A rule allowing a port from a specific address, for a service that had been containerised and moved two years earlier. A rule allowing traffic to a closed…
Three jails enabled, two of them watching log files that moved when the services were containerised. A jail watching a file that does not exist reports zero failures,…
Docker writes its own iptables rules ahead of the chain UFW manages, so a published port is reachable from the internet regardless of what the firewall says. The…
Buster defaults to the nftables backend with an iptables compatibility shim, so iptables -L and nft list ruleset can show different things and both are telling the truth.…
A published container port is reachable from the internet regardless of what UFW says, because Docker inserts its rules ahead of the chain UFW manages. Binding to the…
Rules added with iptables directly are gone after a restart, which is how a database port ends up open on a machine that was firewalled last Tuesday. UFW…