search

capnspacehook / whalewall

Automate management of firewall rules for Docker containers
BSD 3-Clause "New" or "Revised" License
224 stars 3 forks source link

allowing only a reverse proxy #182

Open Dialgatrainer02 opened 7 months ago

Dialgatrainer02 commented 7 months ago

hello, im curently running a reverse proxy setup with multiple containers in docker compose. I have a domain that the reverse proxy uses. I am planning on using authentication via the reverse proxy for all my apps.

However the reverse proxy can be bypassed by entering domain.com:port of specific container this is because my reverse proxy is on the same machine as my other services and i cant shut any ports via the router.

can i use whalewall to restrict the incoming request of all the container to the reverse proxy and would doing this prevent this kind of bypass? im new to containerization and networking so sorry if its already stated elsewhere

one way that has worked before was to have the reverse proxy on a separate device and ip address but i cant do that anymore and i don't know how i can do that with docker

capnspacehook commented 7 months ago

Yes, you should be able to accomplish this by setting whalewall rules for the reverse proxy container and all containers behind the reverse proxy. You would only set mapped port rules and expose ports for the reverse proxy container and then all other containers wouldn't be able to be accessed directly.