From 9241bd37bc1c0c6036b04671b520c51a6f75672a Mon Sep 17 00:00:00 2001 From: adminroot Date: Sat, 25 Oct 2025 19:33:46 -0700 Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=20src/ufw-docker.txt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/ufw-docker.txt | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 src/ufw-docker.txt diff --git a/src/ufw-docker.txt b/src/ufw-docker.txt new file mode 100644 index 0000000..2d4d070 --- /dev/null +++ b/src/ufw-docker.txt @@ -0,0 +1,27 @@ +# BEGIN UFW AND DOCKER +*filter +:ufw-user-forward - [0:0] +:ufw-docker-logging-deny - [0:0] +:DOCKER-USER - [0:0] +-A DOCKER-USER -j ufw-user-forward + +-A DOCKER-USER -j RETURN -s 10.0.0.0/8 +-A DOCKER-USER -j RETURN -s 172.16.0.0/12 +-A DOCKER-USER -j RETURN -s 192.168.0.0/16 + +-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN + +-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16 +-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8 +-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12 +-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16 +-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8 +-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12 + +-A DOCKER-USER -j RETURN + +-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] " +-A ufw-docker-logging-deny -j DROP + +COMMIT +# END UFW AND DOCKER \ No newline at end of file