evilsocket / evilsocket/opensnitch

Intercept forwarded rule not working with docker and local network

Open
#1,079 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
When I enable the system rule "Intercept forwarded connections (docker, etc)" I can no longer access my Docker containers on the local network even when it is in the "disabled" status on the graphical interface.

**Include the following information:**
- OpenSnitch version: `1.6.4`
- OS: `Archlinux`
- Version: `6.6.9`
- Window Manager: `Kde`
- Kernel version: `Linux Desktop27 6.6.9-arch1-1`
- Docker version: `Docker version 24.0.7, build afdd53b4e3`

**To Reproduce**
- Run docker container like: `docker run --rm -it -p 80:80 strm/helloworld-http`

- From the OpenSnitch GUI, switch the status from "Running" to "**Disabled**" to ensure that the issue is not related to rules.

- Attempt to access your container from an external device on the same local network, for example, using http://192.168.1.18.
- Result: It works, and I can access the container.

- Enable the system rule "Intercept forwarded connections (docker, etc)."

- Try to connect again using http://192.168.1.18, and it's impossible to access the container.

I am using eBPF, and there are no errors in `/var/log/opensnitchd.log`.

My iptables:

```
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain DOCKER (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere 172.17.0.2 tcp dpt:http

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target prot opt source destination
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
RETURN all -- anywhere anywhere

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target prot opt source destination
DROP all -- anywhere anywhere
RETURN all -- anywhere anywhere

Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.