title: docker, container ports and iptables
body: <p>I have inserted an iptables rule to block access to my containers from the internet (according to the official docker docs), but now my containers cannot access the internet either.</p>
  <p>I run a container on a dedicated server like this:</p>
  <pre><code>docker run --name mycontainer --network network1 -d -p 10000:80 someImage
  </code></pre>
  <p>I can access that container from my <strong>home network</strong>...:</p>
  <pre><code>telnet servername.com 10000
  </code></pre>
  <p>... even though I have limited access using <code>ufw</code>:</p>
  <pre><code>ufw status
  Status: active
  To                         Action      From
  --                         ------      ----
  22                         ALLOW       Anywhere                  
  80/tcp                     ALLOW       Anywhere                  
  ...
  </code></pre>
  <p>It makes no mention of port 10000, and I initially denied all incoming ports.</p>
  <p>According to the docs at <a href="https://docs.docker.com/network/iptables/" rel="nofollow noreferrer">https://docs.docker.com/network/iptables/</a> when starting a container with <code>-p</code>, docker will automatically expose the port through the firewall by manipulating iptables, using rules which are evaluated before <code>ufw</code> rules.</p>
  <p>Those docs then go on to suggest blocking incoming requests like this, in the section titled &quot;<em>Restrict connections <strong>to</strong> the Docker host</em>&quot;:</p>
  <pre><code>iptables -I DOCKER-USER -i eno ! -s 192.168.1.1 -j DROP
  </code></pre>
  <p>I got the interface name by running <code>route</code>:</p>
  <pre><code>Kernel IP routing table
  Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
  default         static-ip-182-1 0.0.0.0         UG    0      0        0 eno
  172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
  172.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-ef37f7b34afa
  172.19.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-979cf8868fcd
  182.133.43.627  0.0.0.0         255.255.255.192 U     0      0        0 eno
  </code></pre>
  <p>It works, I can no longer telnet onto port 10000.  (surprisingly I didn't need to reload / restart anything).</p>
  <p>Unfortunately, I can no longer access the internet from inside a container. The dedicated server can still ping google.com, but my container cannot:</p>
  <pre><code>docker exec mycontainer ping google.com
  
  ping: unknown host
  </code></pre>
  <p>That was working before inserting the iptables rule, but doesn't work any more.</p>
  <p>Question 1: what do I have to change in ufw / iptables so that my containers can again access the internet (outgoing), but so that I still cannot access my container from the internet (incoming)?</p>
  <p>Question 2: what do I have to change in the iptables rule so that it survives a reboot, because I noticed that after a reboot, I can again telnet to port 10000.</p>
  <p>UPDATE:</p>
  <pre><code>docker network ls
  NETWORK ID     NAME         DRIVER    SCOPE
  a1e2c7cdbc65   bridge       bridge    local
  218e121af9cd   host         host      local
  979cf8868fcd   network1     bridge    local
  cee02cfd1dba   none         null      local
  ef37f7b34afa   network2     bridge    local
  </code></pre>
  <p>I noticed that <code>/etc/resolv.conf</code> is different depending upon whether I check on a container inside a network or one with the default network:</p>
  <pre><code>docker run -it --rm --network network1 alpine cat /etc/resolv.conf
  nameserver 127.0.0.11
  options ndots:0
  
  docker run -it --rm alpine cat /etc/resolv.conf
  nameserver 80.237.128.56
  nameserver 80.237.128.57
  </code></pre>
  <p>Those two nameservers are the ones that my dedicated server uses.</p>
  <pre><code>ufw show raw | grep DROP
  Chain INPUT (policy DROP 0 packets, 0 bytes)
  Chain FORWARD (policy DROP 0 packets, 0 bytes)
         0        0 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0           
         0        0 DROP       all  --  *      br-ef37f7b34afa  0.0.0.0/0            0.0.0.0/0           
         0        0 DROP       all  --  *      br-979cf8868fcd  0.0.0.0/0            0.0.0.0/0           
     14262  1201304 DROP       all  --  eno    *      !127.0.0.1            0.0.0.0/0           
       173    37057 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
         0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
         0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
       427    35720 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  Chain INPUT (policy DROP 0 packets, 0 bytes)
  Chain FORWARD (policy DROP 0 packets, 0 bytes)
         0        0 DROP       all      *      *       ::/0                 ::/0                 rt type:0
         0        0 DROP       all      *      *       ::/0                 ::/0                 rt type:0
         0        0 DROP       all      *      *       ::/0                 ::/0                 ctstate INVALID
         0        0 DROP       all      *      *       ::/0                 ::/0                 rt type:0
         0        0 DROP       all      *      *       ::/0                 ::/0                
         0        0 DROP       all      *      *       ::/0                 ::/0                
  
  </code></pre>
  <p>a little more detail around those drops and docker generally:</p>
  <pre><code>Chain DOCKER (3 references)
      pkts      bytes target     prot opt in     out     source               destination
         2      120 ACCEPT     tcp  --  !br-979cf8868fcd br-979cf8868fcd  0.0.0.0/0            172.19.0.2           tcp dpt:3306
         1       60 ACCEPT     tcp  --  !br-ef37f7b34afa br-ef37f7b34afa  0.0.0.0/0            172.18.0.2           tcp dpt:18088
         0        0 ACCEPT     tcp  --  !br-979cf8868fcd br-979cf8868fcd  0.0.0.0/0            172.19.0.3           tcp dpt:80
         0        0 ACCEPT     tcp  --  !br-ef37f7b34afa br-ef37f7b34afa  0.0.0.0/0            172.18.0.3           tcp dpt:3306
  
  Chain DOCKER-ISOLATION-STAGE-1 (1 references)
      pkts      bytes target     prot opt in     out     source               destination
        19     1164 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
     14533  1228562 DOCKER-ISOLATION-STAGE-2  all  --  br-ef37f7b34afa !br-ef37f7b34afa  0.0.0.0/0            0.0.0.0/0
       168    14646 DOCKER-ISOLATION-STAGE-2  all  --  br-979cf8868fcd !br-979cf8868fcd  0.0.0.0/0            0.0.0.0/0
     25893  4430799 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
  
  Chain DOCKER-ISOLATION-STAGE-2 (3 references)
      pkts      bytes target     prot opt in     out     source               destination
         0        0 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
         0        0 DROP       all  --  *      br-ef37f7b34afa  0.0.0.0/0            0.0.0.0/0
         0        0 DROP       all  --  *      br-979cf8868fcd  0.0.0.0/0            0.0.0.0/0
     14720  1244372 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
  
  Chain DOCKER-USER (1 references)
      pkts      bytes target     prot opt in     out     source               destination
     14465  1218356 DROP       all  --  eno2   *      !127.0.0.1            0.0.0.0/0
     25893  4430799 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
  </code></pre>
  <pre><code>ufw show raw | grep REJECT # contains ip addresses from fail2ban
         0        0 REJECT     all  --  *      *       85.202.169.48        0.0.0.0/0            reject-with icmp-port-unreachable
        25     1904 REJECT     all  --  *      *       112.85.42.128        0.0.0.0/0            reject-with icmp-port-unreachable
        19     1664 REJECT     all  --  *      *       61.177.172.89        0.0.0.0/0            reject-with icmp-port-unreachable
        23     1884 REJECT     all  --  *      *       112.85.42.74         0.0.0.0/0            reject-with icmp-port-unreachable
        21     1764 REJECT     all  --  *      *       112.85.42.15         0.0.0.0/0            reject-with icmp-port-unreachable
        23     1884 REJECT     all  --  *      *       112.85.42.87         0.0.0.0/0            reject-with icmp-port-unreachable
        22     1748 REJECT     all  --  *      *       122.194.229.54       0.0.0.0/0            reject-with icmp-port-unreachable
        19     1644 REJECT     all  --  *      *       122.194.229.45       0.0.0.0/0            reject-with icmp-port-unreachable
        22     1844 REJECT     all  --  *      *       218.92.0.221         0.0.0.0/0            reject-with icmp-port-unreachable
        18     1104 REJECT     all  --  *      *       112.85.42.88         0.0.0.0/0            reject-with icmp-port-unreachable
         0        0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
         0        0 REJECT     all      *      *       ::/0                 ::/0                 reject-with icmp6-port-unreachable
  </code></pre>