Ubuntu 如何使用iptables保护docker容器
我正在尝试保护容器不受外部IP访问“0.0.0.0” 我想将一些容器配置为公共访问,而其他容器则限制为某些IPUbuntu 如何使用iptables保护docker容器,ubuntu,docker,firewall,iptables,ufw,Ubuntu,Docker,Firewall,Iptables,Ufw,我正在尝试保护容器不受外部IP访问“0.0.0.0” 我想将一些容器配置为公共访问,而其他容器则限制为某些IP sudo iptables -N DOCKER-USER sudo iptables -I DOCKER-USER -j DROP # where x.x.x.x is external IP allowed sudo iptables -I DOCKER-USER -s x.x.x.x -j ACCEPT # where yyyy is the external port tha
sudo iptables -N DOCKER-USER
sudo iptables -I DOCKER-USER -j DROP
# where x.x.x.x is external IP allowed
sudo iptables -I DOCKER-USER -s x.x.x.x -j ACCEPT
# where yyyy is the external port that will be allow
sudo iptables -I DOCKER-USER -p tcp --dport yyyy -j ACCEPT
sudo iptables -I FORWARD -o docker0 -j DOCKER-USER
它工作正常,但重新启动后,此配置被重置并停止工作
我已经尝试将此脚本置于/etc/rc.local,但重新启动后它不会执行
我的环境是:
Client:
Version: 17.05.0-ce
API version: 1.29
Go version: go1.7.5
Git commit: 89658be
Built: Thu May 4 22:10:54 2017
OS/Arch: linux/amd64
Server:
Version: 17.05.0-ce
API version: 1.29 (minimum version 1.12)
Go version: go1.7.5
Git commit: 89658be
Built: Thu May 4 22:10:54 2017
OS/Arch: linux/amd64
Experimental: false
您可以保存当前的iptables配置,然后在服务器启动时加载它:
iptables-save | sudo tee /etc/iptables.conf
将以下内容复制到/etc/rc.local
# Load iptables rules from this file
iptables-restore < /etc/iptables.conf
#从此文件加载iptables规则
iptables还原