I'm running Uptime Kuma in Docker with the host port mapped only to localhost: 127.0.0.1:3005 on the host forwarding to port 3001 in the container. I want the web panel to remain inaccessible from the public network and only reach it through an SSH tunnel. I tried `ssh -L 3005:127.0.0.1:3005 user@server -p -vv`, but it failed while my iptables policy was set to DROP. Loopback traffic and some other rules were already allowed. It seems Docker's NAT changes the destination from host port 3005 to container port 3001 before the packet reaches the relevant firewall rule. What iptables rule or SSH configuration is needed?
3 Answers
With a default-deny firewall, remember that Docker’s port forwarding can alter the packet before it reaches the rule you are expecting. In this case, traffic originally targeting host port 3005 is forwarded toward the container on port 3001, so an OUTPUT rule such as `iptables -A OUTPUT -o docker0 -p tcp --dport 3001 -j ACCEPT` allowed the connection to proceed. Make sure the rule is limited to the required interface and port, and verify the complete Docker and connection-tracking rules before relying on it.
Since the container is published as `127.0.0.1:3005->3001`, the SSH tunnel should connect to the host-side port: `ssh -L 3005:127.0.0.1:3005 user@server -p `. Then open `http://127.0.0.1:3005` in your local browser. The service does not need to be publicly exposed.
That was the intended setup. The tunnel worked once I accounted for the firewall rule matching the post-NAT traffic on the Docker interface.
The host binding is `127.0.0.1:3005`, not a public interface, so external clients cannot reach it directly. The SSH client connects to the server’s loopback address, and the server then forwards that connection through Docker to the container. Checking the container’s published-port output and the address it is bound to is a good way to confirm the setup.
Exactly—the important part was matching port 3001 on `docker0`, not only the original host port 3005. Disabling the DROP policy temporarily made the issue obvious.