Why does UFW not block the ports that have been exposed using docker?
Solution 1:
It looks like
Docker tampers directly with IPTables
. It is possible to override this behavior by adding --iptables=false to to the Docker daemon.
Edit /etc/default/docker and uncomment the DOCKER_OPTS line:
DOCKER_OPTS="--dns 8.8.8.8 --dns 8.8.4.4 --iptables=false"
The author concluded the following:
- UFW doesn’t tell you iptables true state (not shocking, but still).
- Never use the -p option (or -P) in Docker for something you don’t want to be public.
- Only bind on either the loopback interface or an internal IP.