16
IP Block Lists & Docker Networking (discuss.tchncs.de)
submitted 4 months ago by fine_sandy_bottom@discuss.tchncs.de to c/selfhosted@lemmy.world
6 comments fedilink hide all child comments

Just wondered if any one is using block lists for their docker containers.

IPSum publishes a great list of IPs worth blocking.

The thing is, I know docker networking interacts with iptables in a complex way such that the iptables INPUT chain is ignored.

The docker docs say you can put custom rules in DOCKER-USER chain, but my iptables knowledge isn't great and I think I'm more likely to mess something up than to have any success.

The thing is, I'm sure that this is something loads of other people have encountered, and I'm sure there must be an easier way.

top 6 comments
sorted by: hot top controversial new old
[-] riddlemeboner@lemdro.id 3 points 4 months ago

Is IPSum IPv4 only? So basically useless.

[-] fine_sandy_bottom@discuss.tchncs.de 2 points 4 months ago

ok. I hadn't thought about that.

Are there alternatives? Or is an IPv6 block list not practically possible?

[-] mhzawadi@lemmy.horwood.cloud 1 points 4 months ago

Some thing like this

iptables -I DOCKER-USER -m set --match-set ipsum src -j DROP

Should do what you need

[-] fine_sandy_bottom@discuss.tchncs.de 1 points 4 months ago

Thank you. I was looking at something like this.

I guess I was asking whether there's a package or project which kinda creates this rule and keeps the ipset list updated.

If I create a rule like that, then next time I'm playing around with this I'm not going to be able to figure out what I've done.

[-] mhzawadi@lemmy.horwood.cloud 2 points 4 months ago

I would have a cron that runs a script to pull the list and update IPset, this might not work.

make a file on your docker server with the below in it, set the file to execute chmod +x file.sh

#!/bin/sh
ipset -q flush ipsum
ipset -q create ipsum hash:ip
for ip in $(curl --compressed https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1); do ipset add ipsum $ip; done
iptables -D INPUT -m set --match-set ipsum src -j DROP 2>/dev/null
iptables -I INPUT -m set --match-set ipsum src -j DROP

Then add a cron file in /etc/cron.d that runs the script every 24 hours

10 3 * * * root /root/file.sh
[-] fine_sandy_bottom@discuss.tchncs.de 1 points 4 months ago

sweet. thanks.

INPUT will need to be DOCKER-USER in your script but otherwise I'll see how it goes.

this post was submitted on 23 Jun 2024
16 points (100.0% liked)

Selfhosted

40183 readers
525 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz