Running multiple docker containers with UFW and "--iptables=false"

noomz · January 16, 2018, 11:31am

I’ve successfully block docker ingress network by reject all incoming packet to DOCKER-INGRESS using iptables -I DOCKER-INGRESS -i eth0 ! -s 127.0.0.1 -j REJECT (replace eth0 with your interface)

--iptables=false has no effect when net.ipv4.conf.all.forwarding=1

Docker has provided document here : https://docs.docker.com/engine/userguide/networking/default_network/container-communication/#communicating-to-the-outside-world

PS. Don’t forget to save your iptables settings.

waynish · October 16, 2019, 10:43am

Pretty surprising how few people are using iptables with docker… Just realized ufw is not working to deny what I set it up to deny 0_0

I’ve started using the iptables rules described here:

github.com

chaifeng/ufw-docker/blob/master/README.md#solving-ufw-and-docker-issues

To Fix The Docker and UFW Security Flaw Without Disabling Iptables
==================

- [English](#tldr)
- [中文](#太长不想读)

## TL;DR

Please take a look at [Solving UFW and Docker issues](#solving-ufw-and-docker-issues).

## Problem

UFW is a popular iptables front end on Ubuntu that makes it easy to manage firewall rules. But when Docker is installed, Docker bypass the UFW rules and the published ports can be accessed from outside.

The issue is:

1. UFW is enabled on a server that provides external services, and all incoming connections that are not allowed are blocked by default.
2. Run a Docker container on the server and use the `-p` option to publish ports for that container on all IP addresses. 
   For example: `docker run -d --name httpd -p 0.0.0.0:8080:80 httpd:alpine`, this command will run an httpd service and publish port 80 of the container to port 8080 of the server.
3. UFW will not block all external requests to visit port 8080. Even the command `ufw deny 8080` will not prevent external access to this port.

This file has been truncated. show original

And when I “ufw default deny” and then run nmap domain.com externally - I can see lots of ports are still “open.” So how does the docker community recommend this to be done?