title: Block external access to docker containers
body: <p>I would like to block direct access to the docker containers from outside. I use a haproxy and want to only allow access to port 80, 443.</p>
  
  <p>I added the following rule to iptables. But I still can access docker containers through different ports.</p>
  
  <pre><code>*filter
  :INPUT DROP [0:0]
  :FORWARD ACCEPT [0:0]
  :OUTPUT ACCEPT [0:0]
  -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  -A INPUT -p icmp -j ACCEPT
  -A INPUT -i lo -j ACCEPT
  -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
  -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
  -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
  COMMIT
  </code></pre>
  
  <p>This probably due to the DOCKER chain</p>
  
  <pre><code># iptables -L
  Chain INPUT (policy DROP)
  target     prot opt source               destination
  ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
  ACCEPT     icmp --  anywhere             anywhere
  ACCEPT     all  --  anywhere             anywhere
  ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
  ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:http
  ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:https
  
  Chain FORWARD (policy ACCEPT)
  target     prot opt source               destination
  DOCKER-ISOLATION  all  --  anywhere             anywhere
  DOCKER     all  --  anywhere             anywhere
  ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
  ACCEPT     all  --  anywhere             anywhere
  ACCEPT     all  --  anywhere             anywhere
  DOCKER     all  --  anywhere             anywhere
  ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
  ACCEPT     all  --  anywhere             anywhere
  ACCEPT     all  --  anywhere             anywhere
  DOCKER     all  --  anywhere             anywhere
  ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
  ACCEPT     all  --  anywhere             anywhere
  ACCEPT     all  --  anywhere             anywhere
  DOCKER     all  --  anywhere             anywhere
  ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
  ACCEPT     all  --  anywhere             anywhere
  ACCEPT     all  --  anywhere             anywhere
  
  Chain OUTPUT (policy ACCEPT)
  target     prot opt source               destination
  
  Chain DOCKER (4 references)
  target     prot opt source               destination
  ACCEPT     tcp  --  anywhere             172.18.0.2           tcp dpt:http
  
  Chain DOCKER-ISOLATION (1 references)
  target     prot opt source               destination
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  DROP       all  --  anywhere             anywhere
  RETURN     all  --  anywhere             anywhere
  </code></pre>
  
  <p>What rules would I need to create to block direct access?</p>