Programmer Humor

33538 readers

640 users here now

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

Keep content in english
No advertisements
Posts must be related to programming or programmer topics
- If the mod doesn't find it funny, you're banned. Ha-ha!... For real: do not use the community for "statements". There are other places for such content. Keep it chill and funny.

founded 3 years ago

MODERATORS

Feyter@programming.dev

anzo@programming.dev

BurningTurtle@programming.dev

pylapp@programming.dev

525

Context: Docker bypasses all UFW firewall rules (lemmy.world)

submitted 1 year ago* (last edited 1 year ago) by qaz@lemmy.world to c/programmer_humor@programming.dev

99 comments fedilink hide all child comments

Docker docs:

Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.

you are viewing a single comment's thread
view the rest of the comments

[–] MasterNerd@lemmy.zip 12 points 1 year ago (2 children)

I mean if you're hosting anything publicly, you really should have a dedicated firewall

[–] ohshit604@sh.itjust.works 1 points 1 year ago

have a dedicated firewall

I mean, don’t router firewalls count in this regard? Isn’t that kinda part of their job?

[–] qaz@lemmy.world 1 points 1 year ago (1 children)

Do you mean a hardware firewall?

[–] MasterNerd@lemmy.zip 2 points 1 year ago (1 children)

Basically yeah, though I didn't specify hardware because of how often virtualization is done now

[–] qaz@lemmy.world 1 points 1 year ago (1 children)

The VPS I'm using unfortunately doesn't offer an external firewall

[–] MasterNerd@lemmy.zip 2 points 1 year ago (1 children)

Well, if you have the option you could set up a virtual network through the VPS and have a box with pfsense or something to route all traffic through. Take this with a grain of salt - I've seen this done but never done it fully myself.

[–] qaz@lemmy.world 2 points 1 year ago

I've just disabled all incoming connections (including SSH etc.) and access everything through WireGuard