How to protect VPS by UFW firewall properly?

Question

I set up a fresh VPS on DO and now I'm trying to protect my server using UFW firewall. But, I'm confused just a little bit.

So, my goal is to allow the only SSH, HTTP/HTTPS related ports. The rest should be closed. What I did to get it:

# ufw allow ssh
# ufw allow http
# ufw allow https

# ufw enable

$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)

As you can see, everything's fine here: all incoming traffic is denied except 22, 80, 443 ports as expected.

By the way, I use Docker for my PHP Laravel application. To start containers I use the command: "docker-compose up -d".

$ docker-compose ps
  Name                Command              State                 Ports
------------------------------------------------------------------------------------
app        docker-php-entrypoint php-fpm   Up      9000/tcp
database   docker-entrypoint.sh mysqld     Up      0.0.0.0:3307->3306/tcp, 33060/tcp
web        nginx -g daemon off;            Up      0.0.0.0:81->80/tcp

Couple of ports are available on host machine: 3307, 81.

To make sure that the firewall works properly I use nmap:

$ nmap -Pn [server ip]
Starting Nmap 7.70 ( https://nmap.org ) at 2018-09-13 12:17 EEST
Nmap scan report for [server host] ([server ip])
Host is up (0.054s latency).
Not shown: 995 filtered ports
PORT    STATE  SERVICE
22/tcp  open   ssh
25/tcp  closed smtp
80/tcp  open   http
81/tcp  open   hosts2-ns
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 5.59 seconds

Here I can't understand two things:

25/tcp  closed smtp

Why is this here?

81/tcp  open   hosts2-ns

Why is this port opened?

Probably I need to enter the web container and specify explicitly 127.0.0.1 ip address in nginx server section. As far as I know, mysql by default is opened for only localhost (my.conf), so as result we don't see mysql port in the list below. But anyway, why does UFW not block docker exposed ports?

Thank you in advance for everyone who can explain to me what it is so.

Answer 1

Probably ufw shows only the ufw configuration and any rules inserted directly in your firewall configuration (with iptables or another tool such as docker) without going through ufw are NOT displayed.

25/tcp  closed smtp

Why is this here?

A frequent reason is that many (consumer) ISP's and organisations block outgoing SMTP traffic.

81/tcp  open   hosts2-ns

Why is this port opened?

Not only is port 81 open, nmap stopped scanning at port 1024 but I expect that when you check further that port 3307 is also open.

It is opened by docker since your docker is instructed to publish ports 81 and 3307 and map them to your docker instances...

$ docker-compose ps
  Name                Command              State                 Ports
------------------------------------------------------------------------------------
app        docker-php-entrypoint php-fpm   Up      9000/tcp
database   docker-entrypoint.sh mysqld     Up      0.0.0.0:3307->3306/tcp, 33060/tcp
web        nginx -g daemon off;            Up      0.0.0.0:81->80/tcp

Inspect the actual active firewall configuration without the userfriendly ufw interface with for instance iptables-save or with iptables -L -v -n -t nat (most of the interesing docker stuff happens in the NAT & routing sections) and maybe iptables -L -v -n

Relevant entries wouls be something like:

# Generated by iptables-save v1.6.0 on Thu Sep 13 13:50:12 2018
*nat
:PREROUTING ACCEPT [21796:1434198]
:INPUT ACCEPT [9101:666864]
:OUTPUT ACCEPT [20943:1960461]
:POSTROUTING ACCEPT [118496:7063513]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER

-A DOCKER -i docker0 -j RETURN
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 3307 -j DNAT --to-destination 172.17.0.3:33060
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 81   -j DNAT --to-destination 172.17.0.8:80

---

What you probably need to do, if you don't want publish ports 81 and 3307 to the whole internet, is to change how you publish them in docker. https://docs.docker.com/config/containers/container-networking/