在带有Docker和Libvirt规则的GNS3主机上配置iptables仅允许单IP访问的安全方案咨询

Great question—your concern about not breaking the existing Docker/Libvirt setup for GNS3 is totally valid. Changing default INPUT/FORWARD policies to DROP outright can easily disrupt the internal networking GNS3 relies on, so we need a more targeted approach that locks down external access while preserving existing functionality. Here's a step-by-step strategy:

Core Strategy #

Instead of flipping default policies to DROP outright, we'll take a targeted approach:

• Add explicit allow rules for your trusted IP at the top of the chains (so they take precedence)
• Ensure loopback and established connections work correctly
• Leave existing Docker/Libvirt chains intact to preserve GNS3 functionality
• Block all unallowed incoming traffic at the end of the chains

Step-by-Step Implementation #

First, define your trusted public IP (replace X.X.X.X with your actual IP):

TRUSTED_IP="X.X.X.X"

1. Secure the INPUT Chain (Host Access) #

These rules ensure only your trusted IP can reach the host, while preserving loopback and internal Libvirt traffic:

• Allow all traffic from your trusted IP (insert at the top of INPUT so it takes precedence):

  sudo iptables -I INPUT 1 -s $TRUSTED_IP -j ACCEPT
  

• Preserve loopback access (critical for internal host processes):

  sudo iptables -I INPUT 2 -i lo -j ACCEPT
  

• Allow established/related connections (so the host can respond to your trusted IP's requests):

  sudo iptables -I INPUT 3 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  

• Block all other incoming traffic (add this at the end of INPUT to catch anything not allowed above):

  sudo iptables -A INPUT -j DROP
  

2. Secure the FORWARD Chain (VM/Container Access) #

If you want your trusted IP to also reach GNS3 VMs or Docker containers, add these rules. If you only need access to the host itself, you can skip the first rule here:

• Allow forwarding from your trusted IP (insert at the top of FORWARD):

  sudo iptables -I FORWARD 1 -s $TRUSTED_IP -j ACCEPT
  

• Allow established/related forwarded connections:

  sudo iptables -I FORWARD 2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  

• Block all other forwarded traffic:

  sudo iptables -A FORWARD -j DROP
  

3. Verify and Persist Rules #

• Check that your rules are applied correctly:

  sudo iptables -L -v
  

  You should see your trusted IP rules at the top of INPUT/FORWARD, followed by the existing LIBVIRT/Docker chains, and the final DROP rule.
• Test that GNS3 VMs and Docker containers still work internally, and only your trusted IP can access the host from outside.
• Save rules to persist after reboot:
  On Debian/Ubuntu:

  sudo iptables-save > /etc/iptables/rules.v4
  

  On RHEL/CentOS:

  sudo service iptables save
  

Why This Works #

• By inserting our allow rules at the top, we ensure your trusted IP is always granted access before any other rules run.
• We don't modify the existing LIBVIRT/Docker chains, so GNS3 and Docker can still manage their own dynamic rules for internal networking.
• Adding a final DROP rule instead of changing the default policy avoids breaking existing established connections (like ongoing VM sessions) when applying the rules.

Notes #

• If GNS3 or Docker adds new rules dynamically later, they'll be inserted after our top-level allow rules, so your trusted IP access won't be affected.
• If you ever need to temporarily open access to another IP, just add a similar iptables -I INPUT 1 -s Y.Y.Y.Y -j ACCEPT rule.

备注：内容来源于stack exchange，提问作者itsamemarkus