I have a webservice running inside a docker instance which was run using the following command:

sudo docker run -d -p 4040:4040 ....

My UFW rules look like this:

~ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
4040                       DENY        Anywhere
22                         ALLOW       Anywhere (v6)
4040                       DENY        Anywhere (v6)

When I access the box directly via its IP, I can access port 4040. Why is the ufw rule not blocking it?

Note: As part of the docker installation, I changed


in /etc/default/ufw as per dockers instructions here (http://docs.docker.io/en/latest/installation/ubuntulinux/#docker-and-ufw)

3 Answers 3


I had the same problem and resolved it by using IPTABLES instead.

Example to only allow 3306 from source ip xxx.xxx.xxx.xxx:

Adds an accept for source matching our ip to line 1 of the FORWARD chain

iptables -I FORWARD 1 -p tcp -i eth0 -s xxx.xxx.xxx.xxx --dport 3306 -j ACCEPT

Drops all other connections on the FORWARD chain for that port

iptables -I FORWARD 2 -p tcp -i eth0 --dport 3306 -j DROP

Using the line numbers (1 & 2) forces the rules to be added above the ones created by docker such as:

-A FORWARD -d ! -i docker0 -o docker0 -p tcp -m tcp --dport 3306 -j ACCEPT

  • Be ware: when restarting the container the newly created container will be prepended onto those IP table rules thus you have to re initialize those exact same iptable changes...
    – Gekkie
    Nov 3, 2014 at 15:21

There is a know issue related with this. Basically, docker is configuring Iptables behind UFW.

More information:

The short possible response:

Set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw
Set DOCKER_OPTS="--iptables=false" in /etc/default/docker

Try running the container with a specific IP.

docker run -d -p ...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .