9

I realized that recently docker add integration with firewalld and I just want to setup my server using firewalld instead of iptables boring rules and chains.

This is my docker zone output:


root@test:~# sudo firewall-cmd --zone=docker --list-all 
docker (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: br-0a659f93a5b6 br-be2e44b2b069 docker0
  sources: 
  services: 
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

I had run multiple services including Laravel(nginx port binding 80 -> 5050), mysql, etc. with above config. I expect that anyone cannot access to port 5050, 3306(mysql) but unfortunately firewall has no effect and everything is open and accessible from outside.

and this is docker modules docker modules

Now How really configure firewalld to drop every request excepts allowed ports?

Masoud Tavakkoli
  • 950
  • 13
  • 34

1 Answers1

1

In summary, the solution is:

  1. Disable iptables in docker
  2. Add masquerade to public zone
  3. Add docker network interface to trusted zone
  4. Add ethernet interface to public zone

I wrote an article about it here: https://dev.to/soerenmetje/how-to-secure-a-docker-host-using-firewalld-2joo

sloppypasta
  • 1,068
  • 9
  • 15
Sören Metje
  • 11
  • 2