Understanding Why Your Web App is Accessible on a Blocked Port in Linode

Discover the reasons why you can access your web app despite blocking a port in Linode and learn how to configure your firewall correctly with UFW and Docker.
---
This video is based on the question https://stackoverflow.com/q/66431617/ asked by the user 'Dan' ( https://stackoverflow.com/u/11943532/ ) and on the answer https://stackoverflow.com/a/66431704/ provided by the user 'larsks' ( https://stackoverflow.com/u/147356/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Why am I able to access my webapp publicly even when blocking the port in my Linode?

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/licensing
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/by-sa/4.0/ ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/by-sa/4.0/ ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Why Is My Web App Accessible on a Blocked Port in Linode?

Sometimes, systems do not behave as we expect them to, especially when it comes to network configurations and firewalls. Imagine you've been configuring your Linode server's firewall to block specific ports for security reasons, only to find that you're still able to access your web application publicly. This can be frustrating and alarming, but there are key reasons and solutions behind this behavior. Let’s delve into the problem and how to solve it.

The Problem

You've set up UFW (Uncomplicated Firewall) to block port 8080, yet you are still able to access your web application through this port. Here are the details of your UFW configuration:

[[See Video to Reveal this Text or Code Snippet]]

Upon applying these rules and reloading your firewall, you expect any connection attempts to port 8080 to be blocked. However, the web application running on this port is still accessible through the browser. What could be causing this discrepancy?

Understanding Docker and UFW

To grasp the situation, it's essential to understand how Docker interacts with firewall rules:

The Role of Docker

When you run a service in a Docker container, Docker automatically sets up its own iptables rules to facilitate communication between the host and the container. This means that even if you've blocked port 8080 with UFW, Docker could still create rules that allow access to the container through this port. Therefore, UFW might not be fully controlling this access.

Where the Issue Lies

Table Interaction: Access to ports opened via Docker is typically managed in the nat PREROUTING chain or the filter FORWARD table, instead of just the filter INPUT table where UFW focuses its controls.

DOCKER_USER Chain: The correct place to implement firewall rules that affect access to Docker containers is in the DOCKER_USER chain within the filter table, which is linked from the FORWARD chain. It is crucial to understand that when dealing with Docker, you'll need to reference the internal container port rather than the host port you have published.

The Solution

To prevent Docker from bypassing UFW rules and modifying iptables, follow these steps:

Edit Docker Configuration:

Open the Docker daemon configuration file located at /etc/docker/daemon.json.

Add the following configuration to disable Docker's automatic iptables manipulation:

[[See Video to Reveal this Text or Code Snippet]]

Save Changes: After making these changes, save the file.

Reload Docker: Apply the new configuration by restarting Docker. You can do this with:

[[See Video to Reveal this Text or Code Snippet]]

This adjustment stops Docker from changing your firewall's settings and ensures that UFW is the only entity managing access to your exposed ports.

Conclusion

In summary, the issue of accessing your web app via a blocked port while utilizing Docker and UFW comes down to how Docker interacts with firewall rules. By adjusting Docker's configuration to stop it from modifying iptables, you can regain control over your port access rules with UFW.

If you're managing firewall settings alongside containerized applications, it’s crucial to understand these interactions to ensure your web applications remain secure. Stay proactive with your server's security configurations and always verify your firewall settings after making changes.

Видео Understanding Why Your Web App is Accessible on a Blocked Port in Linode канала vlogize