What is the best practice of docker + ufw under Ubuntu
Solution 1
I've had such problem like months ago and lately decided to describe the issue along with the solution on my blog. Here's the shortcut.
Using --iptables=false
won't help you much with the case you described. It's simply not enough here. By default, none of your containers can do any outgoing connection.
There's a small step you're omitting on your way to have containers behind UFW here. You can use --iptables=false
or create /etc/docker/daemon.json
file with content as follows
{
"iptables": false
}
the result will be the same, but the latter option requires you to restart whole docker service with service docker restart
or even do a reboot if docker had a chance to add iptables rules before you disabled this function.
When it's done, just do two more things:
$ sed -i -e 's/DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/g' /etc/default/ufw
$ ufw reload
so you set up default forward policy in UFW for accept, and use:
$ iptables -t nat -A POSTROUTING ! -o docker0 -s 172.17.0.0/16 -j MASQUERADE
That way what you're achieving is disabling docker messy behavior in your iptables rules and at the same time docker is provided with necessary routing so containers will do outgoing connections just fine. UFW rules will be still restricted from this point on, though.
Hope this resolves the issue for you and any that gets here in search of an answer.
I described the problem and solution more comprehensively at https://www.mkubaczyk.com/2017/09/05/force-docker-not-bypass-ufw-rules-ubuntu-16-04/
Solution 2
Problem
This problem has been around for a long time.
Disable iptables in Docker will take other problems.
Rollback changes first
If you have modified your server according to the current solution that we find on the internet, please rollback these changes first, including:
- Enable Docker's iptables feature.
Remove all changes like
--iptables=false
, including configuration file/etc/docker/daemon.json
. - UFW's default FORWARD rule changes back to the default
DROP
instead ofACCEPT
. - Remove the rules related to the Docker network in the UFW configuration file
/etc/ufw/after.rules
. - If you have modified Docker configuration files, restart Docker first. We will modify the UFW configuration later, and we can restart it then.
Solving UFW and Docker issues
This solution needs to modify only one UFW configuration file, all Docker configurations and options remain the default. Doesn't need to disable the docker iptables function.
Modify the UFW configuration file /etc/ufw/after.rules
and add the following rules at the end of the file:
# BEGIN UFW AND DOCKER
*filter
:ufw-user-forward - [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -j RETURN -s 10.0.0.0/8
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
-A DOCKER-USER -j RETURN -s 192.168.0.0/16
-A DOCKER-USER -j ufw-user-forward
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 172.16.0.0/12
-A DOCKER-USER -j RETURN
COMMIT
# END UFW AND DOCKER
Using the command sudo systemctl restart ufw
to restart UFW after changing the file. Now the public network can't access any published docker ports, the container and the private network can visit each other regularly, and the containers can also access the external network from inside.
If you want to allow public networks to access the services provided by the Docker container, for example, the service port of a container is 80
. Run the following command to allow the public networks to access this service:
ufw route allow proto tcp from any to any port 80
This command allows the public network to access all published ports whose container port is 80.
Note: If we publish a port by using option -p 8080:80
, we should use the container port 80
, not the host port 8080
.
If there are multiple containers with a service port of 80, but we only want the external network to access a particular container. For example, if the private address of the container is 172.17.0.2, use the following command:
ufw route allow proto tcp from any to 172.17.0.2 port 80
If the network protocol of service is UDP, for example, a DNS service, you can use the following command to allow the external network to access all published DNS services:
ufw route allow proto udp from any to any port 53
Similarly, if only for a specific container, such as IP address 172.17.0.2:
ufw route allow proto udp from any to 172.17.0.2 port 53
How it works?
The following rules allow the private networks to be able to visit each other. Typically, private networks are more trusted than public networks.
-A DOCKER-USER -j RETURN -s 10.0.0.0/8
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
-A DOCKER-USER -j RETURN -s 192.168.0.0/16
The following rules allow UFW to manage whether the public networks are allowed to visit the services provided by the Docker container. So that we can manage all firewall rules in one place.
-A DOCKER-USER -j ufw-user-forward
The following rules block connection requests initiated by all public networks, but allow internal networks to access external networks. For TCP protocol, it prevents from actively establishing a TCP connection from public networks. For UDP protocol, all accesses to ports which is less then 32767 are blocked. Why is this port? Since the UDP protocol is stateless, it is not possible to block the handshake signal that initiates the connection request as TCP does. For GNU/Linux we can find the local port range in the file /proc/sys/net/ipv4/ip_local_port_range
. The default range is 32768 60999
. When accessing a UDP protocol service from a running container, the local port will be randomly selected one from the port range, and the server will return the data to this random port. Therefore, we can assume that the listening port of the UDP protocol inside all containers are less then 32768. This is the reason that we don't want public networks to access the UDP ports that less then 32768.
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 172.16.0.0/12
-A DOCKER-USER -j RETURN
More
https://github.com/chaifeng/ufw-docker
sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
chmod +x /usr/local/bin/ufw-docker
Usage
ufw-docker help
ufw-docker install
ufw-docker status
ufw-docker allow webapp
ufw-docker allow webapp 80
ufw-docker allow webapp 53/udp
ufw-docker list webapp
ufw-docker delete allow webapp 80/tcp
ufw-docker delete allow webapp
Update: 2018-09-10
The reason for choosing ufw-user-forward
, not ufw-user-input
using ufw-user-input
Pro:
Easy to use and understand, supports older versions of Ubuntu.
For example, to allow the public to visit a published port whose container port is 8080
, use the command:
ufw allow 8080
Con:
It not only exposes ports of containers but also exposes ports of the host.
For example, if a service is running on the host, and the port is 8080
. The command ufw allow 8080
allows the public network to visit the service and all published ports whose containers' port is 8080
. But we just want to expose the service running on the host, or just the service running inside containers, not the both.
To avoid this problem, we may need to use a command similar to the following for all containers:
ufw allow proto tcp from any to 172.16.0.3 port 8080
using ufw-user-forward
Pro:
Cannot expose services running on hosts and containers at the same time by the same command.
For example, if we want to publish the port 8080
of containers, use the following command:
ufw route allow 8080
The public network can access all published ports whose container ports are 8080
.
But the port 8080
of the host is still not be accessed by the public network. If we want to do so, execute the following command to allow the public access the port on the host separately:
ufw allow 8080
Con:
Doesn't support older versions of Ubuntu, and the command is a bit more complicated. But you can use my script https://github.com/chaifeng/ufw-docker.
Conclusion
If we are using an older version of Ubuntu, we can use ufw-user-input
chain. But be careful to avoid exposing services that should not be exposed.
If we are using a newer version of Ubuntu which is support ufw route
sub-command, we'd better use ufw-user-forward
chain, and use ufw route
command to manage firewall rules for containers.
Update: Oct 6, 2018
The script ufw-docker supports Docker Swarm now. Please see the latest code for more, https://github.com/chaifeng/ufw-docker
Install for Docker Swarm modeWe can only use this script on manager nodes to manage firewall rules when using in Swarm mode.
- Modifying all
after.rules
files on all nodes, including managers and workers - Deploying this script on manager nodes
Running in Docker Swarm mode, this script will add a global service ufw-docker-agent
. The image chaifeng/ufw-docker-agent is also automatically built from this project.
Solution 3
Not saying solutions here are wrong, but they look a bit "terrifying" and error-prune for someone looking for a quick one-step instruction. I came with this problem recently as well, have read all the similar answers online, and have not found anything quick & clear at the time of writing. Surprisingly, my alternative solution is easy to comprehend and manage, and it works: just implement your firewall outside your host machine.
- Digital Ocean has stunning Firewalls for zero extra cost, WYSIWYG style.
- AWS offers Security Groups
- etc.
Treating Firewall as first-class citizen seems to have a lot of benefits.
Solution 4
I spent two hours trying out the proposals above and from other posts. The only solution that worked was from Tsuna's post in this Github thread:
Append the following at the end of
/etc/ufw/after.rules
(replace eth0 with your external facing interface):# Put Docker behind UFW *filter :DOCKER-USER - [0:0] :ufw-user-input - [0:0] -A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A DOCKER-USER -m conntrack --ctstate INVALID -j DROP -A DOCKER-USER -i eth0 -j ufw-user-input -A DOCKER-USER -i eth0 -j DROP COMMIT
And undo any and all of:
- Remove "iptables": "false" from /etc/docker/daemon.json
- Revert to DEFAULT_FORWARD_POLICY="DROP" in /etc/default/ufw
- Remove any docker related changes to /etc/ufw/before.rules
- Be sure to test that everything comes up fine after a reboot. I still believe Docker's out of the box behavior is dangerous and many more people will continue to unintentionally expose internal services to the outside world due to Docker punching holes in otherwise safe iptables configs.
Solution 5
Disclaimer: This response applies to ufw (i.e. Ubuntu)
As default/standard Docker bridge network works on 172.17.0.0/16 (see docker inspect bridge
Subnet), the most straightforward IMHO is to do:
ufw allow from 172.17.0.0/16
Yi-Chien Chang
Updated on January 25, 2022Comments
-
Yi-Chien Chang over 2 years
I just tried out Docker. It is awesome but seems not work nicely with ufw. By default, docker will manipulate the iptables a little bit. The outcome is not a bug but not what I expected. For more details you can read The dangers of UFW + Docker
My goal is to set up a system like
Host (running ufw) -> docker container 1 - nginx (as a reverse proxy) -> docker container 2 - node web 1 -> docker container 3 - node web 2 -> .......
I want to manage the incoming traffic (e.g. restrict access) through ufw therefore I don't want docker to touch my iptables. Here is my test
Environment:
- a newly installed Ubuntu 14.04 (kernel: 3.13.0-53 )
- Docker 1.6.2
- ufw forwarding is enabled.( [Enable UFW forwarding] 2 )
-
--iptables=false
was added to the Docker daemon.
First Attempt
docker run --name ghost -v /home/xxxx/ghost_content:/var/lib/ghost -d ghost docker run --name nginx -p 80:80 -v /home/xxxx/nginx_site_enable:/etc/nginx/conf.d:ro --link ghost:ghost -d nginx
No luck. The first command is fine but the second command will throw an error
Error response from daemon: Cannot start container
Second Attempt
Then I found this: unable to link containers with --iptables=false #12701
After running the following command, everything looks OK.
sudo iptables -N DOCKER
However, I noticed that I can not establish any outbound connections inside containers. For example:
xxxxg@ubuntu:~$ sudo docker exec -t -i nginx /bin/bash root@b0d33f22d3f4:/# ping 74.125.21.147 PING 74.125.21.147 (74.125.21.147): 56 data bytes ^C--- 74.125.21.147 ping statistics --- 35 packets transmitted, 0 packets received, 100% packet loss root@b0d33f22d3f4:/#
If I remove
--iptables=false
from the Docker daemon, then the internet connection of containers will be back to normal but the ufw will not work 'properly' (well...by my definition).So, what is the best practice of docker + ufw? Can anyone provide some help?
-
funky-future about 6 yearsI added some info on how to setup the iptables rule from the actual Docker network config. This might be of interest for you.
-
Yi-Chien Chang over 5 yearsDon't have time to implement it yet. But it seems a more sophisticated solution. Thanks!!!
-
OverCoder over 5 yearsPerfect! Thought I had to replace
172.16.0.0
with172.17.0.0
-
Michael Härtl over 5 years@Feng Your solution looks interesting. There's another slightly simpler proposal here. I had no time yet to analyze the differences but maybe you can comment on that? One more thing: I think you could rename "internal port" to "host port". I was confused what "internal port" means. In the docker manual it's always either host or container port, which I find clearer.
-
Feng over 5 years@MichaelHärtl Thank you for your correction! My English is not good. The "internal port" means "container port" and the "external port" means "host port". I'll fix it soon. I took a quick look at the solution you mentioned. It's similar to mine. The main difference is that I use IP addresses, not ethernet cards.
-
Michael Härtl over 5 years@Feng Thanks. I've also seen that you use the
ufw-user-forward
chain while the other solution usesufw-user-input
. I guess that's why you needufw route ...
. I found thatufw route ...
is not supported in older versions. -
Feng over 5 years@MichaelHärtl Yes, you are right. I remembered ufw route added since Ubuntu 15.10. I don’t think using ufw-user-input is a good idea. But we can use this chain on older versions of Ubuntu. For latest version we should use ufw-user-forward.
-
Michael Härtl over 5 yearsWhy do you think
ufw-user-input
is a bad idea? Actually I even think that it's easier to understand. When I map ports from the container to the host, I would expect that I can use the usual host rules likeufw allow http
. I find the forward rule a bit harder to remember and also not as intuitive. If you could add some pro's and con's for each solution, that would be great. -
Feng over 5 years@MichaelHärtl I added the reason at the end of my answer. Please let me know if there is any unclear description. Thanks!
-
Birkhoff Lee over 5 yearswhat about docker + firewalld? do you have any directions on that? thanks
-
Feng over 5 years@BirkhoffLee Sorry, I haven't used firewalld yet.
-
Admin about 5 yearsYou are the real MVP
-
Iulian Pinzaru about 5 years@Feng works as expected. This solution is better than accepted one, since you don't have to play around with iptables. If you started using ufw, why should it be a way back to iptables solution? Thank you, it works like a charm and nothing more than adding some lines and restarting service. Good job.
-
Laurent about 5 yearsI reinstalled docker fresh and just added the rules at the end of after.rules, but still network to my libvirt guest isn't working
-
Feng about 5 years@Laurent What's the version of docker/ubuntu? Did you restart the ufw service or reboot your server? It doesn't work means what? Could you show me more details? Thanks!
-
Laurent about 5 yearsUbuntu 18.04 and I tried lastest docker: both the stock docker.io package and the one provided by docker's official repo. I rebooted many times and it just behaves like default: docker breaking the bridge network
-
Laurent about 5 yearsI submitted an issue on your github repo, will be easier to solve it there: github.com/chaifeng/ufw-docker/issues/11
-
Thomas Ebert about 4 yearsThis works fine! However, the nat iptables rule seems to be flushed on reboot. How can I persist it?
-
afboteros about 4 yearsTo persist the iptables rule install the linux package iptables-persistent according to your server distro, in my case (Debian) is sudo apt install iptables-persistent and the package installation will add the NAT rule to a persistent file which is executed on boot.
-
Thomas Ebert about 4 yearsThanks, @afboteros, should have known that... There's a reason I'm using uncomplicated firewall after all ;-)
-
La Muerte Peluda about 4 yearsJust a problem: my containers seem to not resolve DNS correctly now :/
-
thomas about 4 yearsI don't understand why this is not flagged as the best answer... I've lost an entire day with the first solution until I found this.
-
disfated almost 4 yearsYou just saved me!
-
Monkiki almost 4 yearsI've tried with Ubuntu 20.04 and latest Docker and this doesn't work. Running "docker run -it -p 8080:80 nginx" exposes the 8080 port.
-
Max Robbertze over 3 yearsSo the trick here is that the docker networks need to be allocated "by hand" ie not allow docker to do so. (Or else you need to figure what was allocated an expose that) Critically however, if binding to more that one network, you HAVE to specify the networks that acts as the default route "out" of the container" And this can not be pre-determined. There used to be a setting that allows for this, but it was removed from docker.
-
yeahman over 3 yearsthis seems to be the most simple solution; will try it. Was thinking about binding all my containers to 127.0.0.1:<port> and use nginx reverse proxy on host to expose the containers while being able to use UFW; do you think it is a legit solution also?
-
yeahman over 3 years@thomas the first solution seems to be working fine for me. It is much simpler and requires less work. that's why it is the selected solution
-
Dawid Stefaniak over 3 yearsYou SHOULD NOT use it as it removes totally DNS and I couldn't resolve any server. Please provide new/improved solution.
-
Kevin over 3 yearsThis is BROKEN. It causes the system to not resolve any server and I cant even ping anything on my lan. This is NOT a solution!
-
Gabriel Luca about 3 yearsThis dose not work ... some exploration would have been great .. just punting ..some directives is not enough for someone searching .. could be for a pro ..
-
Gabriel Luca about 3 years
sudo ufw reload
outputs ERROR: Could not load logging rules -
Juanra about 3 yearsHey @Feng, Your utility has been a lifesaver in my case, but I have a drawback ... how do you handle the containers when they are destroyed and created again with a new ip? In my case I have to manually rerun the ufw-docker allow command, but I wanted to ask you if you see any way to automate this. I tried a cron task but it failed to work for me.
-
Feng almost 3 years@Juanra Because we can create a different service with the previous same container name. We cannot guarantee they are the same service just by their names. So we’d better manually rerun the ufw-docker command.
-
zingi almost 3 yearsThe answer by @feng is better. That should be the accepted answer.
-
Lam Le over 2 yearsAlthough I agree with you, sometimes an extra layer is also good. And sometimes, we just have to deal with a bunch of bare-metal servers.
-
m50 over 2 yearsThak you very much!
-
Farzan over 2 yearsHere comes when we all realize that SO is unable to differentiate a great answer from several other lower-ranked answers. I really expect this answer to be on top of the list.
-
cjauvin over 2 yearsThank you that is a very thoughtful and helpful answer (I just went the DO firewall route, exactly as you suggested), and indeed the "terror factor" plays a role in a situation like that, where we already need to juggle with the complexity of 25 other aspects of the tech stack we're trying to bring up and running.
-
Sy Ker about 2 yearsWorked for me on a wireguard interface.
-
Vaclav Kusak about 2 yearsYour post is awesome! This is easy and WORKING solution! Thanks a million!
-
Kadarach about 2 yearsHoly cow, you're right. Linode offers this as well.
-
BPDESILVA about 2 yearsYeah, but you have to have custom images and expose different ports on each container
-
mipmip about 2 yearsTogether agree. Don't forget DEFAULT_FORWARD_POLICY="ACCEPT"
-
sjohnson.pi almost 2 yearsHere's a link to Linode's Firewall docs: linode.com/docs/guides/getting-started-with-cloud-firewall