docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Explaining the default iptables FORWARD DROP policy (#2941) 

* Explaining the default iptables FORWARD DROP policy

* Copy edits
This commit is contained in:
Steven Hanna 2017-04-21 14:03:42 -04:00 committed by John Mulhausen
parent db000dc33f
commit 9a3c20b74a
1 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
engine/userguide/networking/default_network/container-communication.md
View File

@ -127,3 +127,39 @@ ACCEPT tcp -- 172.17.0.3 172.17.0.2 tcp dpt:80
containers to each other's raw IP addresses, so connections from one container containers to each other's raw IP addresses, so connections from one container
to another should always appear to be originating from the first container's own to another should always appear to be originating from the first container's own
IP address. IP address.
## Container communication between hosts
For security reasons, Docker configures the `iptables` rules to prevent containers
from forwarding traffic from outside the host machine, on Linux hosts. Docker sets
the default policy of the `FORWARD` chain to `DROP`.
To override this default behavior you can manually change the default policy:
```bash
$ sudo iptables -P FORWARD ACCEPT
```
The `iptables` settings are lost when the system reboots. If you want
the change to be permanent, refer to your Linux distribution's documentation.
> **Note**: In Docker 1.12 and earlier, the default `FORWARD` chain policy was
> `ACCEPT`. When you upgrade to Docker 1.13 or higher, this default is
> automatically changed for you.
>
> If you had a previously working configuration with multiple containers
> spanned over multiple hosts, this change may cause the existing setup
> to stop working if you do not intervene.
### Why would you need to change the default `DROP` to `ACCEPT`?
Suppose you have two hosts and each has the following configuration
```none
host1: eth0/192.168.7.1, docker0/172.17.0.0/16
host2: eth0/192.168.8.1, docker0/172.18.0.0/16
```
If the container running on `host1` needs the ability to communicate directly
with a container on `host2`, you need a route from `host1` to `host2`. After
the route exists, `host2` needs to be able to accept packets destined for its
running container, and forward them along. Setting the policy to `ACCEPT`
accomplishes this.