# 同时使用Docker和ufw，Docker 会绕过 UFW 规则的更好的解决方案

**URL:** <https://idcflare.com/t/topic/29161>\
**Category:** 教程\
**Tags:** 服务器\
**Created:** [2025 年10 月 13 日 08:00 UTC](https://idcflare.com/t/topic/29161 "2025-10-13T08:00:14Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bensong](https://idcflare.com/user_avatar/idcflare.com/bensong/32/12436_2.png) [@Bensong](https://idcflare.com/u/Bensong)\
**Post date:** [2025 年10 月 13 日 08:00 UTC](https://idcflare.com/t/topic/29161/1 "2025-10-13T08:00:14Z")

</div>

## 问题

UFW 是 Ubuntu 上一个流行的 iptables 前端，可以轻松管理防火墙规则。但是，安装 Docker 后，Docker 会绕过 UFW 规则，导致已发布的端口可以被外部访问。

## 解决方案

安装GitHub上一个项目：

> **[GitHub - chaifeng/ufw-docker: To fix the Docker and UFW security flaw without...](https://github.com/chaifeng/ufw-docker)**
>
> To fix the Docker and UFW security flaw without disabling iptables

这个项目把规则命令进行了封装，只需要：

### 安装

下载 `ufw-docker` 脚本

```auto
sudo wget -O /usr/local/bin/ufw-docker \
  https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
chmod +x /usr/local/bin/ufw-docker

```

使用下列命令来修改 ufw 的 `after.rules` 文件

```auto
ufw-docker install

```

这个命令做了以下事情：

- 备份文件 `/etc/ufw/after.rules`
- 把 UFW 和 Docker 的相关规则添加到文件 `after.rules` 的末尾

### 使用方法

显示帮助

```auto
ufw-docker help

```

检查 UFW 配置文件中防火墙规则的安装

```auto
ufw-docker check

```

更新 UFW 的配置文件，添加必要的防火墙规则

```auto
ufw-docker install

```

显示当前防火墙允许的转发规则

```auto
ufw-docker status

```

列出所有和容器 `httpd` 相关的防火墙规则

```auto
ufw-docker list httpd

```

暴露容器 `httpd` 的 `80` 端口

```auto
ufw-docker allow httpd 80

```

暴露容器 `httpd` 的 `443` 端口，且协议为 `tcp`

```auto
ufw-docker allow httpd 443/tcp

```

如果容器 `httpd` 绑定到多个网络上，暴露其 `443` 端口，协议为 `tcp`，网络为 `foobar-external-network`

```auto
ufw-docker allow httpd 443/tcp foobar-external-network

```

把容器 `httpd` 的所有映射端口都暴露出来

```auto
ufw-docker allow httpd

```

删除所有和容器 `httpd` 相关的防火墙规则

```auto
ufw-docker delete allow httpd

```

删除容器 `httpd` 的 `tcp` 端口 `443` 的规则

```auto
ufw-docker delete allow httpd 443/tcp

```

暴露服务 `web` 的 `80` 端口

```auto
docker service create --name web --publish 8080:80 httpd:alpine

ufw-docker service allow web 80
# 或者
ufw-docker service allow web 80/tcp

```

删除与服务 `web` 相关的规则

```auto
ufw-docker service delete allow web

ufw-docker service delete allow web 80/tcp

```

---

<div class="post-metadata">

**Author:** ![bai](https://idcflare.com/user_avatar/idcflare.com/bai/32/605_2.png) [@bai](https://idcflare.com/u/bai)\
**Post date:** [2025 年10 月 13 日 09:33 UTC](https://idcflare.com/t/topic/29161/2 "2025-10-13T09:33:05Z")

</div>

感谢教程，这就去试试

---

<div class="post-metadata">

**Author:** ![handsome](https://idcflare.com/user_avatar/idcflare.com/handsome/32/349_2.png) [@handsome](https://idcflare.com/u/handsome)\
**Post date:** [2025 年10 月 13 日 15:28 UTC](https://idcflare.com/t/topic/29161/3 "2025-10-13T15:28:24Z")

</div>

感谢大佬 ！

---

<div class="post-metadata">

**Author:** ![secman](https://idcflare.com/user_avatar/idcflare.com/secman/32/16624_2.png) [@secman](https://idcflare.com/u/secman)\
**Post date:** [2025 年10 月 13 日 15:47 UTC](https://idcflare.com/t/topic/29161/4 "2025-10-13T15:47:53Z")

</div>

感谢分享

---

<div class="post-metadata">

**Author:** ![Bigbuoluo](https://idcflare.com/user_avatar/idcflare.com/bigbuoluo/32/2206_2.png) [@Bigbuoluo](https://idcflare.com/u/Bigbuoluo)\
**Post date:** [2025 年10 月 13 日 16:02 UTC](https://idcflare.com/t/topic/29161/5 "2025-10-13T16:02:33Z")

</div>

研究下项目 感谢

---

<div class="post-metadata">

**Author:** ![barcode](https://idcflare.com/user_avatar/idcflare.com/barcode/32/12200_2.png) [@barcode](https://idcflare.com/u/barcode)\
**Post date:** [2025 年10 月 14 日 04:41 UTC](https://idcflare.com/t/topic/29161/6 "2025-10-14T04:41:05Z")

</div>

又是好学的一天

---

<div class="post-metadata">

**Author:** ![RDNE](https://idcflare.com/user_avatar/idcflare.com/rdne/32/10541_2.png) [@RDNE](https://idcflare.com/u/RDNE)\
**Post date:** [2025 年10 月 14 日 05:56 UTC](https://idcflare.com/t/topic/29161/7 "2025-10-14T05:56:28Z")

</div>

感谢分享

---

<div class="post-metadata">

**Author:** ![yqyan](https://idcflare.com/user_avatar/idcflare.com/yqyan/32/3375_2.png) [@yqyan](https://idcflare.com/u/yqyan)\
**Post date:** [2025 年10 月 14 日 06:19 UTC](https://idcflare.com/t/topic/29161/8 "2025-10-14T06:19:31Z")

</div>

感谢分享教程 🙏

---

<div class="post-metadata">

**Author:** ![2com](https://idcflare.com/user_avatar/idcflare.com/2com/32/14450_2.png) [@2com](https://idcflare.com/u/2com)\
**Post date:** [2025 年10 月 14 日 06:22 UTC](https://idcflare.com/t/topic/29161/9 "2025-10-14T06:22:56Z")

</div>

docker端口设置为127.0.0.1:port:port就可以了

---

<div class="post-metadata">

**Author:** ![Walmart](https://idcflare.com/user_avatar/idcflare.com/walmart/32/3519_2.png) [@Walmart](https://idcflare.com/u/Walmart)\
**Post date:** [2025 年10 月 16 日 00:14 UTC](https://idcflare.com/t/topic/29161/10 "2025-10-16T00:14:19Z")

</div>

谢谢大佬的教程

---

<div class="post-metadata">

**Author:** ![kzhsw](https://idcflare.com/user_avatar/idcflare.com/kzhsw/32/9149_2.png) [@kzhsw](https://idcflare.com/u/kzhsw)\
**Post date:** [2025 年10 月 16 日 00:49 UTC](https://idcflare.com/t/topic/29161/11 "2025-10-16T00:49:12Z")

</div>

可以看看你的托管商有没有“安全组”，这个docker不能绕过

---

<div class="post-metadata">

**Author:** ![luming](https://idcflare.com/user_avatar/idcflare.com/luming/32/2108_2.png) [@luming](https://idcflare.com/u/luming)\
**Post date:** [2025 年10 月 16 日 02:27 UTC](https://idcflare.com/t/topic/29161/12 "2025-10-16T02:27:21Z")

</div>

感谢分享

---

<div class="post-metadata">

**Author:** ![yazhou\_fu](https://idcflare.com/user_avatar/idcflare.com/yazhou_fu/32/10599_2.png) [@yazhou\_fu](https://idcflare.com/u/yazhou_fu)\
**Post date:** [2025 年10 月 16 日 02:35 UTC](https://idcflare.com/t/topic/29161/13 "2025-10-16T02:35:46Z")

</div>

感谢分享 🫰

---

<div class="post-metadata">

**Author:** ![nbenter](https://idcflare.com/letter_avatar/nbenter/32/6_22734026db12803ebb3e059622ac3534.png) [@nbenter](https://idcflare.com/u/nbenter)\
**Post date:** [2025 年10 月 16 日 10:30 UTC](https://idcflare.com/t/topic/29161/14 "2025-10-16T10:30:39Z")

</div>

网站的话，简单一点操作，是不是将端口映射到127.0.0.1也行？

---

<div class="post-metadata">

**Author:** ![Bensong](https://idcflare.com/user_avatar/idcflare.com/bensong/32/12436_2.png) [@Bensong](https://idcflare.com/u/Bensong)\
**Post date:** [2025 年10 月 16 日 10:37 UTC](https://idcflare.com/t/topic/29161/15 "2025-10-16T10:37:35Z")

</div>

可以，不过针对复杂应用就不建议在docker改了，比如dify

---

<div class="post-metadata">

**Author:** ![ScottCawthon](https://idcflare.com/user_avatar/idcflare.com/scottcawthon/32/2354_2.png) [@ScottCawthon](https://idcflare.com/u/ScottCawthon)\
**Post date:** [2025 年10 月 16 日 15:26 UTC](https://idcflare.com/t/topic/29161/16 "2025-10-16T15:26:53Z")

</div>

感谢大佬的教程分享

---

<div class="post-metadata">

**Author:** ![kyzhangs](https://idcflare.com/user_avatar/idcflare.com/kyzhangs/32/22888_2.png) [@kyzhangs](https://idcflare.com/u/kyzhangs)\
**Post date:** [2025 年10 月 24 日 03:47 UTC](https://idcflare.com/t/topic/29161/17 "2025-10-24T03:47:11Z")

</div>

那其他人怎么访问呢，再加个nginx反代嘛

---

<div class="post-metadata">

**Author:** ![nero](https://idcflare.com/user_avatar/idcflare.com/nero/32/714_2.png) [@nero](https://idcflare.com/u/nero)\
**Post date:** [2025 年10 月 26 日 06:31 UTC](https://idcflare.com/t/topic/29161/18 "2025-10-26T06:31:29Z")

</div>

谢谢分享 🫰