Restrict Docker exposed port from only specific IP adresses

Question

How to restrict a container's port exposed by Docker from only a list of IPs? Only this list of IP would be able to access this port.

I tried that:

iptables -I DOCKER -p tcp --dport PORT_X -j REJECT --reject-with icmp-port-unreachable
iptables -I DOCKER -p tcp --dport PORT_X --source EXTERNAL_IP_1 --destination HOST_IP_1 -j ACCEPT
iptables -I DOCKER -p tcp --dport PORT_X --source EXTERNAL_IP_2 --destination HOST_IP_1 -j ACCEPT
iptables -I DOCKER -p tcp --dport PORT_X --source EXTERNAL_IP_3 --destination HOST_IP_1 -j ACCEPT

Answer 1

I had the same problem. I solved it with this rules :

iptables -I DOCKER-USER -i <your_interface_name> -j DROP
iptables -I DOCKER-USER -i <your_interface_name> -s <your_first_ip> -j ACCEPT
iptables -I DOCKER-USER -i <your_interface_name> -s <your_second_ip> -j ACCEPT

Care, DOCKER-USER is a chain which will not be deleted when service docker restart

You should be able to add your port flag, but i'm not an expert and it is not my needs.