Oh just a simple API confirmation call, yeah just let it get access to the internet, just hardcode the response address and all and you are good.
OvermindDL1
shahryarjb
Thanks, I just have a question, if my container generally have access to internet will I have a problem?
answering this maybe help me to do safety my project generally, it goes without saying that I have only one external api in my project, and may my user be able to send malicious request to my elixir project without my nginix directly ? special if I use external api in my private api behind my api gateway? it is clear that it is just a question to prevent bad way to improve my project.
by the way I filtered this container by iptables and interface and subnet:
for example:
sudo docker network create --internal mynetwork_html
sudo docker network inspect mynetwork_html | grep Subnet
"Subnet": "192.168.100.0/20"
sudo iptables -S | grep 192.168.100.0 | cut -d" " -f7 | tail -n1
br-11d6257150db
network.yml
container_html:
networks:
- html
networks:
html:
external: true
name: mynetwork_html
for test:
sudo docker exec -it container_html ash
ping 8.8.8.8
ping google.com
ping yahoo.com
google ip range:
dig -t TXT _netblocks.google.com
; <<>> DiG 9.10.3-P4-Debian <<>> -t TXT _netblocks.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42472
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;_netblocks.google.com. IN TXT
;; ANSWER SECTION:
_netblocks.google.com. 872 IN TXT "v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all"
;; Query time: 34 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Oct 31 18:50:19 +0330 2018
;; MSG SIZE rcvd: 286
and
vi mynetwork
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 35.190.247.0/24 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 64.233.160.0/19 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 66.102.0.0/20 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 66.249.80.0/20 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 72.14.192.0/18 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 74.125.0.0/16 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 108.177.8.0/21 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 173.194.0.0/16 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 209.85.128.0/17 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 216.58.192.0/19 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 216.239.32.0/19 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/20 -d 8.8.8.8 ! -o br-11d6257150db -j MASQUERADE
sudo iptables -t nat -A DOCKER -i br-11d6257150db -j RETURN
sudo iptables -A FORWARD -o br-11d6257150db -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -o br-11d6257150db -j DOCKER
sudo iptables -A FORWARD -i br-11d6257150db ! -o br-11d6257150db -j ACCEPT
sudo iptables -D DOCKER-ISOLATION-STAGE-1 ! -s 192.168.100.0/20 -o br-11d6257150db -j DROP
sudo iptables -D DOCKER-ISOLATION-STAGE-1 ! -d 192.168.100.0/20 -i br-11d6257150db -j DROP
sudo iptables -A DOCKER-ISOLATION-STAGE-1 -i br-11d6257150db ! -o br-11d6257150db -j DOCKER-ISOLATION-STAGE-2
sudo iptables -A DOCKER-ISOLATION-STAGE-2 -o br-11d6257150db -j DROP
chmod u+x mynetwork
./mynetwork
0
OvermindDL1
Depends on what you run in it.
Has nothing to do with this, outgoing and incoming connections are exceedingly different, incoming has to be expose’d, outgoing does not.
1