История изменений
Исправление Qwentor, (текущая версия) :
# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
DROP tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:http state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:3031 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8888 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8086 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8083 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:3000 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:4002 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:4001 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:4000 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8001 state NEW
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN
ACCEPT tcp -- anywhere anywhere multiport dports 8000
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:8126
ACCEPT udp -- anywhere 172.17.0.2 udp dpt:8125
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:2024
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:2023
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:2004
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:cfinger
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:http
Chain DOCKER-ISOLATION (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Правила блокировки mysql тут нет (удалил), т.к. не работает.
Но вообще же вроде стоит не пускать все что явно не разрешено.
По крайней мере если поднимаю веб-сервер на произвольном порту - доступа нет - только на явно прописанных. А вот порт MariaDB сразу открытый. Хз в чем дело, не пойму пока.
Исправление Qwentor, :
# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
DROP tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:http state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:3031 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8888 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8086 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8083 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:3000 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:4002 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:4001 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:4000 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8001 state NEW
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN
ACCEPT tcp -- anywhere anywhere multiport dports 8000
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:8126
ACCEPT udp -- anywhere 172.17.0.2 udp dpt:8125
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:2024
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:2023
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:2004
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:cfinger
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:http
Chain DOCKER-ISOLATION (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Правило блокировки mysql тут нет (удалил), т.к. не работает.
Но вообще же вроде стоит не пускать все что явно не разрешено.
По крайней мере если поднимаю веб-сервер на произвольном порту - доступа нет - только на явно прописанных. А вот порт MariaDB сразу открытый. Хз в чем дело, не пойму пока.
Исходная версия Qwentor, :
# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
DROP tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:http state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:3031 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8888 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8086 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8083 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:3000 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:4002 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:4001 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:4000 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:8001 state NEW
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN
ACCEPT tcp -- anywhere anywhere multiport dports 8000
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:8126
ACCEPT udp -- anywhere 172.17.0.2 udp dpt:8125
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:2024
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:2023
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:2004
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:cfinger
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:http
Chain DOCKER-ISOLATION (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Правило блокировки mysql тут нет, т.к. не работает.
Но вообще же вроде стоит не пускать все что явно не разрешено.
По крайней мере если поднимаю веб-сервер на произвольном порту - доступа нет - только на явно прописанных. А вот порт MariaDB сразу открытый. Хз в чем дело, не пойму пока.