UFW and Docker issue

mendozal

Hi everyone

I don't know if what I'm about to say is really a thing, or it's just me not understanding how it works.

I was reviewing logs and found an IP trying to do some nasty stuff on a website, so I decided to block it permanently. I did it using UFW but didn't seem to work, and after some research I found that apparently UFW doesn't work well with docker containers, as in it can't block connections to containers.

Apparently, there are many solutions to this, but all of them are very low level and I'm afraid of doing something that breaks the CP

This is one of them: https://github.com/chaifeng/ufw-docker

Is this something you also face? Or is it something known that just has to be dealt with?

I ended up using Cloudflare to block the IP using bot protection mode.

Adam

There is a blanket allow in the default config for ports forwarded to docker containers which explains the behaviour you're seeing.

https://github.com/chaifeng/ufw-docker this solution is sensible however I can't guarantee that it won't interfere with future appcd updates so I wouldn't recommend applying it at this time.

You could consider blocking the bot in .htaccess instead.

When we release the Enhance firewall management tool there will be a proper tool for adding rules in a structured way which won't interfere with docker, appcd or the php containers.

gavin

Adam Just wanted to know this firewall management tool will add rules via UFW or nftables or iptables?