Good morning at all. I am running Ubuntu 14.04 server and Docker 1.8.1 and UFW is my front-end to manage iptables.

I need to run an application into a container. I do need the following behavior:

  • my app need to connect to another machine on port, to say, 8888/tcp.
  • I do not want that docker manages my iptables, hence i have set DOCKER_OPTS="--iptables=false" in /etc/default/docker. That done, docker should now skip to set ANY iptables rule.

Then, i have done the following in UFW in order to get docker containers connect to the outside world:

  • set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw
  • set net.ipv4.ip_forward=1 and net.ipv4.conf.all.forwarding=1 in /etc/sysctl.conf

I have also added the following lines to /etc/ufw/before.rules to enable NAT functionalities:

# nat Table rules

# Forward traffic from private network through eth0, the Internet iface on master.

# don't delete the 'COMMIT' line or these nat table rules won't be processed

where is the docker iface ip range.

After a reboot, i have ran sudo iptables -t nat -L -n, which gives me:

target     prot opt source               destination         
MASQUERADE  all  -- 

Then, since my DEFAULT_OUTPUT_POLICY is set to DROP, and i wanted to test whether the iptables=false option actually works, i have ran:

docker run -it ubuntu:14.04 bash
root@56997560933c:/# apt-get update

but..the container is able to download updates, even if the port 80/tcp and 53 are not open to the outside on the host machine..

I am know wondering...what i did wrong? what more i have to do in order to avoid that a docker container connects to the outside world using a port that i have not allowed in my iptables (using UFW) ?


Note for completeness: There are no traces of DOCKER in any chain in my iptables. Also, when downloading updates, if i run netstat , there are no ESTABLISHED connections outside ssh...this is even stranger...

reported from this question of another user, posted on stackoverflow. I think this is the right place.

  • So are you Alberto or do you just have exactly the same problem? :)
    – cxw
    Aug 31, 2015 at 9:53
  • No i'm not alberto.. but i had a similar problem that i have not solved yet and i am in general interested in docker networking :) I have also upvoted his question
    – Jhon Zunda
    Aug 31, 2015 at 10:01
  • Show the complete firewall. Aug 31, 2015 at 17:16


You must log in to answer this question.

Browse other questions tagged .