CentOS

Hi,
I'm currently using CentOS 7 as a server. I use firewalld to restrain to the maximum the access to my server. Only my ssh and nginx is accessible ... Well, actually this is what I thought.
I've discover a really annoying problem : I use postgresql inside a docker (I use the official image) and for an unknown reason, I can access my database on port 5432 (default port for postgresql) from outside even though the only active zone is the following one :

Code: Select all

  public (active)
  target: default
  icmp-block-inversion: yes
  interfaces: eth0
  sources:
  services: nginx ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

nginx service allows port 80 and 443 and ssh service allows port 22.
I don't understand why psql is accessible from outside. As far as I know I suspect docker because I've had a similar issue when I used debian server. Docker tends to meddle with iptables and overwrites rules.
Thanks for your help !

In the end, I will finally answer to myself.
Actually, It seems to be a know problem between firewalld and docker. Here is a link showing such incompatibility.
Since docker is tampering with only ports it exposes, I just change the docker run instruction to listen to only local connections :

Code: Select all

docker run -p 5432:5432 ....

is replaced by

Code: Select all

docker run -p 127.0.0.1:5432:5432

Hoping this may help some with the same problem.

CentOS

firewalld & docker - interaction

firewalld & docker - interaction

Re: firewalld & docker - interaction