VM Firewall implicitly allow ports... Why?

General
1

Hi there,

I have a docker-compose with two ports :

    ports:
    - 20517:20517/udp
    - 20519:20519/udp

My firewall (UFW- configuration deny all incoming packet except SSH :

Status: active
Default: deny (incoming), allow (outgoing), deny (routed)

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere

Why the ports 20517 and 20519 are reachable from outside while the firewall do not allow them ? I don’t understand…

2

Docker automatically updates standard firewall rules to allow incoming connection when you specify a port to be opened.

This is mostly for convenience for standard users. If you use ports:, you usually want to open the ports.

3

Here are the docs: https://docs.docker.com/network/packet-filtering-firewalls/

You can generally deactivate that docker creates iptables rules for you by adding "iptables": false to /etc/docker/daemon.json (you need to create it and begin the file with a { and end it with }, if it doesn’t exist).

Though, if people want published ports only available from the local machine, they publish the ports with 127.0.0.1:20517:20517/udp, and don’t bother to disable docker’s iptables management at all.

1 Like
4

Thanks you so much for the explaination !