# Internal network between containers without external network access **URL:** \ **Category:** General\ **Tags:** docker\ **Created:** [November 21, 2017, 5:29pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751 "2017-11-21T17:29:16Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![user10e32](https://avatars.discourse-cdn.com/v4/letter/u/5f9b8f/32.png) [@user10e32](https://forums.docker.com/u/user10e32)\ **Post date:** [November 21, 2017, 5:29pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/1 "2017-11-21T17:29:16Z")
How to create internal network between containers that does not connect to external web? **What I have done (without using compose):** I have read “[Docker container networking](https://docs.docker.com/engine/userguide/networking/)” documentation. Created “User-defined networks” “bridge network”. Then I created two containers that are using this network. I pinged both containers (25% lost?) and then I pinged [google.com](http://google.com) and the result was the same as before. **Why did I manage to ping [google.com](http://google.com) in “User-defined network”? How can I create network, where containers can communicate with each other, but not external web ([google.com](http://google.com)?). How can I do it with compose and without?** _What I am trying to do is: I want to allow communication to external web ([google.com](http://google.com)) only through another container. So I need to add both containers to internal network and one of them to network that ables to communicate to external world._ _Additional question: If someone has created such system before then, is it possible to access container that does not have external access localhost website?_ ---
**Author:** ![sdetweil](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@sdetweil](https://forums.docker.com/u/sdetweil)\ **Post date:** [November 21, 2017, 5:49pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/2 "2017-11-21T17:49:47Z")
I think this link describes info you are asking about… ipv4.forwarding=true > **[Understand container communication](https://docs.docker.com/engine/userguide/networking/default_network/container-communication/#communicating-to-the-outside-world)** > > The information in this section explains container communication within the Docker default bridge. This is a bridge network named bridge created automatically when you install Docker. Note: The Docker networks... ```auto Docker’s forward rules permit all external source IPs by default. To allow only a specific IP or network to access the containers, insert a negated rule at the top of the DOCKER filter chain. For example, to restrict external access such that only source IP 8.8.8.8 can access the containers, the following rule could be added: $ iptables -I DOCKER -i ext_if ! -s 8.8.8.8 -j DROP ``` ---
**Author:** ![user10e32](https://avatars.discourse-cdn.com/v4/letter/u/5f9b8f/32.png) [@user10e32](https://forums.docker.com/u/user10e32)\ **Post date:** [November 21, 2017, 6:19pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/3 "2017-11-21T18:19:34Z")
Thanks for your reply, but I only want to deny access to the outside world in containers that are connected to specific network. Example of general idea of compose file, where network1 is internal isolated network and network2 is access to external web : ``` version: "3" services: proxy: build: ./proxy networks: - network2 - network1 app: build: ./app networks: - network1 networks: network1: driver: custom-driver-1 network2: driver: custom-driver-2 ``` ---
**Author:** ![sdetweil](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@sdetweil](https://forums.docker.com/u/sdetweil)\ **Post date:** [November 21, 2017, 6:22pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/4 "2017-11-21T18:22:23Z")
iptables can also deny access given a network address (range) this is executed on the docker host… ---
**Author:** ![user10e32](https://avatars.discourse-cdn.com/v4/letter/u/5f9b8f/32.png) [@user10e32](https://forums.docker.com/u/user10e32)\ **Post date:** [November 21, 2017, 6:31pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/5 "2017-11-21T18:31:18Z")
I understood that it is executed on the docker host. But the problem is that my other containers would stop working when I would do something like that. How can I update Wordpress plugins that are located in other container that id using default bridge drive … I need that only for containers that are located in specific network can not access outside world. End result what I tray to achieve: proxy container contains mitmproxy installation and app contains application that I want to test. ---
**Author:** ![sdetweil](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@sdetweil](https://forums.docker.com/u/sdetweil)\ **Post date:** [November 21, 2017, 6:56pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/6 "2017-11-21T18:56:33Z")
All containers would have to be controlled to specific gateways if you want to have that work and then you’d use iptables on the host to set the routing. You can’t just let them default ---
**Author:** ![user10e32](https://avatars.discourse-cdn.com/v4/letter/u/5f9b8f/32.png) [@user10e32](https://forums.docker.com/u/user10e32)\ **Post date:** [November 21, 2017, 7:10pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/7 "2017-11-21T19:10:41Z")
Please specify, what do you mean by “You can’t just let them default”? (I want to take my system from virtualbox to docker) ---
**Author:** ![sdetweil](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@sdetweil](https://forums.docker.com/u/sdetweil)\ **Post date:** [November 21, 2017, 7:22pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/8 "2017-11-21T19:22:44Z")
If you want control of where there traffic goes then you have to control the Gateway that they connect to and you have to control the forwarding on the Gateway that they connect to ---
**Author:** ![dannchurch](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/dannchurch/32/18083_2.png) [@dannchurch](https://forums.docker.com/u/dannchurch)\ **Post date:** [November 27, 2017, 5:57pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/9 "2017-11-27T17:57:18Z")
To create a network that doesn’t allow access to communicating with external networks, use the ‘internal: true’ configuration on an Overlay network. Your config would thus be: ```auto version: "3" services: proxy: build: ./proxy networks: - network2 - network1 app: build: ./app networks: - network1 networks: network1: driver: overlay internal: true network2: driver: custom-driver-2 ``` Containers that are **only** on network1 won’t be able to communicate with the “outside” world. In your case, the app service won’t be able to access [google.com](http://google.com) but proxy will (since it’s also on a non-internal network). ---
**Author:** ![19wolf](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/19wolf/32/28972_2.png) [@19wolf](https://forums.docker.com/u/19wolf)\ **Post date:** [December 14, 2020, 6:21am UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/10 "2020-12-14T06:21:44Z")
Hi, I realize this topic is over 3 years old, but when using `internal: true`, could I replace ‘proxy’ with ‘vpn’ in the example given, and have ‘app’ connect to the internet via ‘vpn’?