配置 DOCKER-USER链 以限制Docker容器的访问，链的规则是否生效与链的优先级和规则顺序相关

1.规则

查看现有规则

sudo iptables -L DOCKER-USER --line-numbers

允许已建立的连接

sudo iptables -I DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

允许 192.168.0.100 访问

sudo iptables -A DOCKER-USER -s 192.168.0.100 -j ACCEPT

仅允许 192.168.0.100 访问 7000 端口

sudo iptables -A DOCKER-USER -p tcp --dport 7000 -s 192.168.0.100 -j ACCEPT
sudo iptables -A DOCKER-USER -p tcp --dport 7000 -j DROP

⚠️注意：7000为容器内部端口

添加规则到指定位置

sudo iptables -I DOCKER-USER 3 -p tcp --dport 7000 -s 192.168.0.100 -j ACCEPT

禁止所有 IP 的访问

sudo iptables -A DOCKER-USER -j DROP

条件都不匹配时，返回上一级链

sudo iptables -A DOCKER-USER -j RETURN

删除所有规则

sudo iptables -F DOCKER-USER

删除指定规则

sudo iptables -D DOCKER-USER 4

恢复默认规则

sudo iptables -F DOCKER-USER

sudo iptables -I DOCKER-USER -j RETURN

参数说明: -I在最前面插入 -A在最后面插入 -F清空指定链里的所有规则

2.示例

# 示例1：允许 192.168.0.100 访问
sudo iptables -I DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A DOCKER-USER -s 192.168.0.100 -j ACCEPT
sudo iptables -A DOCKER-USER -j DROP
sudo iptables -A DOCKER-USER -j RETURN


# 示例2：仅允许 192.168.0.100 访问 7000 端口
sudo iptables -I DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A DOCKER-USER -p tcp --dport 7000 -s 192.168.0.100 -j ACCEPT
sudo iptables -A DOCKER-USER -p tcp --dport 7000 -j DROP
sudo iptables -A DOCKER-USER -j RETURN

3.示例输出

# 示例1
sudo iptables -L DOCKER-USER --line-numbers
Chain DOCKER-USER (1 references)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
2    ACCEPT     all  --  192.168.0.100        anywhere            
3    DROP       all  --  anywhere             anywhere            
4    RETURN     all  --  anywhere             anywhere 

# 示例2
sudo iptables -L DOCKER-USER --line-numbers
Chain DOCKER-USER (1 references)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
2    ACCEPT     tcp  --  192.168.0.100        anywhere             tcp dpt:7000
3    DROP       tcp  --  anywhere             anywhere             tcp dpt:7000
4    RETURN     all  --  anywhere             anywhere

4.持久化规则

iptables默认不会保存规则重启会失效，因此需要使用 iptables-persistent 工具来保存规则

安装 iptables-persistent

sudo apt install iptables-persistent

保存规则

sudo netfilter-persistent save

重新加载规则

sudo netfilter-persistent reload