mjhjmtu

I need to block all INPUT traffic to port 8090 on the Ubuntu server 16.04.
I used Iptables but it did not help.
Commands I used:

iptables -A INPUT -p tcp --dport 8090 -j DROP
iptables -A INPUT -p tcp --dport 8090 -s <IP> -j ACCEPT

In NAT I have:
Chain DOCKER (2 references)
target prot opt source destination
DNAT tcp -- anywhere <VM local IP> tcp dpt:8090 to:172.21.0.2:8080

Public interface named eth0 and docker interface named docker0

Because of DNAT you're now routing. Your INPUT chain isn't used anymore for this DNATed traffic and it's now the FORWARD chain that is traversed instead. The new destination is 172.21.0.2:8080 and that's what the rules should now care about, not <VM local IP>:8090 anymore.

So with DNAT in place, you should block your traffic with (in the right order: allow exception, then forbid everything else):

iptables -A FORWARD -s <IP> -d 172.21.0.2 -p tcp --dport 8080 -j ACCEPT
iptables -A FORWARD -d 172.21.0.2 -p tcp --dport 8080 -j DROP

To be sure it's actually done before any system rule, you could do:

iptables -I FORWARD 1 -s <IP> -d 172.21.0.2 -p tcp --dport 8080 -j ACCEPT
iptables -I FORWARD 2 -d 172.21.0.2 -p tcp --dport 8080 -j DROP

Those rules as is might prevent other containers to reach this container depending on configuration, so you might have to adapt them (by stating the external input interface for example). Anyway you have to find a way to integrate this nicely with the system's method of firewall.

about these lines:

iptables -A INPUT -p tcp --dport 8090 -j DROP
iptables -A INPUT -p tcp --dport 8090 -s <IP> -j ACCEPT

you should change order of those, because IPTables rules overwrite each other in conflict state and it is a correct way, so first correct these and check all other roles to prevent of overwriting.

regarding NAT part of your question, it is not clear, however, on docker you should assign port while you up a container:

docker run ... -p 8090:8080 ...