Answers: <p>Rather than a proxy solution, I thought of a different approach, avant1 will act as the gateway to all containers in localnet &amp; testnet bridge networks. Either while creating the bridge networks you can specify a custom gateway as 172.18.0.2 &amp; 172.19.0.3 for localnet and testnet respectively or use ip route command to replace the default gateways in individual containers.</p>
  <p>In my case, added a FORWARD drop rule for domain yahoo.com in avant1.
  Entering into avant1 container interactively, did the following:</p>
  <pre><code>iptables --append FORWARD -d yahoo.com -j DROP
  </code></pre>
  <p>&amp; launching avant3 container interactively, executed</p>
  <pre><code>ip route replace default via 172.19.0.3 dev eth0
  </code></pre>
  <p>then,</p>
  <pre><code>curl yahoo.com -I
  </code></pre>
  <p>will not allow the traffic anymore in avant3 while allowing rest to passthrough</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-01-03T19:46:42.467Z
Answers: 2023-01-03T19:52:35.983Z
Answers: 2023-01-03T19:52:35.983Z
Answers: Nachi Nachiappan
Body: <p>We need to implement a proxy only by using iptables in a container and all traffic from other containers use this container to reach internet. Additionally in this proxy, drop trafffic to yahoo.com domain and allow the rest.</p>
  <p>I've a Oracle VM Box in windows that hosts a Ubuntu VM. In this VM, I've installed docker with 4 containers having Ubuntu image as shown here:</p>
  <p><a href="https://i.sstatic.net/I21kh.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/I21kh.jpg" alt="enter image description here" /></a></p>
  <p>Requirement is any traffic from avant3, avant4 or avant2 should use avant1 as proxy to reach internet. avant1 should only implement iptables rules to become a tcp proxy.</p>
  <p>In avant1 container in interactive mode, did the following as per <a href="http://www.tldp.org/HOWTO/TransparentProxy-6.html" rel="nofollow noreferrer">this  link</a>:</p>
  <pre><code>iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
  iptables --append FORWARD --in-interface eth1 -j ACCEPT
  </code></pre>
  <p>Going into avant3 and executing curl and specifying avant1 as proxy, getting this response:</p>
  <pre><code>root@340787f0b409:/# curl -x 172.19.0.3 &quot;www.google.com&quot; -I
  curl: (7) Failed to connect to 172.19.0.3 port 1080 after 0 ms: Connection refused
  root@340787f0b409:/# curl -x 172.19.0.3:80 &quot;www.google.com&quot; -I
  curl: (7) Failed to connect to 172.19.0.3 port 80 after 0 ms: Connection refused
  root@340787f0b409:/# 18.0
  </code></pre>
  <p>Can anybody guide me on the mistake I'm doing to achieve my requirement?</p>
  
Tags: <docker><api-gateway>
Title: proxy in a docker container implemented only with iptables - refuses connection
UserDisplayName: Nachi Nachiappan
ThreadText: # proxy in a docker container implemented only with iptables - refuses connection
  
  (Asked by: username_0 on 2022-12-30)
  
  We need to implement a proxy only by using iptables in a container and all traffic from other containers use this container to reach internet. Additionally in this proxy, drop trafffic to yahoo.com domain and allow the rest.
  
  I've a Oracle VM Box in windows that hosts a Ubuntu VM. In this VM, I've installed docker with 4 containers having Ubuntu image as shown here:
  
  [![enter image description here](https://i.sstatic.net/I21kh.jpg)](https://i.sstatic.net/I21kh.jpg)
  
  Requirement is any traffic from avant3, avant4 or avant2 should use avant1 as proxy to reach internet. avant1 should only implement iptables rules to become a tcp proxy.
  
  In avant1 container in interactive mode, did the following as per [this link](http://www.tldp.org/HOWTO/TransparentProxy-6.html):
  
  ```
  iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
  iptables --append FORWARD --in-interface eth1 -j ACCEPT
  
  ```
  
  Going into avant3 and executing curl and specifying avant1 as proxy, getting this response:
  
  ```
  root@340787f0b409:/# curl -x 172.19.0.3 "www.google.com" -I
  curl: (7) Failed to connect to 172.19.0.3 port 1080 after 0 ms: Connection refused
  root@340787f0b409:/# curl -x 172.19.0.3:80 "www.google.com" -I
  curl: (7) Failed to connect to 172.19.0.3 port 80 after 0 ms: Connection refused
  root@340787f0b409:/# 18.0
  
  ```
  
  Can anybody guide me on the mistake I'm doing to achieve my requirement?
  
  **Tags:** docker, api-gateway
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2023-01-03. Score: 1
  
  Rather than a proxy solution, I thought of a different approach, avant1 will act as the gateway to all containers in localnet & testnet bridge networks. Either while creating the bridge networks you can specify a custom gateway as 172.18.0.2 & 172.19.0.3 for localnet and testnet respectively or use ip route command to replace the default gateways in individual containers.
  
  In my case, added a FORWARD drop rule for domain yahoo.com in avant1.
  Entering into avant1 container interactively, did the following:
  
  ```
  iptables --append FORWARD -d yahoo.com -j DROP
  
  ```
  
  & launching avant3 container interactively, executed
  
  ```
  ip route replace default via 172.19.0.3 dev eth0
  
  ```
  
  then,
  
  ```
  curl yahoo.com -I
  
  ```
  
  will not allow the traffic anymore in avant3 while allowing rest to passthrough
  
  
  ---
  
  