Firewalling Micro-services Traffic

In this lesson, you will learn how to enforce granular security policies on traffic flowing between individual micro-services within a Linux host.

When deploying micro-services, the default "flat" network often allows any container to talk to any other container. Relying solely on the virtual switch or container orchestrator is insufficient; you must implement host-level filtering to enforce a "Zero Trust" architecture.

Because micro-services often scale dynamically, tracking them by static IP addresses is brittle. Instead, the most effective approach is to leverage Packet Tagging and Marking (Lesson 6) in conjunction with Advanced Filtering with Sets (Lesson 10).

Implementing Granular Control

To restrict traffic between a front-end container and a back-end database, you don't just rely on ports; you define granular rules based on the source and destination containers. If your containers are assigned specific interface names or metadata tags via the kernel, you can use nftables to isolate them:

# Define a set for your backend database IP range
table inet filter {
    set backend_services {
        type ipv4_addr;
        elements = { 172.17.0.5, 172.17.0.6 };
    }

    chain forward {
        type filter hook forward priority 0;
        
        # Only allow traffic to the backend from the specific front-end container
        ip saddr 172.17.0.2 ip daddr @backend_services tcp dport 5432 accept
        
        # Drop all other inter-container traffic by default
        drop
    }
}

By applying these rules at the forward hook, you capture traffic crossing bridge interfaces before it reaches the destination container. This ensures that even if one container is compromised, the attacker cannot pivot to services they aren't explicitly permitted to reach.

As you scale, you can maintain these rules efficiently by updating the elements in your nftables sets via a script or an API, ensuring that your firewall rules remain consistent with your current cluster state. This moves your security posture from "allow all" to an explicit, whitelist-only micro-segmentation model.

Key Takeaway: Use nftables sets and granular forward hooks to implement micro-segmentation, ensuring that inter-container communication is restricted to explicit, whitelist-approved paths.