# Internal network between containers without external network access

**URL:** <https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751>\
**Category:** General\
**Tags:** docker\
**Created:** [November 21, 2017, 5:29pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751 "2017-11-21T17:29:16Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![dannchurch](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/dannchurch/32/18083_2.png) [@dannchurch](https://forums.docker.com/u/dannchurch)\
**Post date:** [November 27, 2017, 5:57pm UTC](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751/9 "2017-11-27T17:57:18Z")

</div>

To create a network that doesn’t allow access to communicating with external networks, use the ‘internal: true’ configuration on an Overlay network. Your config would thus be:

```auto
version: "3"
services:

  proxy:
    build: ./proxy
    networks:
      - network2
      - network1

  app:
    build: ./app
    networks:
      - network1

networks:
  network1:
    driver: overlay
    internal: true
  network2:
    driver: custom-driver-2

```

Containers that are **only** on network1 won’t be able to communicate with the “outside” world. In your case, the app service won’t be able to access [google.com](http://google.com) but proxy will (since it’s also on a non-internal network).

---

_[View the full topic](https://forums.docker.com/t/internal-network-between-containers-without-external-network-access/41751)._