Re: docker and iptables

jdow <jdow@xxxxxxxxxxxxx> · Fri, 20 Oct 2023 00:39:51 -0700



    On 20231019 19:15:47, David King wrote:

    
    On
      10/19/23 21:53, Jonathan Billings wrote:
      

        On Oct 19, 2023, at 10:05, Alex <mysqlstudent@xxxxxxxxx>
        wrote:
        

        I'm using docker on fedora38 and can't
          figure out how to prevent port 8080 from being available to
          the outside world. I've done quite a bit of reading on this,
          and it appears I'm not the only one having trouble figuring
          this out. This docker doc appears to indicate it shouldn't be
          listening on the external port when the -p option is not used.
          

          https://docs.docker.com/network/#the-world
          

        You should be using firewalld to limit access to services
        running in docker, as described here:
        

https://docs.docker.com/network/packet-filtering-firewalls/#integration-with-firewalld
        

      Indeed.  Fedora deprecated iptables a while ago.  It uses nftables
      now with firewalld being used to configure it.
      

    And finally you can even set up a filter that allows a specific
      source to attempt a connection no more often than once every 90
      seconds. Before I found that the IPTables "recent" option was the
      only solution newer than ipchains where I first used the trick. I
      bet something as simple as "horsehair" is far enough down the
      guess list that the probability of a successful attack is out at
      way more time than I have life left. When you can put time on your
      side life's great.
    Now, presuming he has another setup problem similar to the one I
      nominally found a potential solution for two days ago and have not
      implemented yet can you answer his actual question rather than
      accuse him of being a dunce using the wrong and deprecated tool on
      the off hand chance he has a worthwhile reason? It would be the
      polite thing to do, wouldn't it?

    
    {^_-}

    
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue