title: Block outgoing connections to private IPs from Docker containers
body: <p>Some of the services that we run on our servers with Docker, try to connect to private IP addresses (10.0.0.0/8, 192.0.0.0/16, 172.16.0.0/12, 100.64.0.0/10).</p>
  
  <p>This behavior is normal but our server provider detects this traffic and sends us alerts.</p>
  
  <p>We would like to stop only the outgoing traffic, not the incoming with iptables.</p>
  
  <p>This is our current setup:</p>
  
  <pre><code>-A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner `id -u dockeruser` -j REJECT --reject-with icmp-port-unreachable
  -A OUTPUT -d 100.64.0.0/10 -m owner --uid-owner `id -u dockeruser` -j REJECT --reject-with icmp-port-unreachable
  -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner `id -u dockeruser` -j REJECT --reject-with icmp-port-unreachable
  -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner `id -u dockeruser` -j REJECT --reject-with icmp-port-unreachable
  </code></pre>
  
  <p>However this doesn't seem to work because Docker creates the following rules:</p>
  
  <pre><code>Chain FORWARD (policy ACCEPT)
  target     prot opt source               destination
  DOCKER-ISOLATION  all  --  anywhere             anywhere
  DOCKER     all  --  anywhere             anywhere
  </code></pre>
  
  <p>For the services:</p>
  
  <pre><code>Chain DOCKER (1 references)
  target     prot opt source               destination
  ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:1234
  ACCEPT     tcp  --  anywhere             172.17.0.4           tcp dpt:1234
  </code></pre>
  
  <p>Finally:</p>
  
  <pre><code>Chain DOCKER-ISOLATION (1 references)
  target     prot opt source               destination
  RETURN     all  --  anywhere             anywhere
  </code></pre>
  
  <p>Any feedback is appreciated.</p>