Docker daemon configuration

Take back the iptables control from the Docker daemon. Add --iptables=false to the Docker daemon unit, located at /lib/systemd/system/docker.service on ArchLinux.

Now, reload the unit file and restart the service:

$ systemctl daemon-reload
$ systemctl restart docker.service

Setup iptables

Here is the final iptables rules file, may it serve you well.

*nat
-A POSTROUTING -s 172.17.0.0/16 -j MASQUERADE
COMMIT

*filter
# Default policy: DROP all
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP

# Answer to established and related connections
-A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow anything on localhost
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

########################
# Docker configuration #
########################

# Allow dockers to communicate with other dockers
-A FORWARD -i docker0 -o docker0 -j ACCEPT

# Allow dockers to perform DNS lookups
-A FORWARD -p udp -i docker0 --dport 53 -j ACCEPT
-A FORWARD -p tcp -i docker0 --dport 53 -j ACCEPT

# Allow HTTP and HTTPS traffic
-A FORWARD -p tcp -i docker0 -m multiport --dports 80,443 -j ACCEPT

######################
# Host configuration #
######################

# Allow DNS lookup
-A OUTPUT -p udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp --dport 53 -j ACCEPT

# Allow HTTP/HTTPS traffic through the proxy (if you decide to setup the HTTP proxy)
# -A OUTPUT -p tcp -m multiport --dports 80,443 -m owner --uid-owner privoxy -j ACCEPT

# Allow SSH connections on port 22
-A INPUT -p tcp --dport 22 -j ACCEPT

# Allow connection to the database from host
-A OUTPUT -p tcp --dport 5432 -j ACCEPT

# Allow incoming HTTPS connections
-A INPUT -p tcp --dport 443 -j ACCEPT

# Reject all other traffic
-A INPUT -j REJECT
-A FORWARD -j REJECT
-A OUTPUT -o eth0 -j REJECT

COMMIT

This file may be daunting if you are not used to iptables. Let's build it from scratch, step by step.

A good way to start is to disable all traffic on the virtual machine. Create an iptables rules file (e.g. /etc/iptables/rules) and set the default policy to DROP for all the traffic. Do not apply those rules if you are using SSH to connect to the virtual machine, it would disconnect you and prevent any future SSH connection. If you use SSH, wait until the end of the iptables section before applying the rules.

*filter
# Incoming IP packets
-P INPUT DROP
# Packets from someone else (another IP address) destinated to another IP address
-P FORWARD DROP
# Outgoing IP packets
-P OUTPUT DROP
COMMIT

Now, every attempt to communicate should be dropped. Most applications will then fail on timeouts, which is not very convenient. It would be better to have a communication refused message when a packet is discarded by the firewall.

To reject the packets instead of simply dropping them, add the following rules right before the COMMIT instruction:

-A INPUT -j REJECT
-A FORWARD -j REJECT
-A OUTPUT -j REJECT

It's time to allow some traffic. All the rules added from now on should be placed between the policy rules (line starting with -P) and the reject rules -A ...  REJECT as the iptables rules file is processed from top to bottom.

First, allow dockers to communicate with each other:

-A FORWARD -i docker0 -o docker0 -j ACCEPT

If you want them to connect to a network outside of the virtual machine, say the Internet, you'll also have to masquerade traffic from the dockers, so that the outside world can reply to the docker that performed the request. Add the following section in the rules file (e.g. before the *filter section):

*nat
-A POSTROUTING -s 172.17.0.0/16 -j MASQUERADE
COMMIT

When a rule accepts traffic on a port for a TCP connection, it basically enables the TCP handshake to be handled correctly. Enabling established connections ensures subsequent traffic will be allowed. The related state is a bit more subtle, a good read is the official iptables description for connection state.

# TCP established and related connections
-A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

# UDP established and related connections
-A INPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT

From now on, when you allow a new connection, subsequent exchanges will be allowed. Pretty essential for SSH.

You can allow SSH incoming connections on default port (22).

-A INPUT -p tcp -dport 22 -j ACCEPT

Proceed the same way for all other traffic to allow. Probably DNS (53), the database, incoming HTTP and HTTPS requests, etc.

Privoxy setup

Install privoxy for your distribution.

Modify the user.action file (e.g. located at /etc/privoxy/user.action) to block all traffic:

{ +block }
/

Unblock HTTP traffic based on hostname or path, following the syntax given in action files pattern documentation.

{ -block }
.pypi.python.org

Docker daemon setup

Once again, you may have to play around with the Docker daemon so that it knows about the system proxy. You should add or modify the Environment line in the Docker daemon unit file:

Environment="http_proxy=http://localhost:8118" "https_proxy=https://localhost:8118"

If you changed privoxy's listen port, you should change it here as well.