What is the best way to limit the IP addresses which can be access from within a docker container?

Question

I have an answer which will limit docker containers to only be able to access a single IP address outside the host. Using this iptables rule on the host:

iptables -I FORWARD -i docker0 ! -d 8.8.8.8 -j DROP

means that from inside any docker containers it is only possible to access the IP address 8.8.8.8.

This is fairly drastic - basically, if the destination is NOT 8.8.8.8 then drop the packet.

What is the best way that I can set up rules which would allow me limit the containers to a certain number of IP addresses?

Answer 1

I needed to ensure that the dev copy of the website which was in the docker container could not access any live resources - Paypal, various API's etc. The code in the website was legacy and many things/URL's were hard-coded.

The way I achieved this was to have something like this in the build script:

echo
echo "Setting up firewall rules for all docker containers..."
sudo ipset create dockerdests hash:ip -exist
sudo ipset add dockerdests x.x.x.x -exist
sudo ipset add dockerdests y.y.y.y -exist
sudo ipset add dockerdests 8.8.8.8 -exist
sudo ipset add dockerdests 8.8.4.4 -exist
sudo iptables -I FORWARD 1 -i docker0 -m set --match-set dockerdests dst -j ACCEPT
sudo iptables -I FORWARD 2 -i docker0 -j DROP

where x.x.x.x and y.y.y.y are dev resources.