IPTables, Docker & Password Pusher

[Threepwood77]

Hello everyone,
I have a problem with my deployment.
the docker works, I use a nginx reverse proxy, everything works, it's perfect.
however, i'd like to secure access to the host machine with iptables (debian).
I've tried opening ports 5100 for localhost access, and ports 80 and 443 for public Internet access, but there's nothing I can do when access generates a timeout:

504 Gateway Time-out
nginx/1.18.0

when I disable all iptables rules, no problem, it works.
any idea of the rules that might be needed for this to work ?
thanks for your help.

[pglombardo]

Hi @Threepwood77 - Could you post the IPTables ruleset that you tried to apply? And also the nginx config. With that either I or someone from the community could try to recreate the issue and hopefully devise a fix.

[Threepwood77]

Hello,
yes of course, I should have done it from the start ^^
here is my nginx conf:

server {
server_name exemple.com;
listen 443 ssl;
ssl_certificate /SSL/exemple.com.crt;
ssl_certificate_key /SSL/exemple.com.key;
location / {
proxy_pass http://localhost:5100;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

my iptables rules (with many tests for docker ...) :

iptables -t filter -F
iptables -t filter -X
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -t filter -A INPUT -p icmp -j DROP
iptables -t filter -A OUTPUT -p icmp -j DROP

iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT

Docker

iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i lo -p tcp --dport 5100 -j ACCEPT
iptables -A OUTPUT -o lo -p tcp --dport 5100 -j ACCEPT
iptables -A INPUT -i lo -p tcp --dport 9000 -j ACCEPT
iptables -A OUTPUT -o lo -p tcp --dport 9000 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A FORWARD -i lo -o pwpush_default -j ACCEPT
iptables -A FORWARD -i pwpush_default -o lo -j ACCEPT

thank you !