Docker iptables NAT Rules
Docker programs the kernel's nat table: DNAT rules in the DOCKER chain rewrite host-port destinations to container IPs, and a MASQUERADE rule rewrites container source addresses on the way out. Because these rules are consulted before host firewall rules like ufw, published ports can bypass a naively configured firewall.
This Concept is waiting for its first lesson!
Docker programs the kernel's nat table: DNAT rules in the DOCKER chain rewrite host-port destinations to container IPs, and a MASQUERADE rule rewrites container source addresses on the way out. Because these rules are consulted before host firewall rules like ufw, published ports can bypass a naively configured firewall.
Are you a teacher? Sign in to start contributing.
Sign In