Docker Community Forums

Share and learn in the Docker community.

Blocking traffic to local network

I have a server that I want to host services on for both the internet and for the local network. I want to block traffic from containers to my local network, so that if an a service that is on the internet gets compromised, then the attackers don’t have access to my local network.

sudo iptables -I DOCKER-ISOLATION-STAGE-2 -d -j DROP
sudo iptables -I DOCKER-ISOLATION-STAGE-2 -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT is my local network

This seems to be working for me, but I want to know if I was missing something?
Is there are more straightforward way to solve this problem?
DOCKER-ISOLATION-STAGE-2 seems un-documented, should I be using this or something else?
Are there any other concerns that I should have?

– Thanks