Firewall example for a host that acts as a router and hosts both public and private services on docker

firewall.sh

set -e
WAN_IF=br0.2
LAN_IF=br0
WAN_IP=$(ip -4 -o addr show dev $WAN_IF | awk '{print $4}' | cut -d/ -f1)
echo "WAN IP: $WAN_IP"
# Block incoming connection on WAN except port 22
iptables -F INPUT
iptables -A INPUT -i $WAN_IF -p tcp --dport 22 -j ACCEPT
# Allow 80 and 443 (currently via docker)
#iptables -A INPUT -i $WAN_IF -p tcp --dport 80 -j ACCEPT
#iptables -A INPUT -i $WAN_IF -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i $WAN_IF -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $WAN_IF -p tcp -j DROP
# Same for docker
iptables -F DOCKER-USER
# ALlow routing to LAN IF
iptables -A DOCKER-USER -i $WAN_IF -o $LAN_IF -j ACCEPT
# Block everything except port 80 and 443
iptables -A DOCKER-USER -p tcp -m conntrack --ctorigdst $WAN_IP --ctorigdstport 80 -j ACCEPT
iptables -A DOCKER-USER -p tcp -m conntrack --ctorigdst $WAN_IP --ctorigdstport 443 -j ACCEPT
iptables -A DOCKER-USER -p tcp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A DOCKER-USER -p tcp -m conntrack --ctorigdst $WAN_IP -j DROP
iptables -A DOCKER-USER -j RETURN