News for hackers. Stuff that matters.

A comment on Permissive forwarding rule leads to unintentional exposure of containers (2021). Parent comment

Re:Permissive forwarding rule leads to unintentional exposur... by jandrese on Wednesday June 22, 2022 @04:07PM (#31841214)
If you are going that far why not just:

    iptables -t filter -I FORWARD -j DROP
and while you are at it:

    sysctl -w net.ipv4.conf.all.forwarding=0
    sysctl -w net.ipv6.conf.all.forwarding=0
[ Parent | on HN ]
Re:Permissive forwarding rule leads to unintentional exposur... by 0xbadcafebee on Wednesday June 22, 2022 @04:12PM (#31841282)
....because then containers can't network at all to non-local networks, e.g. no internet access. for bridge networks at least (which is the default).

by specifying the drop for new connections incoming from the external interface, you stop connections to listening services from external networks, but established and related connections can continue implicitly, so forwarding still works for outbound connections.

if you really want to block all internet access for containers, and stop anything else on your system that might need to use forwarding, then your suggestion is correct.

[ Parent | on HN ]