Skip to content

Don't use ip_forward to expose containers to the public internet #11508

@docwhat

Description

@docwhat

Setting net.ipv4.ip_forward=1 is troublesome for various reasons, including security.

Would it be possible to stop using that and instead use something like iptables rule below instead?

Example for container started with --port 0.0.0.0:29418:29418

iptables -I PREROUTING 1 -t nat -i eth0 -p tcp --dport 29418 -j REDIRECT --to-port 29418

This should work, though translating 0.0.0.0 to eth0 is a potential problem. I'm not an iptables wizard, so there is certainly a better way to do this.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/networkingNetworkingkind/featureFunctionality or other elements that the project doesn't currently have. Features are new and shiny

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions