actually fix the problem. They explain in the docs how to fix this situation, actually, and even how to prevent Docker from modifying iptables. Another example of why we should RTFM...

  for tool in iptables ip6tables ; do
    for intf in wlan+ eth+ ; do
      for table in INPUT DOCKER-USER ; do
        $tool -I $table 1 -i $intf -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        $tool -I $table 2 -i $intf -m conntrack --ctstate INVALID -j DROP
        $tool -I $table 3 -i $intf -m conntrack --ctstate NEW -j DROP
    done
  done
  iptables-save > /etc/iptables.rules
  ip6tables-save > /etc/ip6tables.rules

https://help.ubuntu.com/community/IptablesHowTo https://wiki.debian.org/iptables https://wiki.alpinelinux.org/wiki/Configure_Networking#Firew... https://wiki.archlinux.org/title/Iptables#Configuration_and_... [1] https://docs.docker.com/network/iptables/

[ Parent | on HN ]

Re:Permissive forwarding rule leads to unintentional exposur... by teraflop on Wednesday June 22, 2022 @03:42PM (#31840886)

As discussed extensively in https://github.com/moby/moby/issues/22054, which is linked from the OP: this doesn't actually help, because Docker (by default) bypasses your existing firewall rules.

[ Parent | on HN ]

Re:Permissive forwarding rule leads to unintentional exposur... by 0xbadcafebee on Wednesday June 22, 2022 @03:49PM (#31840976)

Ah, forgot about forwarding table. These should fix that:

  for tool in iptables ip6tables ; do
    $tool -I DOCKER-USER 1 -i eth+ -m conntrack --ctstate NEW -j DROP
    $tool -I DOCKER-USER 1 -i wlan+ -m conntrack --ctstate NEW -j DROP
  done

If these are saved and loaded with the rest of networking, they will appear at the top of the FORWARD table before the DOCKER table jumps. Docker won't remove these rules, and they come first in the table, so they supersede Docker's rules. Any new connections forwarded from an external interface should drop.

edit: changed from FORWARD to DOCKER-USER table

[ Parent | on HN ]

Re:Permissive forwarding rule leads to unintentional exposur... by jandrese on Wednesday June 22, 2022 @04:07PM (#31841214)

If you are going that far why not just:

    iptables -t filter -I FORWARD -j DROP

and while you are at it:

    sysctl -w net.ipv4.conf.all.forwarding=0
    sysctl -w net.ipv6.conf.all.forwarding=0

[ Parent | on HN ]

Re:Permissive forwarding rule leads to unintentional exposur... by 0xbadcafebee on Wednesday June 22, 2022 @04:12PM (#31841282)

....because then containers can't network at all to non-local networks, e.g. no internet access. for bridge networks at least (which is the default).

by specifying the drop for new connections incoming from the external interface, you stop connections to listening services from external networks, but established and related connections can continue implicitly, so forwarding still works for outbound connections.

if you really want to block all internet access for containers, and stop anything else on your system that might need to use forwarding, then your suggestion is correct.

[ Parent | on HN ]

Re:Permissive forwarding rule leads to unintentional exposur... by qbasic_forever on Wednesday June 22, 2022 @03:42PM (#31840888)

Docker creates its own iptables rules when its daemon runs, so unfortunately whatever firewall you setup will be ignored by exceptions it creates.

[ Parent | on HN ]

Re:Permissive forwarding rule leads to unintentional exposur... by sigg3 on Wednesday June 22, 2022 @03:40PM (#31840853)

But isn't the point of TFA that regular docker (which runs with privileges) negates these rules effectively punching holes?

[ Parent | on HN ]