It works with Docker swarm ?

[D0wn3r]

Do this works with docker swarm ?

I have a

level=WARN msg="blocked request" reason="forbidden IP" method=GET URL=/v1.24/version client=10.0.2.67:60802 response=403

When I try to use it with Traefik v3. I guess this is supposed to be allowed with the option -allowfrom=reverse-proxy in the command but with swarm is that works ?

(reverse-proxy in the name of my traefik service in the stack)

Thanks

[D0wn3r]

It works if I set ip (but I would like it dynamic) and if I allow all GET

services:
  dockerproxy:
    image: wollomatic/socket-proxy:1 # see https://github.com/wollomatic/socket-proxy for reference
    command:
      - '-loglevel=info' # set to debug for far more logging
      - '-allowfrom=10.0.2.67,10.0.2.68,10.0.2.62'
      - '-listenip=0.0.0.0'
      - '-allowGET=.*' # this regexp allows readonly access only for requests that traefik needs
      - '-shutdowngracetime=5'
      - '-watchdoginterval=600'
      - '-stoponwatchdog'

[wollomatic]

The above error message is caused by the -allowfrom configuration.

If the hostnames in Swarm are dynamically generated, it is difficult to set an allowlist for them. A possibility would be to allow a local network range, e.g., -allowfrom=10.0.2.0/24. Please keep in mind that this can easily result in insecure configurations (on the other hand, most of the other Socket-Proxy-Software allows access from any IP).

---

The -allowGET option depends on how you use Traefik:

If you use the docker provider (https://doc.traefik.io/traefik/providers/docker/), the '-allowGET=/v1\..{1,2}/(version|containers/.*|events.*)' is fine for socket-proxy.

You probably need another configuration for the allowlist if you use the swarm provider (https://doc.traefik.io/traefik/providers/swarm/): Maybe -allowGET=.* is fine in that case. You can enable the debug logging and see how the requests look. After that, you can create a more specific working regexp.

Also, see #30

(I'll convert this issue to a discussion)

[D0wn3r]

So -allowfrom doesn't support swarm service name ?
It would be very cool to have this support.
What -allowfrom try to match exactly ?
How it works behind the scene maybe we can find a way to make it work with swarm mode

[wollomatic]

-allowfrom supports any hostname that is resolvable via DNS. So, if you have a static hostname, it will work with Swarm. The only way it does not work is when hostnames are dynamically created.

Socket-proxy resolves the hostname given with -allowfrom from the configured DNS server and compares whether any of the resolved IP addresses matches the IP address of the requesting client.