Sign inSign up

antondlr/ufw

By antondlr

•Updated almost 4 years ago

manage iptables on your host from within a container

Image
0

460

antondlr/ufw repository overview

⁠UFW in a docker container

🚨 Use with caution: used improperly, you can easily lock yourself out of your box 🚨

⁠Why?

Because managing iptables should be left to the robots

⁠How?

This container has all the tools but needs elevated privs to do its thing

--net host
--cap-add SYS_ADMIN
--cap-add NET_ADMIN
⁠Rule persistence

The default ruleset is baked into the image at /etc/ufw-default
To persist these into a volume: docker run --rm -ti --name ufw -v /opt/volumes/ufw_rules:/etc/ufw --entrypoint bash antondlr/ufw:debian -c 'cp -r /etc/ufw-default/* /etc/ufw

⁠First run

First time you should run this first: docker run --rm -ti --net host --cap-add NET_ADMIN antondlr/ufw:debian enable

⁠fake-installing the ufw binary

echo "alias ufw='docker run --rm -ti --name ufw-cmd -v /opt/volumes/ufw_rules:/etc/ufw --net host --cap-add NET_ADMIN antondlr/ufw:debian" >> ~/.bash_profile
Or on CoreOS:
echo "alias ufw='docker run --rm -ti --name ufw-cmd -v /opt/volumes/ufw_rules:/etc/ufw --net host --cap-add NET_ADMIN antondlr/ufw:debian" > /etc/profile.d/aliases.sh

Alternatively, docker run --rm -ti --name ufw-cmd -v /opt/volumes/ufw_rules:/etc/ufw --net host --cap-add NET_ADMIN antondlr/ufw:debian allow ssh

⁠Load rules on boot

Install this systemd service:

[Unit]
Description=Uncomplicated Firewall, containerised
After=Docker.slice

[Service]
TimeoutStartSec=0
Type=oneshot
Restart=on-failure
ExecStartPre=-/usr/bin/docker kill ufw
ExecStartPre=-/usr/bin/docker rm ufw
ExecStart=/usr/bin/docker run --name ufw -m 256m \
  -v /opt/volumes/ufw_rules:/etc/ufw \
  --cap-add NET_ADMIN \
  --network host \
  antondlr/ufw:debian \
  enable
ExecStartPost=-/usr/bin/docker rm ufw

[Install]
WantedBy=multi-user.target
⁠Fix for dockerized hosts

We want to keep everything as "stock" as possible, so we tweak the canonical solution⁠ a bit
instead of using the ufw-user-forward chain, we use ufw-user-input

🚨make sure you have a rule to allow ssh and other important ingress services 🚨

Add this to the end of your /etc/ufw/after.rules file:
(when using the same paths as above, this would be /opt/volumes/ufw_rules/after.rules )

# BEGIN UFW AND DOCKER
*filter
:ufw-user-input - [0:0]
:ufw-docker-logging-deny - [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -j ufw-user-input

-A DOCKER-USER -j RETURN -s 10.0.0.0/8
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
-A DOCKER-USER -j RETURN -s 192.168.0.0/16

-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN

-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12

-A DOCKER-USER -j RETURN

-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
-A ufw-docker-logging-deny -j DROP

COMMIT
# END UFW AND DOCKER

Tag summary

Content type

Image

Digest

sha256:bafac03b8…

Size

40.7 MB

Last updated

almost 4 years ago

docker pull antondlr/ufw:debian-arm