> For the complete documentation index, see [llms.txt](https://til.devjugal.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://til.devjugal.com/docker/fix-ufw-security-flaw.md).

# Docker Fix UFW Security Flaw

It's been a while since I've started using Docker and while running containers with port binding such "8888:8888" may have made perfect sense to be accessible from anywhere, I was under this impression that UFW should take care of that, and not allow access to Docker Containers from outside unless I've created a rule to allow anyway. But, guess what? Sneaky Docker bypasses UFW just like that using iptables, and voila, end result is you can still access the container. To fix this, we can apply the following fix from [ufw-docker](https://github.com/chaifeng/ufw-docker#solving-ufw-and-docker-issues).

## Fix

Edit the `/etc/ufw/after.rules` file, and add the following content to it, followed by `sudo ufw reload` or `sudo systemctl restart ufw` command.

```
# BEGIN UFW AND DOCKER
*filter
:ufw-user-forward - [0:0]
:ufw-docker-logging-deny - [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -j ufw-user-forward

-A DOCKER-USER -j RETURN -s 10.0.0.0/8
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
-A DOCKER-USER -j RETURN -s 192.168.0.0/16

-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN

-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12

-A DOCKER-USER -j RETURN

-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
-A ufw-docker-logging-deny -j DROP

COMMIT
# END UFW AND DOCKER
```

***Source:*** [***ufw-docker***](https://github.com/chaifeng/ufw-docker)