$ docker network ls NETWORK ID NAME DRIVER SCOPE 3e8110efa04a bridge bridge local bb3cd79b9236 docker_gwbridge bridge local 22849c4d1c3a host host local 3kuba8yq3c27 ingress overlay swarm ecbd1c6c193a none null local要检查其属性，运行docker network inspect bridge
$ docker network inspect bridge
[
{
"Name": "bridge",
"Id": "3e8110efa04a1eb0923d863af719abf5eac871dbac4ae74f133894b8df4b9f5f",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.18.0.0/16",
"Gateway": "172.18.0.1"
}
]
},
"Internal": false,
"Containers": {},
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Labels": {}
}
]
$ ifconfig docker0
docker0 Link encap:Ethernet HWaddr 02:42:44:88:bd:75
inet addr:172.18.0.1 Bcast:0.0.0.0 Mask:255.255.0.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
$ ifconfig | grep 192.168.100. -B 1
br-e6bc7d6b75f3 Link encap:Ethernet HWaddr 02:42:bc:f1:91:09
inet addr:192.168.100.1 Bcast:0.0.0.0 Mask:255.255.255.0
$ brctl show docker0 bridge name bridge id STP enabled interfaces docker0 8000.02424488bd75 no
$ docker run -ti ubuntu:14.04 /bin/bash
root@6622112b507c:/#
root@6622112b507c:/# ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:ac:12:00:02
inet addr:172.18.0.2 Bcast:0.0.0.0 Mask:255.255.0.0
inet6 addr: fe80::42:acff:fe12:2/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:766 (766.0 B) TX bytes:508 (508.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
$ docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES a754719db594 ubuntu:14.04 "/bin/bash" 5 seconds ago Up 4 seconds zen_kalam 976041ec420f ubuntu:14.04 "/bin/bash" 7 seconds ago Up 5 seconds stupefied_easley您能马上看到现在[b]有两个接口连接到docker0网桥接口（每个容器一个）[/b]
$ sudo brctl show docker0
bridge name bridge id STP enabled interfaces
docker0 8000.02424488bd75 no veth2177159
vethd8e05dd
从其中一个容器[b]ping[/b]到google，然后从docker主机对容器的虚拟接口进行流量捕获，将显示容器流量
$ docker exec a754719db594 ping google.com PING google.com (216.58.217.110) 56(84) bytes of data. 64 bytes from iad23s42-in-f110.1e100.net (216.58.217.110): icmp_seq=1 ttl=48 time=0.849 ms 64 bytes from iad23s42-in-f110.1e100.net (216.58.217.110): icmp_seq=2 ttl=48 time=0.965 ms ubuntu@swarm02:~$ sudo tcpdump -i veth2177159 icmp tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on veth2177159, link-type EN10MB (Ethernet), capture size 262144 bytes 20:47:12.170815 IP 172.18.0.3 > iad23s42-in-f14.1e100.net: ICMP echo request, id 14, seq 55, length 64 20:47:12.171654 IP iad23s42-in-f14.1e100.net > 172.18.0.3: ICMP echo reply, id 14, seq 55, length 64 20:47:13.170821 IP 172.18.0.3 > iad23s42-in-f14.1e100.net: ICMP echo request, id 14, seq 56, length 64 20:47:13.171694 IP iad23s42-in-f14.1e100.net > 172.18.0.3: ICMP echo reply, id 14, seq 56, length 64
$ docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' a754719db594
172.18.0.3
$ docker exec 976041ec420f ping 172.18.0.3 PING 172.18.0.3 (172.18.0.3) 56(84) bytes of data. 64 bytes from 172.18.0.3: icmp_seq=1 ttl=64 time=0.070 ms 64 bytes from 172.18.0.3: icmp_seq=2 ttl=64 time=0.053 ms
$ sudo tcpdump -ni docker0 host 172.18.0.2 and host 172.18.0.3 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on docker0, link-type EN10MB (Ethernet), capture size 262144 bytes 20:55:37.990831 IP 172.18.0.2 > 172.18.0.3: ICMP echo request, id 14, seq 200, length 64 20:55:37.990865 IP 172.18.0.3 > 172.18.0.2: ICMP echo reply, id 14, seq 200, length 64 20:55:38.990828 IP 172.18.0.2 > 172.18.0.3: ICMP echo request, id 14, seq 201, length 64 20:55:38.990866 IP 172.18.0.3 > 172.18.0.2: ICMP echo reply, id 14, seq 201, length 64
MAGE COMMAND CREATED STATUS PORTS NAMES ccbf97c72bf5 ubuntu:14.04 "/bin/bash" 3 seconds ago Up 3 seconds admiring_torvalds 77d9f02d61f2 ubuntu:14.04 "/bin/bash" 4 seconds ago Up 4 seconds goofy_borg 19743c0ddf24 ubuntu:14.04 "/bin/sh" 8 minutes ago Up 8 minutes high_engelbart首先我运行如下命令来获得peer_ifindex 号
$ docker exec 77d9f02d61f2 sudo ethtool -S eth0 NIC statistics: peer_ifindex: 16
$ sudo ip link | grep 16 16: veth7bd3604@if15: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP mode DEFAULT group default
$ sudo iptables -t filter -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:domain ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:bootps ACCEPT udp -- anywhere anywhere udp dpt:bootps Chain FORWARD (policy ACCEPT) target prot opt source destination DOCKER-ISOLATION all -- anywhere anywhere DOCKER all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere DOCKER all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere DOCKER all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere DROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain DOCKER (3 references) target prot opt source destination Chain DOCKER-ISOLATION (1 references) target prot opt source destination DROP all -- anywhere anywhere DROP all -- anywhere anywhere DROP all -- anywhere anywhere DROP all -- anywhere anywhere DROP all -- anywhere anywhere DROP all -- anywhere anywhere RETURN all -- anywhere anywhere突出显示的是不同的链，以及每个链的默认策略（没有自定义链的默认策略）。 我们还可以看到Docker已经添加了两个自定义链：Docker和Docker-Isolation，并且在Forward链中插入了以这两个新链作为目标的规则。 [b]Docker-isolation chain[/b] Docker-isolation包含限制不同容器网络之间的访问的规则。 要查看更多详细信息，请在运行iptables时使用-v选项
$ sudo iptables -t filter -L -v …. Chain DOCKER-ISOLATION (1 references) pkts bytes target prot opt in out source destination 0 0 DROP all -- br-e6bc7d6b75f3 docker0 anywhere anywhere 0 0 DROP all -- docker0 br-e6bc7d6b75f3 anywhere anywhere 0 0 DROP all -- docker_gwbridge docker0 anywhere anywhere 0 0 DROP all -- docker0 docker_gwbridge anywhere anywhere 0 0 DROP all -- docker_gwbridge br-e6bc7d6b75f3 anywhere anywhere 0 0 DROP all -- br-e6bc7d6b75f3 docker_gwbridge anywhere anywhere 36991 3107K RETURN all -- any any anywhere anywhere您可以在上面看到一些删除规则，阻止任何由docker创建的桥接接口之间的流量，从而确保容器网络不能通信。 [b]icc=false[/b] 可以传递到docker network create命令的选项之一是com.docker.network.bridge.enable_icc，它代表容器间通信。 将此选项设置为false会阻止同一网络上的容器彼此通信。 这是通过在前向链中添加一个丢弃规则来实现的，该丢弃规则匹配来自与去往同一接口的网络相关联的桥接器接口的分组。 举个例子，我们用以下命令创建一个新的网络
docker network create --driver bridge --subnet 192.168.200.0/24 --ip-range 192.168.200.0/24 -o "com.docker.network.bridge.enable_icc"="false" no-icc-network
$ ifconfig | grep 192.168.200 -B 1
br-8e3f0d353353 Link encap:Ethernet HWaddr 02:42:c4:6b:f1:40
inet addr:192.168.200.1 Bcast:0.0.0.0 Mask:255.255.255.0
$ sudo iptables -t filter -S FORWARD
-P FORWARD ACCEPT
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o br-8e3f0d353353 -j DOCKER
-A FORWARD -o br-8e3f0d353353 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i br-8e3f0d353353 ! -o br-8e3f0d353353 -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-e6bc7d6b75f3 -j DOCKER
-A FORWARD -o br-e6bc7d6b75f3 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i br-e6bc7d6b75f3 ! -o br-e6bc7d6b75f3 -j ACCEPT
-A FORWARD -i br-e6bc7d6b75f3 -o br-e6bc7d6b75f3 -j ACCEPT
-A FORWARD -o docker_gwbridge -j DOCKER
-A FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT
-A FORWARD -o lxcbr0 -j ACCEPT
-A FORWARD -i lxcbr0 -j ACCEPT
-A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP
-A FORWARD -i br-8e3f0d353353 -o br-8e3f0d353353 -j DROP
$ sudo iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DOCKER all -- anywhere anywhere ADDRTYPE match dst-type LOCAL Chain INPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination DOCKER all -- anywhere !127.0.0.0/8 ADDRTYPE match dst-type LOCAL Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- 172.18.0.0/16 anywhere MASQUERADE all -- 192.168.100.0/24 anywhere MASQUERADE all -- 172.19.0.0/16 anywhere MASQUERADE all -- 10.0.3.0/24 !10.0.3.0/24 Chain DOCKER (2 references) target prot opt source destination RETURN all -- anywhere anywhere RETURN all -- anywhere anywhere RETURN all -- anywhere anywhere在postrouting链中，您可以看到在与自己网络外部的任何主机通信时，通过应用伪装操作创建的所有docker网络。 [b]总结[/b] 网桥网络在docker主机上具有对应的linux网桥接口，其作为layer2交换机，并且连接在同一子网上的不同容器。 容器中的每个网络接口在Docker主机上具有在容器运行时创建的对应虚拟接口。 桥接接口上来自Docker主机的流量捕获等效于在交换机上配置SPAN端口，可以在该网络上查看所有集群间通信。 在虚拟接口（veth- *）上来自docker主机的流量捕获将显示容器在特定子网上发送的所有流量 [b]Linux iptables[/b]规则用于阻止不同的网络（有时网络中的主机）使用过滤器表进行通信。 这些规则通常添加在DOCKER-ISOLATION链中。 容器通过桥接接口与外部通信，其IP被隐藏在docker主机的IP地址后面。 这是通过向iptables中的nat表添加规则来实现的。 [b]结束语[/b] 以上就是本文关于详解Docker使用Linux iptables 和 Interfaces管理容器网络的全部内容，希望对大家有所帮助。有兴趣的朋友可以参阅：[url=http://www.1sucai.cn/article/124408.htm]浅谈Docker安全机制内核安全与容器之间的网络安全[/url] 等以及本站其他专题。感谢大家对编程素材网的支持！
机械节能产品生产企业官网模板...
大气智能家居家具装修装饰类企业通用网站模板...
礼品公司网站模板
宽屏简约大气婚纱摄影影楼模板...
蓝白WAP手机综合医院类整站源码（独立后台）...苏ICP备2024110244号-2 苏公网安备32050702011978号 增值电信业务经营许可证编号：苏B2-20251499 | Copyright 2018 - 2025 源码网商城 (www.ymwmall.com) 版权所有