dockerdocker-network

Restrict Internet Access - Docker Container

I have a situation to restrict internet access of the container in load balancer network. for example in that below picture

easy for your reference

Only container4 connects to the Internet; other three only communicate through container4 with the outside world. For example if container1 needs smtp support, it will forward smtp request to container4 to get access.

No container other than container4 should be allowed to access the Internet directly! This should be enforced on Docker level.

I believe it will be configurable on docker network creation, can any one explain how to achieve this?

Solution

  • Network creation for access internet

    docker network create --subnet=172.19.0.0/16 internet

    Network creation for block internet access

    docker network create --internal --subnet 10.1.1.0/24 no-internet

    If you want to connect docker container into internet 

    docker network connect internet container-name

    If you want to block internet access

    docker network connect no-internet container-name

    Note

    in internal network we can't expose ports to connect outside world, please refer this question for more details