mjhjmtu

This is arch linux, kernel 4.18.0-rc3.

I've run these commands:

iptables -F
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP

iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# Allow local
iptables -A INPUT -i lo -j ACCEPT

# Allow services
iptables -A INPUT -p tcp -m tcp --dport 22 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 53 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 8000 -s 192.168.0.0/24 -j ACCEPT

# Allow established
iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

And running iptables -nvL produces:

Chain INPUT (policy DROP 2120 packets, 121K bytes)
 pkts bytes target prot opt in out source destination
 116 15649 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW
 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F
 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
 36 2432 ACCEPT tcp -- * * 192.168.0.0/24 0.0.0.0/0 tcp dpt:22
 1 44 ACCEPT tcp -- * * 192.168.0.0/24 0.0.0.0/0 tcp dpt:53
 4 160 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
 3 132 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
 0 0 ACCEPT tcp -- * * 192.168.0.0/24 0.0.0.0/0 tcp dpt:8000

Which I think looks good, I've omitted some extra docker chains that it adds itself. But then if I nmap from another host on the network I get:

Host is up (0.0020s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
443/tcp closed https
MAC Address: D4:5D:DF:13:98:A5 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 4.89 seconds

So, the bit that doesn't work

• port 80 isn't there, but ss shows me it's listening and I can curl to it - nginx running in docker


• port 53 is there, and ss shows me it's listening but I can't dig it, it times out - dnsmasq not running in docker

I'm assuming these are related as if I stop the iptables service everything goes through ok, not sure which way to go next though. Any suggestions what I'm missing?

Edit:

$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
7c91645b13e0 jenkins/jenkins:lts "/sbin/tini -- /usr/…" 11 hours ago Up 11 hours 8080/tcp, 50000/tcp jenkins_jenkins_1
be584769dae7 nginx:1 "nginx -g 'daemon of…" 11 hours ago Up 10 hours 0.0.0.0:80->80/tcp website_nginx_1
6fdc045ae863 mongo:3 "docker-entrypoint.s…" 36 hours ago Up 11 hours 27017/tcp wikijs_mongo_1
abf884b83aeb requarks/wiki "supervisord --nodae…" 36 hours ago Up 11 hours 3000/tcp wikijs_wiki_1

$ ss -tlan
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 32 0.0.0.0:53 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
ESTAB 0 0 192.168.0.12:34196 192.168.0.209:8009
TIME-WAIT0 0 192.168.0.12%enp5s0:37082 138.201.81.199:80
ESTAB 0 0 192.168.0.12:58514 151.101.17.140:443
ESTAB 0 0 192.168.0.12:22 192.168.0.99:58500
ESTAB 0 0 192.168.0.12:34380 192.168.0.147:8009
ESTAB 0 0 172.19.0.1:59316 172.19.0.3:80
ESTAB 0 0 172.19.0.1:59304 172.19.0.3:80
LISTEN 0 128 *:80 *:*
LISTEN 0 128 *:4243 *:*
LISTEN 0 32 [::]:53 [::]:*
LISTEN 0 128 [::]:22 [::]:*
ESTAB 0 0 [::ffff:192.168.0.12]:80 [::ffff:192.168.0.99]:60214
ESTAB 0 0 [::ffff:192.168.0.12]:80 [::ffff:192.168.0.99]:60323

DNS not working was because iptables was allowing TCP not UDP. That's straightforward. HTTP I understand a little less, but by default the docker daemon runs as:

/usr/bin/dockerd -H fd://

I had this overridden to expose the docker daemon on a TCP port

/usr/bin/dockerd -H tcp://0.0.0.0:4243 -H unix:///var/run/docker.sock

What this has to do with the ports that the container services run on, I don't know. But by not exposing the docker daemon (I did need that, no longer do) it's working now.