ufw환경에서 docker사용시 iptables와 충돌되는 문제 해결방법

docker에서 오픈된 포트를 ufw를 방화벽으로 관리가 되지 않았다. 원인은 docker는 iptables로 직접 관리 하기떄문이다.

해결방법: ufw-docker설치하여 사용하면 된다.

ufw-docker설치

sudo wget -O /usr/local/bin/ufw-docker \
  https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker

chmod +x /usr/local/bin/ufw-docker

ufw방화벽에 docker rule설치

ufw-docker install

ufw 방화벽 재시동

ufw reload

상기와 같이 실행하면 docker에서 오픈된 포트를 외부에서 방문되지 않게 된다. 만약 외부에서 방문하게 하려면

ufw-docker allow [docker id혹은 name] [포트]

오픈된 포트 rule삭제시

ufw-docker delete allow  [docker id혹은 name] [포트]

ufw-docker 주요명령:

Usage:
  ufw-docker <list|allow> [docker-instance-id-or-name [port[/tcp|/udp]] [network]]
  ufw-docker delete allow [docker-instance-id-or-name [port[/tcp|/udp]] [network]]

  ufw-docker service allow <swarm-service-id-or-name <port</tcp|/udp>>>
  ufw-docker service delete allow <swarm-service-id-or-name>

  ufw-docker <install|check> [--docker-subnets [SUBNET0 SUBNET1 ...]] [--system]
  ufw-docker install-service [--force]

  ufw-docker <status|install|install-service|uninstall|check|reload|man[page]|help>

Examples:
  ufw-docker help
  ufw-docker man
  ufw-docker check --help
  ufw-docker install --help

  ufw-docker check                         # Check the installation of firewall rules
  ufw-docker check --docker-subnets        # Auto-detect and use all Docker network subnets
  ufw-docker check --docker-subnets 192.168.207.0/24 10.207.0.0/16 fd00:cf::/64

  ufw-docker install --system             # Install firewall rules and man-page
  ufw-docker install --docker-subnets     # Auto-detect and use all Docker network subnets
  ufw-docker install --docker-subnets 192.168.207.0/24 10.207.0.0/16 fd00:cf::/64
  ufw-docker install --docker-subnets 192.168.207.0/24 10.207.0.0/16 fd00:cf::/64

  ufw-docker install-service              # Install the ufw-docker service
  ufw-docker install-service --force      # Install the ufw-docker service, overwriting the existing service file

  ufw-docker status

  ufw-docker list httpd

  ufw-docker allow httpd
  ufw-docker allow httpd 80
  ufw-docker allow httpd 80/tcp
  ufw-docker allow httpd 80/tcp default

  ufw-docker delete allow httpd
  ufw-docker delete allow httpd 80/tcp
  ufw-docker delete allow httpd 80/tcp default

  ufw-docker service allow httpd 80/tcp

  ufw-docker service delete allow httpd

  ufw-docker reload                       # Reload all firewall rules

참조:https://github.com/chaifeng/ufw-docker