Plesk Firewall do not block connections to Docker container? This is no longer a problem with Bobcares by your side.

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Service.

Let’s take a look at how our Support Team recently helped out a customer when Plesk Firewall do not block connections to Docker container.

How to resolve “Plesk Firewall do not block connections to Docker container”

According to our Support Engineers. Docker installs 2 custom iptables chains, namely, DOCKER-USER and DOCKER. These two chains are responsible for incoming packets.

Furthermore, Plesk does not have the authority to make any changes in these chains. Additionally, there is an internal request (ID PPPM-9222) to improve Plesk Firewall in future updates.

In order to resolve the error: deny rules set up in Plesk Firewall do not block connections to Docker container, our Support Techs have come up with a solution for now.

1. First, we have to connect to the server through SSH.
2. Then we will add the rule to the DOCKER-USER chain which is verified in FORWARD:
   • In order to prevent access from the public network without exceptions:

     # iptables -I DOCKER-USER -d 172.17.0.2 -p tcp --dport <DOCKER_CONTAINER_PORT> -j DROP

     Here, we will replace <DOCKER_CONTAINER_PORT> with the right container port number. For instance:

     # iptables -I DOCKER-USER -d 172.17.0.2 -p tcp --dport 6379 -j DROP
   • In order to deny access from the public network besides specific IP addresses:

     # iptables -I DOCKER-USER -d 172.17.0.2 -p tcp --dport <DOCKER_CONTAINER_PORT> -j DROP
     # iptables -I DOCKER-USER -d 172.17.0.2 -p tcp --dport <DOCKER_CONTAINER_PORT> -s <ALLOWED_IPS> -j ACCEPT

     We have to replace <DOCKER_CONTAINER_PORT> with the appropriate container port number and <ALLOWED_IPS> with the appropriate IP addresses.
3. After that, we have to remove the Firewall extension.
4. Finally, we have to save the iptable rules to the file system, depending on the OS.
   • CentOS/RHEL-based distribution:

     First, we will connect to the server via SSH and then run the following commands in order to save the firewall rules as well as load them on server startup:

     # service iptables save
     Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
     
     # service ip6tables save
     Saving firewall rules to /etc/sysconfig/ip6table[ OK ]
   • Debian/Ubuntu-based distributions:

     First, we will connect to the server via SSH and then install the iptables-persistent package in order to load firewall rules on server startup:

     # apt-get install iptables-persistent

     After that, we have to save the rules to the file system with this command:

     # netfilter-persistent save

[Looking for a solution to another query? We are just a click away.]

Conclusion

In essence, the skilled Support Engineers at Bobcares demonstrated what to do when Plesk Firewall does not block connections to container.