search

chaifeng / ufw-docker

To fix the Docker and UFW security flaw without disabling iptables
GNU General Public License v3.0
4.55k stars 382 forks source link

after.rules not reloaded unless reboot #40

Open Mike-the-one opened 3 years ago

Mike-the-one commented 3 years ago

Happy new year!

First, thanks for the information. It works great in a swarm cluster.

But I have one small issue, how to completely disable firewall after these changes?

I tried ufw disable still not able to access container from public network.

Removed the new stuff added in /etc/ufw/after.rules, followed by a ufw reload and ufw disable did not work.

The only thing worked is to remove the new stuff in after.rules, and ufw disable and ufw disable then reboot.

Any quick way to turn off these rules without a reboot?

thanks

chaifeng commented 3 years ago

Hi, thank you.

The easiest way is to add a bypass rule manually.

sudo iptables -I DOCKER-USER 1 -j RETURN

this command will add a rule to bypass all following rules.

Using sudo iptables -n -L DOCKER-USER to list rules in the chain, we will find the bypass rule.

sudo iptables -D DOCKER-USER 1 to delete the first rule of this chain.