Aus zwei Gründen: Ich kann das Forum dann jederzeit starten oder stoppen, oder auf eine andere Maschine umziehen. Alle benötigten Dateien liegen in einem lokalen Verzeichnis, der Rest bleibt unberührt.Bagbag schrieb:
Ich verstehe nicht, wie du das meinst. Der traefik braucht Port 443 für https und 80 u. a. für die Certs. Traefik kann nicht zu Ports weiterleiten von Anwendungen, die direkt auf dem Host laufen.Bagbag schrieb:
extra_hosts:
- "host.docker.internal:host-gateway" volumes:
- "./proxy-conf/:/proxy-conf/" command:
- "--providers.file.directory=/proxy-conf"proxy-conf/dynamic_conf.yml erstellen:http:
routers:
to-forum:
rule: Host(`f.irgendetwas.com`)
entrypoints: websecure
tls:
certresolver: myresolver
service: forum
services:
forum:
loadbalancer:
servers:
- url: http://host.docker.internal:portHier/sudo ufw allow in 30899 hinzufüge, dann funktioniert es. Die Schattenseite ist aber, dass dann auch http://ip:30899 direkt aufgerufen werden kann, also Docker sozusagen umgangen werden kann.
docker inspect bridge "Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},Bagbag schrieb:
/8? Ich probiere das mal gerade.
sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip
To Action From
-- ------ ----
...
30899 ALLOW IN 172.0.0.0/8
...sudo ufw allow from 172.0.0.0/8 to any port 30899 funktioniert einwandfrei.
). Der Grund ist, dass Docker nicht zusammen mit ufw/iptables funktioniert: https://stackoverflow.com/questions/30383845/what-is-the-best-practice-of-docker-ufw-under-ubuntu , weil Docker iptables umgeht.127.0.0.1:port1:port2 zu exposen.
Aber nicht bei einem Dedicated + "Software"firewall.Bagbag schrieb:
Falls ich mich selber aussperre, bestünde nur noch die Möglichkeit, das Ding neu zu starten und alles neu zu installieren.
/etc/nftables.conf:flush ruleset
table inet firewall {
chain inbound_ipv4 {
# accepting ping (icmp-echo-request) for diagnostic purposes.
# However, it also lets probes discover this host is alive.
# This sample accepts them within a certain rate limit:
#
icmp type echo-request limit rate 5/second accept
}
chain inbound_ipv6 {
# accept neighbour discovery otherwise connectivity breaks
#
icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
# accepting ping (icmpv6-echo-request) for diagnostic purposes.
# However, it also lets probes discover this host is alive.
# This sample accepts them within a certain rate limit:
#
# icmpv6 type echo-request limit rate 5/second accept
}
chain inbound {
# By default, drop all traffic unless it meets a filter
# criteria specified by the rules that follow below.
type filter hook input priority 0; policy drop;
# Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop }
# Allow loopback traffic.
iifname lo accept
# Allow on ports ... for IPv4 and IPv6.
tcp dport { 123, 234, usw. } accept
ip saddr 172.17.0.0/16 accept
ip saddr 172.18.0.0/16 accept
# Uncomment to enable logging of denied inbound traffic
log prefix "[nftables] Inbound Denied: " counter drop
}
chain forward {
# Drop everything (assumes this device is not a router)
type filter hook forward priority 0; policy drop;
}
# no need to define output chain, default policy is accept if undefined.
}nft -f /etc/nftables.conf aufrufe, NACHDEM Docker gestartet wurde.nft list ruleset sehen:# hier das, was oben steht...
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
chain DOCKER {
## gekürzt
}
chain POSTROUTING {
## gekürzt
}
chain PREROUTING {
## gekürzt
}
chain OUTPUT {
## gekürzt
}
}
# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
chain DOCKER {
## gekürzt
}
chain DOCKER-ISOLATION-STAGE-1 {
## gekürzt
}
chain DOCKER-ISOLATION-STAGE-2 {
## gekürzt
}
chain FORWARD {
## gekürzt
}
chain DOCKER-USER {
## gekürzt
}
}
table ip6 nat {
chain DOCKER {
}
}
table ip6 filter {
chain DOCKER {
}
chain DOCKER-ISOLATION-STAGE-1 {
## gekürzt
}
chain DOCKER-ISOLATION-STAGE-2 {
## gekürzt
}
chain FORWARD {
## gekürzt
}
chain DOCKER-USER {
## gekürzt
}
}block_port_for_www() {
if [[ $# -ne 1 ]]; then
echo "Illegal number of parameters" >&2
exit 2
fi
APP_PORT=$1
iptables -A INPUT -i lo -p tcp --dport "$APP_PORT" -j ACCEPT
iptables -A INPUT -p tcp --dport "$APP_PORT" -j DROP
}flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy accept;
# Allow incoming ping
# but still honor limit and drop the excess
# It could have been rewritten using anonymous chains
# but I kept it simple.
# It has to be done as an exception to the stateful rule
# so before it.
icmp type echo-request limit rate 15/second accept
icmp type echo-request drop
icmpv6 type echo-request limit rate 15/second accept
icmpv6 type echo-request drop
# firewall becomes stateful from here:
# bulk of the traffic will be handled by this single rule
ct state established,related accept
# Allow connections from localhost
iif "lo" accept
# Allow connections on port 30899 (Discourse) from localhost
# tcp dport 30899 iif "lo" accept # already allowed by rule above
# Allow connections from Docker containers
ip saddr 172.18.0.0/16 accept
# Allow specific ports from remote hosts via TCP
tcp dport { ...ssh usw... } accept
# Allow specific ports from remote hosts via UDP
# udp dport { ... } accept
# minimal ICMPv6 support for an end-node system
# non-LAN ICMPv6 (as well as IPv4 ICMP) packets used to report
# errors are handled by the generic stateful rule.
icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
# Drop all other incoming traffic
drop
}
}tcp dport { ...ssh usw... } accept anpassen. 
