I have deployed a Docker Swarm server on my VPS, to handle an Asp.Net Core application. I want to serve this app through a Nginx web server.
Let's suppose my web app is a vanilla app I created through .Net Core CLI command:
dotnet new webapp mywebapp
Dockerfile (simplified):
FROM mcr.microsoft.com/dotnet/core/sdk:3.0-alpine as builder
WORKDIR /app
COPY . .
RUN dotnet publish -c Release -o publish
WORKDIR /app/publish
ENTRYPOINT ["dotnet", "MyWebApp.dll"]
My docker-compose.yml looks like this (simplified):
version: '3'
services:
app:
image: edouard/mywebapp:latest
ports:
- 9000:80
My nginx config looks like this:
server {
listen 443 ssl;
server_name myservername.com;
ssl_certificate /path/to/ssl_certificate;
ssl_certificate_key /path/to/ssl_certificate_key;
location / {
proxy_pass http://localhost:9000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection keep-alive;
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name myservername.com;
return 301 https://$host$request_uri;
}
As you can see, I use Nginx as reverse proxy server, redirecting all HTTP/HTTPS traffic from 80 and 443 ports to the local 9000 port, which Docker Swarm is mapping to the 80 port inside the container, on which a Kestrel server is running.
On https://myservername.com, everything is running fine. But here is the thing: people can also access to my web app on http://myservername.com:9000! This is something I don't want.
I guess I have to configure the firewall so that I only allow traffic to the 80 and 443 port (taking care of letting the 22 port for SSH, etc.). I have read some tutorials to know how to do this, however, Docker Swarm is also handling the firewall!
When I launch sudo iptables -L -v:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
3417 873K DOCKER-USER all -- any any anywhere anywhere
3417 873K DOCKER-INGRESS all -- any any anywhere anywhere
31 9043 DOCKER-ISOLATION-STAGE-1 all -- any any anywhere anywhere
0 0 ACCEPT all -- any docker0 anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 DOCKER all -- any docker0 anywhere anywhere
0 0 ACCEPT all -- docker0 !docker0 anywhere anywhere
0 0 ACCEPT all -- docker0 docker0 anywhere anywhere
18 7620 ACCEPT all -- any docker_gwbridge anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 DOCKER all -- any docker_gwbridge anywhere anywhere
13 1423 ACCEPT all -- docker_gwbridge !docker_gwbridge anywhere anywhere
0 0 DROP all -- docker_gwbridge docker_gwbridge anywhere anywhere
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-ISOLATION-STAGE-2 all -- docker0 !docker0 anywhere anywhere
13 1423 DOCKER-ISOLATION-STAGE-2 all -- docker_gwbridge !docker_gwbridge anywhere anywhere
31 9043 RETURN all -- any any anywhere anywhere
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- any docker0 anywhere anywhere
0 0 DROP all -- any docker_gwbridge anywhere anywhere
13 1423 RETURN all -- any any anywhere anywhere
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
3417 873K RETURN all -- any any anywhere anywhere
Chain DOCKER-INGRESS (1 references)
pkts bytes target prot opt in out source destination
1567 101K ACCEPT tcp -- any any anywhere anywhere tcp dpt:9000
1270 698K ACCEPT tcp -- any any anywhere anywhere state RELATED,ESTABLISHED tcp spt:9000
31 9043 RETURN all -- any any anywhere anywhere
How am I suppose to configure the firewall so that it doesn't interact with Docker Swarm? I have found some parts of answers:
However, I find it pretty complicated, and I am astonished that there is no official answer to this issue on Docker's blogs.
Versions:
- VPS: Debian 10.2
- Docker Engine: 19.03.5
- Nginx: 1.16.1
- Iptables: 1.8.2
Thanks for your help.
