firewalld & docker - interaction

Support for security such as Firewalls and securing linux
Post Reply
amazerol
Posts: 2
Joined: 2020/01/13 18:36:34

firewalld & docker - interaction

Post by amazerol » 2020/01/13 18:48:55

Hi,
I'm currently using CentOS 7 as a server. I use firewalld to restrain to the maximum the access to my server. Only my ssh and nginx is accessible ... Well, actually this is what I thought.
I've discover a really annoying problem : I use postgresql inside a docker (I use the official image) and for an unknown reason, I can access my database on port 5432 (default port for postgresql) from outside even though the only active zone is the following one :

Code: Select all

  public (active)
  target: default
  icmp-block-inversion: yes
  interfaces: eth0
  sources:
  services: nginx ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
nginx service allows port 80 and 443 and ssh service allows port 22.
I don't understand why psql is accessible from outside. As far as I know I suspect docker because I've had a similar issue when I used debian server. Docker tends to meddle with iptables and overwrites rules.
Thanks for your help !

amazerol
Posts: 2
Joined: 2020/01/13 18:36:34

Re: firewalld & docker - interaction

Post by amazerol » 2020/01/14 11:26:56

In the end, I will finally answer to myself.
Actually, It seems to be a know problem between firewalld and docker. Here is a link showing such incompatibility.
Since docker is tampering with only ports it exposes, I just change the docker run instruction to listen to only local connections :

Code: Select all

docker run -p 5432:5432 ....
is replaced by

Code: Select all

docker run -p 127.0.0.1:5432:5432
Hoping this may help some with the same problem.

Post Reply

Return to “CentOS 7 - Security Support”