search

chaifeng / ufw-docker

To fix the Docker and UFW security flaw without disabling iptables
GNU General Public License v3.0
4.31k stars 369 forks source link

docker containers lost communication #123

Open matheus-neu opened 3 weeks ago

matheus-neu commented 3 weeks ago

this is my ufw-docker code

*filter :ufw-user-forward - [0:0] :ufw-docker-logging-deny - [0:0] :DOCKER-USER - [0:0] -A DOCKER-USER -j ufw-user-forward

-A DOCKER-USER -j RETURN -s 172.17.0.0/16 -A DOCKER-USER -j RETURN -s 192.168.0.0/24

-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN

-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/24 -A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.17.0.0/16 -A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/24 -A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.17.0.0/16

-A DOCKER-USER -j RETURN

-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] " -A ufw-docker-logging-deny -j DROP

COMMIT

when i enable the ufw, all the containers lost communication, deluge doesn't communicate with sonarr, everything in dashy turns off, what can i do?

image

matheus-neu commented 3 weeks ago

when i put these rules on ufw

ufw allow in on docker0 ufw allow out on docker0

the containers can communicate, but it's secure?