problem
This problem has existed for a long time.
Disabling iptables in Docker will lead to other problems.
Rollback changes first
If you changed your server in accordance with the current solution that we find on the Internet, first roll back these changes, including:
- Enable Docker iptables function. Remove any changes, for example
--iptables=false , including the configuration file /etc/docker/daemon.json . - The UFW FORWARD rule defaults back to
DROP by default instead of ACCEPT . - Remove the rules for the Docker network in the UFW configuration file
/etc/ufw/after.rules . - If you changed the Docker configuration files, restart Docker first. We will change the UFW configuration later, and then we can restart it.
Troubleshooting UFW and Docker
This solution should change only one UFW configuration file, all configurations and Docker options remain by default. No need to disable the Docker iptables function.
Modify the UFW configuration file /etc/ufw/after.rules and add the following rules to the end of the file:
Use the sudo systemctl restart ufw to restart UFW after changing the file. Now the public network cannot access any published ports of the dock, the container and the private network can visit each other regularly, and the containers can also access the external network from the inside.
If you want to allow public networks access to services provided, for example, by the Docker container, the container service port is 80 . Run the following command to allow public networks access to this service:
ufw route allow proto tcp from any to any port 80
This command allows the public network to access all published ports whose container port is 80.
Note. If we publish a port using the -p 8080:80 option, we should use container port 80 , not host port 8080 .
If there are several containers with service port 80, but we want the external network to have access to a specific container. For example, if the container's private address is 172.17.0.2, use the following command:
ufw route allow proto tcp from any to 172.17.0.2 port 80
If the network protocol of the service is UDP, for example, the DNS service, you can use the following command to allow the external network access to all published DNS services:
ufw route allow proto udp from any to any port 53
Similarly, if only for a specific container, such as IP address 172.17.0.2:
ufw route allow proto udp from any to 172.17.0.2 port 53
How does it work?
The following rules allow private networks to visit each other. Private networks are generally more reliable than public networks.
-A DOCKER-USER -j RETURN -s 10.0.0.0/8 -A DOCKER-USER -j RETURN -s 172.16.0.0/12 -A DOCKER-USER -j RETURN -s 192.168.0.0/16
The following rules allow UFW to determine whether public networks are allowed to visit the services provided by the Docker container. So that we can manage all the firewall rules in one place.
-A DOCKER-USER -j ufw-user-forward
The following rules block connection requests initiated by all public networks, but allow internal networks access to external networks. For TCP, this prevents the active establishment of a TCP connection from public networks. For UDP, all access to ports less than 32767 is blocked. Why is this port? Since UDP is stateless, it is not possible to block an acknowledgment signal that initiates a connection request, as TCP does. For GNU / Linux, we can find the range of local ports in the file /proc/sys/net/ipv4/ip_local_port_range . The default range is 32768 60999 . When accessing the UDP protocol service from a running container, the local port will be randomly selected from the range of ports, and the server will return data to this random port. Therefore, we can assume that the UDP listening port in all containers is less than 32768. This is the reason that we do not want public networks to have access to UDP ports that are less than 32768.
-A DOCKER-USER -j DROP -p tcp -m tcp
More
https://github.com/chaifeng/ufw-docker
sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker chmod +x /usr/local/bin/ufw-docker
using
ufw-docker help ufw-docker install ufw-docker status ufw-docker allow webapp ufw-docker allow webapp 80 ufw-docker allow webapp 53/udp ufw-docker list webapp ufw-docker delete allow webapp 80/tcp ufw-docker delete allow webapp
Update: 2018-09-10
Reason for choosing ufw-user-forward rather than ufw-user-input
using ufw-user-input
Pro:
Easy to use and understand, supports older versions of Ubuntu.
For example, to allow the public to visit a published port whose container port is 8080 , use the command:
ufw allow 8080
Against:
It not only provides container ports, but also provides host ports.
For example, if the host is running a service and the port is 8080 . The ufw allow 8080 command allows a public network to visit the service and all published ports whose container ports are 8080 . But we just want to show a service running on a host, or just a service running inside containers, not both.
To avoid this problem, we may need to use a command similar to the following for all containers:
ufw allow proto tcp from any to 172.16.0.3 port 8080
using ufw-user-forward
Pro:
It is not possible to expose services running on hosts and containers at the same time with the same command.
For example, if we want to publish port 8080 containers, use the following command:
ufw route allow 8080
The public network can access all published ports whose containers have port 8080 .
But host port 8080 still unavailable to the public network. If we want to do this, run the following command to allow port sharing on the host separately:
ufw allow 8080
Against:
Does not support older versions of Ubuntu, and the command is a bit more complicated. But you can use my script https://github.com/chaifeng/ufw-docker .
Conclusion
If we use an older version of Ubuntu, we can use ufw-user-input . But be careful not to expose services that should not be exposed.
If we are using a newer version of Ubuntu that supports ufw route support ufw route , we better use ufw-user-forward and ufw route to manage container firewall rules.
Update: October 6, 2018
The ufw-docker script now supports Docker Swarm. Please see the latest code for more information, https://github.com/chaifeng/ufw-docker
Set to Docker Swarm mode
We can use this script only on the manager nodes to control the firewall rules when used in Swarm mode.
- Change all
after.rules files on all sites, including managers and employees - Deploying this script on manager nodes
Working in Docker Swarm mode, this script will add the global service ufw-docker-agent . The chaifeng / ufw-docker-agent image is also automatically created from this project.