Join Log in
Score:2
avatar Server

How exactly is docker circumventing my nftables?

sn flag
dewijones92

My aim is to block all ports from non "lo" interfaces except for 22, 80, 443. I don't want external devices to my Rasberry pi to be able to access anything else except for 22, 80, 443.

I have a nc server running on port 9123. My nftables rightly blocks LAN devices from accessing that port. However - any service I start in docker seems to be NOT blocked - other LAN devices can access docker servers on the PI. I don't quite understand how this is happening. On line 107 my defauly policy is to DROP, the proceeding line adds an exception on the "lo" interface. What exactly is going on here? And how can I achieve the desired behaviour (i.e.) to block LAN devices from accessing anything on the pi except for 22,80,443? thanks

   root@raspberrypi:/home/pi/tmp # nft  list ruleset   | awk '{printf "%d\t%s\n", NR, $0}'
    1   table ip nat {
    2       chain DOCKER {
    3           iifname "docker0" counter packets 0 bytes 0 return
    4           iifname "docker_gwbridge" counter packets 0 bytes 0 return
    5           iifname "br-7a4b6e0a5c6f" counter packets 3840 bytes 115200 return
    6           iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 8920 counter packets 0 bytes 0 dnat to 172.20.0.2:8920
    7           iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 8096 counter packets 0 bytes 0 dnat to 172.20.0.2:8096
    8           iifname != "docker0" meta l4proto tcp tcp dport 8080 counter packets 0 bytes 0 dnat to 172.17.0.2:8080
    9           iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 445 counter packets 0 bytes 0 dnat to 172.20.0.3:445
    10          iifname != "docker0" meta l4proto tcp tcp dport 3389 counter packets 0 bytes 0 dnat to 172.17.0.2:3389
    11          iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 9125 counter packets 8306 bytes 531572 dnat to 172.20.0.5:80
    12          iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 9123 counter packets 0 bytes 0 dnat to 172.20.0.6:80
    13          iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 139 counter packets 0 bytes 0 dnat to 172.20.0.3:139
    14          iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 9124 counter packets 0 bytes 0 dnat to 172.20.0.7:80
    15          iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 32400 counter packets 0 bytes 0 dnat to 172.20.0.8:32400
    16      }
    17  
    18      chain POSTROUTING {
    19          type nat hook postrouting priority srcnat; policy accept;
    20          oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 958 bytes 399977 masquerade
    21          oifname != "docker_gwbridge" ip saddr 172.19.0.0/16 counter packets 0 bytes 0 masquerade
    22          oifname != "br-7a4b6e0a5c6f" ip saddr 172.20.0.0/16 counter packets 184 bytes 12810 masquerade
    23          oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade
    24          oifname != "br-7a4b6e0a5c6f" ip saddr 172.20.0.0/16 counter packets 8 bytes 502 masquerade
    25          oifname != "docker_gwbridge" ip saddr 172.19.0.0/16 counter packets 0 bytes 0 masquerade
    26          oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade
    27          oifname != "docker_gwbridge" ip saddr 172.19.0.0/16 counter packets 0 bytes 0 masquerade
    28          oifname != "br-7a4b6e0a5c6f" ip saddr 172.20.0.0/16 counter packets 8 bytes 502 masquerade
    29          oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 45 bytes 3148 masquerade
    30          oifname != "docker_gwbridge" ip saddr 172.19.0.0/16 counter packets 0 bytes 0 masquerade
    31          oifname != "br-7a4b6e0a5c6f" ip saddr 172.20.0.0/16 counter packets 36 bytes 2324 masquerade
    32          oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade
    33          oifname != "br-7a4b6e0a5c6f" ip saddr 172.20.0.0/16 counter packets 36 bytes 2324 masquerade
    34          oifname != "docker_gwbridge" ip saddr 172.19.0.0/16 counter packets 0 bytes 0 masquerade
    35          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 8080 counter packets 0 bytes 0 masquerade
    36          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 8920 counter packets 0 bytes 0 masquerade
    37          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 3389 counter packets 0 bytes 0 masquerade
    38          ip saddr 172.20.0.4 ip daddr 172.20.0.4 tcp dport 32400 counter packets 0 bytes 0 masquerade
    39          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 8096 counter packets 0 bytes 0 masquerade
    40          ip saddr 172.20.0.5 ip daddr 172.20.0.5 tcp dport 80 counter packets 0 bytes 0 masquerade
    41          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 445 counter packets 0 bytes 0 masquerade
    42          ip saddr 172.20.0.7 ip daddr 172.20.0.7 tcp dport 80 counter packets 0 bytes 0 masquerade
    43          ip saddr 172.20.0.8 ip daddr 172.20.0.8 tcp dport 80 counter packets 0 bytes 0 masquerade
    44          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 139 counter packets 0 bytes 0 masquerade
    45          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 80 counter packets 0 bytes 0 masquerade
    46          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 8080 counter packets 0 bytes 0 masquerade
    47          ip saddr 172.20.0.3 ip daddr 172.20.0.3 tcp dport 32400 counter packets 0 bytes 0 masquerade
    48          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 3389 counter packets 0 bytes 0 masquerade
    49          ip saddr 172.20.0.5 ip daddr 172.20.0.5 tcp dport 80 counter packets 0 bytes 0 masquerade
    50          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 80 counter packets 0 bytes 0 masquerade
    51          ip saddr 172.20.0.7 ip daddr 172.20.0.7 tcp dport 445 counter packets 0 bytes 0 masquerade
    52          ip saddr 172.20.0.8 ip daddr 172.20.0.8 tcp dport 8920 counter packets 0 bytes 0 masquerade
    53          ip saddr 172.20.0.7 ip daddr 172.20.0.7 tcp dport 139 counter packets 0 bytes 0 masquerade
    54          ip saddr 172.20.0.8 ip daddr 172.20.0.8 tcp dport 8096 counter packets 0 bytes 0 masquerade
    55          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 445 counter packets 0 bytes 0 masquerade
    56          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 8080 counter packets 0 bytes 0 masquerade
    57          ip saddr 172.20.0.3 ip daddr 172.20.0.3 tcp dport 80 counter packets 0 bytes 0 masquerade
    58          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 3389 counter packets 0 bytes 0 masquerade
    59          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 139 counter packets 0 bytes 0 masquerade
    60          ip saddr 172.20.0.4 ip daddr 172.20.0.4 tcp dport 32400 counter packets 0 bytes 0 masquerade
    61          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 80 counter packets 0 bytes 0 masquerade
    62          ip saddr 172.20.0.8 ip daddr 172.20.0.8 tcp dport 80 counter packets 0 bytes 0 masquerade
    63          ip saddr 172.20.0.9 ip daddr 172.20.0.9 tcp dport 8920 counter packets 0 bytes 0 masquerade
    64          ip saddr 172.20.0.9 ip daddr 172.20.0.9 tcp dport 8096 counter packets 0 bytes 0 masquerade
    65          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 80 counter packets 0 bytes 0 masquerade
    66          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 8080 counter packets 0 bytes 0 masquerade
    67          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 3389 counter packets 0 bytes 0 masquerade
    68          ip saddr 172.20.0.3 ip daddr 172.20.0.3 tcp dport 80 counter packets 0 bytes 0 masquerade
    69          ip saddr 172.20.0.4 ip daddr 172.20.0.4 tcp dport 80 counter packets 0 bytes 0 masquerade
    70          ip saddr 172.20.0.5 ip daddr 172.20.0.5 tcp dport 8920 counter packets 0 bytes 0 masquerade
    71          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 445 counter packets 0 bytes 0 masquerade
    72          ip saddr 172.20.0.7 ip daddr 172.20.0.7 tcp dport 32400 counter packets 0 bytes 0 masquerade
    73          ip saddr 172.20.0.5 ip daddr 172.20.0.5 tcp dport 8096 counter packets 0 bytes 0 masquerade
    74          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 139 counter packets 0 bytes 0 masquerade
    75          meta l4proto tcp ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 8920 counter packets 0 bytes 0 masquerade
    76          meta l4proto tcp ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 8096 counter packets 0 bytes 0 masquerade
    77          meta l4proto tcp ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 8080 counter packets 0 bytes 0 masquerade
    78          meta l4proto tcp ip saddr 172.20.0.3 ip daddr 172.20.0.3 tcp dport 445 counter packets 0 bytes 0 masquerade
    79          meta l4proto tcp ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 3389 counter packets 0 bytes 0 masquerade
    80          meta l4proto tcp ip saddr 172.20.0.5 ip daddr 172.20.0.5 tcp dport 80 counter packets 0 bytes 0 masquerade
    81          meta l4proto tcp ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 80 counter packets 0 bytes 0 masquerade
    82          meta l4proto tcp ip saddr 172.20.0.3 ip daddr 172.20.0.3 tcp dport 139 counter packets 0 bytes 0 masquerade
    83          meta l4proto tcp ip saddr 172.20.0.7 ip daddr 172.20.0.7 tcp dport 80 counter packets 0 bytes 0 masquerade
    84          meta l4proto tcp ip saddr 172.20.0.8 ip daddr 172.20.0.8 tcp dport 32400 counter packets 0 bytes 0 masquerade
    85      }
    86  
    87      chain PREROUTING {
    88          type nat hook prerouting priority dstnat; policy accept;
    89          fib daddr type local counter packets 86612 bytes 5842738 jump DOCKER
    90          fib daddr type local counter packets 59086 bytes 4082250 jump DOCKER
    91          fib daddr type local counter packets 58016 bytes 4020180 jump DOCKER
    92          fib daddr type local counter packets 58010 bytes 4019512 jump DOCKER
    93          fib daddr type local counter packets 21891 bytes 1551454 jump DOCKER
    94      }
    95  
    96      chain OUTPUT {
    97          type nat hook output priority -100; policy accept;
    98          ip daddr != 127.0.0.0/8 fib daddr type local counter packets 11 bytes 660 jump DOCKER
    99          ip daddr != 127.0.0.0/8 fib daddr type local counter packets 10 bytes 600 jump DOCKER
    100         ip daddr != 127.0.0.0/8 fib daddr type local counter packets 9 bytes 540 jump DOCKER
    101         ip daddr != 127.0.0.0/8 fib daddr type local counter packets 8 bytes 480 jump DOCKER
    102         ip daddr != 127.0.0.0/8 fib daddr type local counter packets 1 bytes 60 jump DOCKER
    103     }
    104 }
    105 table ip filter {
    106     chain INPUT {
    107         type filter hook input priority -450; policy drop;
    108         iifname "lo" counter packets 19231 bytes 156043045 accept
    109         ip daddr 127.0.0.0/8 counter packets 0 bytes 0 reject
    110         ct state established,related counter packets 67781 bytes 452733513 accept
    111         icmp type echo-request accept
    112         ct state new tcp dport 22 counter packets 119 bytes 7020 accept
    113         ct state new tcp dport 443 counter packets 324 bytes 19343 accept
    114         ct state new tcp dport 80 counter packets 17 bytes 916 accept
    115         ip protocol icmp counter packets 0 bytes 0 accept
    116         limit rate 5/minute counter packets 685 bytes 107167 log prefix "iptables denied: " level debug
    117         tcp dport 9125 drop
    118         counter packets 27066 bytes 4826608 drop
    119     }
    120 
    121     chain OUTPUT {
    122         type filter hook output priority filter - 1; policy drop;
    123         counter packets 133164 bytes 583633753 accept
    124     }
    125 }
1495
1 + 0
Score:2
A.B avatar Server
cl flag
A.B

As one can see in the Packet flow in Netfilter and General Networking schematic below:

Packet flow in Netfilter and General Networking

the nat prerouting chain happens before the routing decision. So when Docker uses DNAT to change the destination from the initial network namespace (ie: the host) to an other network namespace (a routed container), the flow doesn't pass anymore through filter/input but instead uses filter/forward: the ip filter INPUT chain is not traversed anymore. Choosing priority -450 doesn't change anything: that's a priority within the same hook. prerouting always happens before input (as seen on the schematic) whatever the priority chosen. Using -450 in filter/input only allow to have the chain be traversed first, before iptables' default priority 0.

Also as a remark choosing a chain ip filter INPUT with nftables as in OP's example (since the priority -450 can only have been made using nftables) could clash with iptables-nft's filter/INPUT chain's handling and should be avoided.

The INPUT rules can still be used in a few cases:

  • when not related to Docker: docker doesn't redirect traffic not intended for its containers
  • when the container is stopped (eg: the application crashed and was not restarted automatically) then Docker removes associated rules: packets are not routed/forwarded anymore
  • possibly depending on Docker's configuration (about docker-proxy and NAT hairpin controlled by Docker's userland-proxy global parameter) when a container is a client of another container, then in the docker-proxy case, the traffic is not routed (because it goes through docker-proxy which is a proxy) and thus reaches the input hook.

I also made an answer in an UL SE Q/A about how to use nftables along Docker, its own use of iptables and the br_netfilter kernel module which also affects nftables even if nftables has no adequate tool to cope with it:

nftables whitelisting docker

+ 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.