How to block non-local traffic?

[panomitrius]

I realized this script exposes all docker containers to traffic from everywhere. How can I modify it to only allow local traffic while not opening up to global access?

[luison]

We are also struggling with this. Our intention is to maintain CSF "in front of docker so only opened ports in CSF are open to external IPs not in allowed lists or dynamic.

So far we've managed to do it by adding accept rules to the output of all of the docker interfaces.

@juli3nk scripts is actually very efficient but treats NAT the same way as CSF, this is NAT is non-firewalled. And creates all opened ports in docker as DNAT rule.

It would be great to see an alternative option.

[barart]

need this too... does somebody knows how to do this?

[emielmolenaar]

I've hacked together a small solution for this problem; unfortunately it involves editing the original script. See emielmolenaar@1d34117 .

I'm by no means an iptables / csf expert so please let me know if this isn't the way to go!

[Scott-Mc]

@panomitrius CSF has some base docker support by default now, you can set DOCKER="1" in /etc/csf/csf.conf and not need this script. However if you need to expose a proxy and get the clients IP you will need a script like this with DNAT rules. I have created a variant of this script and fixed this and most of the issues mentioned in this repo, it's at https://github.com/Scott-Mc/csf-docker if useful to you/anyone else that still uses this old repo.