Resolve the issues with UFW and Docker.

When utilizing Docker, you might encounter a situation where UFW (Uncomplicated Firewall) rules fail to influence the network traffic of Docker containers. This occurs because Docker, by default, directly modifies iptables rules, bypassing UFW's control.

How can we address this issue?

Let's take the scenario of opening UDP ports 22, 80, 443, and 8443 as an example:

1. Install and Enable UFW

Firstly, ensure that UFW is installed on your system and enabled:

bash
sudo apt update
sudo apt install ufw
sudo ufw enable

2. Open the Necessary Ports

Use the following commands to open ports for SSH (22), HTTP (80), and HTTPS (443):

bash
sudo ufw allow 22
sudo ufw allow 80
sudo ufw allow 443
sudo ufw allow 8443/udp

3. Install the ufw-docker Tool

ufw-docker is a utility designed to resolve conflicts between Docker and UFW firewall rules. Installation steps are as follows:

bash
sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
sudo chmod +x /usr/local/bin/ufw-docker

4. Configure ufw-docker

Execute the following command to install ufw-docker:

bash
sudo ufw-docker install

This command modifies UFW's configuration files to ensure compatibility with Docker's network rules.

5. Restart the Server

Due to possible unknown reasons, restarting UFW may not always ensure rule effectiveness; restarting the server resolves this issue.

bash
sudo reboot

6. Verify Configuration

Use the following command to check UFW's status and confirm that the required ports are open:

bash
sudo ufw status

The output should indicate that ports 22, 80, and 443 are allowed.

7. Delete Rules

Begin by listing all rule numbers using the following command:

bash
sudo ufw status numbered

Delete rules based on their corresponding numbers. For instance, to delete rules numbered 3 and 4:

bash
sudo ufw delete 3
sudo ufw delete 4

8. Reference

ufw-docker