UFW rules don't work with docker

Question

I have a 12.04.4 server, and I have enabled ufw, and have tried to block port 8080. However, it is still open.

$ sudo ufw deny 8080
Rule added
Rule added (v6)

$ sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22                         ALLOW IN    Anywhere
[ 2] 80                         ALLOW IN    Anywhere
[ 3] 8080                       DENY IN     Anywhere
[ 4] 22                         ALLOW IN    Anywhere (v6)
[ 5] 80                         ALLOW IN    Anywhere (v6)
[ 6] 8080                       DENY IN     Anywhere (v6)

Thoughts? I can still access the website that is on 8080. I have rebooted the system several times. The IP address is handled via static assignment, but I can't find anything that would indicate that that is the problem.

The service I'm trying to block is on a docker instance, however this question did not help.

Do you want both protocols or does it matter? And do you have gufw installed? — Seth, Apr 24 '14 at 16:45
@Seth the system is ipv4 only, so I don't care about v6. And, no, I haven't. — jrg, Apr 24 '14 at 17:07
Try: sudo ufw delete deny 8080 and then sudo ufw deny proto tcp from any to port 8080. sudo ufw reload. If that doesn't work it's either a weird bug/qwerk or maybe the order of your rules confuses it. — Seth, Apr 24 '14 at 17:12

score 4 · Accepted Answer · edited Apr 26 '14 at 14:44

4

The docker template that I am using is for Discourse. I solved it by editing the containers/app.yml file to include this under the ''expose' section:

 - "127.0.0.1:20080:80"

This means that it routes port 20080 on 127.0.0.1 to port 80 on the docker instance, thus removing the need entirely for a ufw rule.

edited Apr 26 '14 at 14:44

Seth

58,122

answered Apr 26 '14 at 12:17

jrg

60,611

score 1 · Answer 2 · answered Apr 24 '14 at 16:57

1

I tested it.

When I enter the command: sudo ufw deny 80, I could connect to myself, But other host could not.

I suggest you try to connect from any other than you.

answered Apr 24 '14 at 16:57

xiaodongjie

2,824
1
18
37

Aha, I wondered if that could be it. – Seth Apr 24 '14 at 17:00
I'm ssh'ed into the server on the other side of the country, and I'm successfully accessing the system from my local web browser. – jrg Apr 24 '14 at 17:07

score 0 · Answer 3 · answered Jul 17 '21 at 19:38

0

The iptables docker rules are evaluated after the ufw ones. I wanted to restrict all IPs except one (of a VPN server) and I found the better solution in the docker documentation

answered Jul 17 '21 at 19:38

franciscorode

101

UFW rules don't work with docker

3 Answers3