2

I have enabled ufw. The is ufw status verbose output

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere                  
22/tcp (v6)                ALLOW IN    Anywhere (v6)

But when I run nginx as docker run --name nginx -p 80:80 -d nginx I still can see nginx welcome page in the browser and nmap shows 80 port as open.

Improve this question

1 Answer 1

Reset to default
3

By default Docker manages its own firewall rules via calling iptables directly. It will allow a port in the firewall when you expose it in your container. These are not visible in ufw.

Improve this answer
5
  • What firewall would you recommend to use so that it works for all apps?
    – ogbofjnr
    Commented Sep 10, 2020 at 18:46
  • @ogbofjnr What do you mean? ufw seems to be just fine.
    – Michael Hampton
    Commented Sep 10, 2020 at 18:48
  • But all I have is docker containers, like rancher, and other workloads work in it. How do I control the opened ports then?
    – ogbofjnr
    Commented Sep 10, 2020 at 20:34
  • @ogbofjnr You could disable Docker's management of the firewall and allow ports in the firewall yourself, but then they would always be allowed, instead of only allowed when the relevant container is running.
    – Michael Hampton
    Commented Sep 10, 2020 at 20:37
  • Isn't ufw relying on iptables? Dont't the fw rules in ufw end up in iptables? For those using docker, they should use 'expose' instead of 'ports' when they do not want their ports to be reachable from outside/internet. [See difference between ports and expose][1] [1]: stackoverflow.com/questions/40801772/…
    – aks
    Commented Mar 22, 2022 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .