[Docker Orchestration] F/W 설정

방화벽 설정 : ubuntu 기본 방화벽 도구(UFW : uncomplicated Firewall)

ubuntu@ip-172-31-20-199:/etc$ ls -al /etc/default/ufw
-rw-r--r-- 1 root root 1754 Aug 17  2017 /etc/default/ufw

ubuntu@ip-172-31-20-199:/etc$ cat /etc/default/ufw
# /etc/default/ufw
#

# Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
# accepted). You will need to 'disable' and then 'enable' the firewall for
# the changes to take affect.
IPV6=yes

# Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
# you change this you will most likely want to adjust your rules.
DEFAULT_INPUT_POLICY="DROP"

# Set the default output policy to ACCEPT, DROP, or REJECT. Please note that if
# you change this you will most likely want to adjust your rules.
DEFAULT_OUTPUT_POLICY="ACCEPT"

# Set the default forward policy to ACCEPT, DROP or REJECT.  Please note that
# if you change this you will most likely want to adjust your rules
#DEFAULT_FORWARD_POLICY="DROP"

DEFAULT_FORWARD_POLICY="ACCEPT"

# Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please
# note that setting this to ACCEPT may be a security risk. See 'man ufw' for
# details
DEFAULT_APPLICATION_POLICY="SKIP"

# By default, ufw only touches its own chains. Set this to 'yes' to have ufw
# manage the built-in chains too. Warning: setting this to 'yes' will break
# non-ufw managed firewall rules
MANAGE_BUILTINS=no

#
# IPT backend
#
# only enable if using iptables backend
IPT_SYSCTL=/etc/ufw/sysctl.conf

# Extra connection tracking modules to load. Complete list can be found in
# net/netfilter/Kconfig of your kernel source. Some common modules:
# nf_conntrack_irc, nf_nat_irc: DCC (Direct Client to Client) support
# nf_conntrack_netbios_ns: NetBIOS (samba) client support
# nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT
# nf_conntrack_ftp, nf_nat_ftp: active FTP support
# nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side)
IPT_MODULES="nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns"

$ ufw reload

root@ip-172-31-20-199:/etc/default# systemctl restart ufw

root@ip-172-31-20-199:/etc/default# ps -ef |grep ufw
root     14281 14236  0 13:33 pts/0    00:00:00 grep --color=auto ufw

root@ip-172-31-20-199:/etc/default# service ufw status
● ufw.service - Uncomplicated firewall
   Loaded: loaded (/lib/systemd/system/ufw.service; enabled; vendor preset: enabled)
   Active: active (exited) since Sun 2019-03-03 13:33:08 UTC; 23s ago
     Docs: man:ufw(8)
  Process: 14265 ExecStop=/lib/ufw/ufw-init stop (code=exited, status=0/SUCCESS)
  Process: 14274 ExecStart=/lib/ufw/ufw-init start quiet (code=exited, status=0/SUCCESS)
 Main PID: 14274 (code=exited, status=0/SUCCESS)

Mar 03 13:33:08 ip-172-31-20-199 systemd[1]: Stopped Uncomplicated firewall.
Mar 03 13:33:08 ip-172-31-20-199 systemd[1]: Starting Uncomplicated firewall...
Mar 03 13:33:08 ip-172-31-20-199 systemd[1]: Started Uncomplicated firewall.
root@ip-172-31-20-199:/etc/default#

cf. 원격으로 컨테이너 접근 필요시 docker 포트(default 2375) 오픈

$ ufw allow 2375/tcp

root@ip-172-31-20-199:/etc/default# ufw allow 2375/tcp
Rules updated
Rules updated (v6)