How to close Docker ports reddit / selfhosted ---------------------------------------------------------------------- Triliandstir · 2023-10-03 16:00 Hi, I have installed docker with several applications and now I am stuck in mess. For example, Vaultwarden is exposed on port 8080. I have created a Nginx proxy manager https rewrite. Now, I could close 8080 port outside of the host, but, VW is required to send email to my internal smpt server. How can I solve such problems? At first I thought I would just enable UFW and enable only SSH and HTTPS ports, that way all internal docker stuff would work, but then I read that this may not be the best idea. How to fix such problems? ---------------------------------------------------------------------- Senior_Seaweed2860 · 2023-10-03 16:10 I use this without problems for Long time, https://github.com/chaifeng/ufw-docker ---------------------------------------------------------------------- hollowman8904 · 2023-10-03 16:21 What does VW sending email have to do with closing port 8080? Typically you would put nginx and VW on the same docker network and only expose nginx’s ports on the host. VW would only be routable inside the docker network (via http://vaultwarden:8080 as an upstream) ---------------------------------------------------------------------- zoredache · 2023-10-03 17:25 On a standard bridge network, containers can make outgoing connections without any issues. So you probably don't need any ports exposed/published to send something to your smtp server. The exposed/publish ports, is just about making incoming connections to that container work. It adds a couple NAT rules and/or enables the docker-proxy to relay the incoming connections. ---------------------------------------------------------------------- AlexxSeven · 2023-10-03 18:55 Assuming your running things like your SMTP server as containers on the same host as well. look into the docker network drivers [https://docs.docker.com/network/ drivers/](https://docs.docker.com/network/drivers/) and the network create command [https://docs.docker.com/engine/reference/commandline/n etwork\_create/](https://docs.docker.com/engine/reference/commandline/ network_create/) ​ a user-defined bridge would offer you a better solution to your networking issue in terms of isolation and communications, allowing you to define the DHCP pool for your containers and which containers sit within the same network and can communicate without being accessed by containers that don't need access to them. your reverse proxy then sits on the user-defined network for your web services with 443 exposed to route all http traffic. then you follow this same formula for communications between your Vaultwarden server and the SMTP If docker's CLI is a bit too daunting, look into Portainer. its a nice, pretty straight forward GUI for docker that gives you access to pretty much everything you could do in the CLI. including networking. Either way you'll likely be spending some time reworking your container networks and exposed services. ---------------------------------------------------------------------- thekrautboy · 2023-10-03 19:51 > For example, Vaultwarden is exposed on port 8080. I have created a Nginx proxy manager https rewrite. Now, I could close 8080 port outside of the host, but, VW is required to send email to my internal smpt server. How can I solve such problems? One has nothing to do with the other. The 8080 port is a portmapping on the Docker host for **incoming** connections, meaning from your workstation to the Docker host to Vaultwarden itself for example. Vaultwarden sending emails is a outgoing connection, which doenst need any portmappings in Docker itself. Docker handles these automatically and by default outgoing is always allowed. Refer to /r/Docker and maybe /r/HomeNetworking for such basic support. ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-10-03 21:44 I just run everything with no port mapping except my reverse proxy. ---------------------------------------------------------------------- Astorek86 · 2023-10-03 21:52 What about iptables directly? If so: Docker has a excellent Documentation-Site for this Topic: [Packet filtering and firewalls](https://docs.docker.com/network/packet-filtering- firewalls/) ---------------------------------------------------------------------- emprahsFury · 2023-10-03 22:02 When you define the port, define the whole docker i.e 127.0.0.1:8080 instead of just 8080 ---------------------------------------------------------------------- Triliandstir · 2023-10-04 20:06 Where would I do that in portainer? ---------------------------------------------------------------------- Triliandstir · 2023-10-04 20:54 >on the same docker network and only expose nginx’s ports on the host. VW would only be routable inside the docker network (via http://vaultwarden:8080 as an upstream) Thank you! How should I handle the host firewall? To enable only required services. On other non-docker servers, I use UFW to only allow required traffic, but docker hosts are a different thing? ---------------------------------------------------------------------- Triliandstir · 2023-10-04 20:54 thank you, will look in to it ---------------------------------------------------------------------- Triliandstir · 2023-10-04 20:54 Thank you ---------------------------------------------------------------------- Triliandstir · 2023-10-04 20:57 Thank you, will do in the future ---------------------------------------------------------------------- hollowman8904 · 2023-10-04 21:12 No need really (unless you want to black-hole traffic instead of refusing it). By not exposing the port for VW, clients attempting to connect to port 8080 will get a “connection refused”. Remember, you’re creating an isolated network inside of Docker: there’s no way in except for what you explicitly expose (ideally just the reverse proxy).