Configure UFW to manage Docker related connections - Revision history

Discorddigital at 15:10, 22 September 2021

2021-09-22T15:10:03Z

← Older revision		Revision as of 15:10, 22 September 2021
Line 1:		Line 1:
	==Prologue==		==Prologue==
	This guide applies to Ubuntu 20.04. After you installed docker and setup UFW to block all connections by default, docker will bypass the firewall entirely.		This guide applies to Ubuntu 20.04. After you installed docker and setup UFW to block all connections by default, docker will bypass the firewall entirely.

			To fix this issue follow this guide to configure Docker and UFW to properly work together.

	=== /etc/docker/daemon.json===		=== /etc/docker/daemon.json===

Discorddigital: Added information about network interface name.

2021-07-15T14:03:09Z

Added information about network interface name.

← Older revision		Revision as of 14:03, 15 July 2021
Line 12:		Line 12:
	=== /etc/ufw/after.rules===		=== /etc/ufw/after.rules===
	Then you need to edit following file as well: <code>/etc/ufw/after.rules</code>		Then you need to edit following file as well: <code>/etc/ufw/after.rules</code>
	Make sure to paste following lines '''before''' the last line in the file which is <code>COMMIT</code><syntaxhighlight lang="md">
			Make sure to paste following lines '''before''' the last line in the file which is <code>COMMIT</code>

			Also adjust <code>ens3</code> to your default interface name.<syntaxhighlight lang="md">
	# Put Docker behind UFW		# Put Docker behind UFW
	*filter		*filter

Discorddigital at 12:40, 15 July 2021

2021-07-15T12:40:59Z

← Older revision		Revision as of 12:40, 15 July 2021
Line 2:		Line 2:
	This guide applies to Ubuntu 20.04. After you installed docker and setup UFW to block all connections by default, docker will bypass the firewall entirely.		This guide applies to Ubuntu 20.04. After you installed docker and setup UFW to block all connections by default, docker will bypass the firewall entirely.

	~~You can fix this~~ by creating/editing following file: <code>/etc/docker/daemon.json</code><syntaxhighlight lang="json">		=== /etc/docker/daemon.json===

			Start by creating/editing following file: <code>/etc/docker/daemon.json</code><syntaxhighlight lang="json">
	{		{
	"iptables": false		"iptables": false
	}		}
	</syntaxhighlight~~>Once done, you need to edit following file as well: <code>/etc/ufw/after.rules</code~~>		</syntaxhighlight>

			=== /etc/ufw/after.rules===
			Then you need to edit following file as well: <code>/etc/ufw/after.rules</code>
	Make sure to paste following lines '''before''' the last line in the file which is <code>COMMIT</code><syntaxhighlight lang="md">		Make sure to paste following lines '''before''' the last line in the file which is <code>COMMIT</code><syntaxhighlight lang="md">
	# Put Docker behind UFW		# Put Docker behind UFW

Discorddigital: Created page with "==Prologue== This guide applies to Ubuntu 20.04. After you installed docker and setup UFW to block all connections by default, docker will bypass the firewall entirely. You c..."

2021-07-15T12:39:14Z

Created page with "==Prologue== This guide applies to Ubuntu 20.04. After you installed docker and setup UFW to block all connections by default, docker will bypass the firewall entirely. You c..."

New page

==Prologue==
This guide applies to Ubuntu 20.04. After you installed docker and setup UFW to block all connections by default, docker will bypass the firewall entirely.

You can fix this by creating/editing following file: <code>/etc/docker/daemon.json</code><syntaxhighlight lang="json">
{
"iptables": false
}
</syntaxhighlight>Once done, you need to edit following file as well: <code>/etc/ufw/after.rules</code>

Make sure to paste following lines '''before''' the last line in the file which is <code>COMMIT</code><syntaxhighlight lang="md">
# Put Docker behind UFW
*filter
:DOCKER-USER - [0:0]
:ufw-user-input - [0:0]

-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-USER -m conntrack --ctstate INVALID -j DROP
-A DOCKER-USER -i ens3 -j ufw-user-input
-A DOCKER-USER -i ens3 -j DROP
# End Docker UFW rules
</syntaxhighlight>Once you've done this, execute following commands to apply your changes:
{{warning}} This will restart all your docker containers.

<code>sudo systemctl restart ufw</code>

<code>sudo systemctl restart docker</code>

Test your configuration to make sure the changes are working.
[[Category:UFW]]
[[Category:Docker]]