title: Docker ufw connect to host machine
body: <p>I tried out Docker with UFW and i read a lot of this. </p>
  
  <p>My goal was to connect to an mariadb database on the host machine from an docker image.</p>
  
  <pre><code>Host (running ufw) -&gt; docker container 1 - mediawiki -&gt; Database (onHost)
                     -&gt; docker container 2 - phpwebserver -&gt; Database (onHost)
                     -&gt; docker container 3 - nextcloud -&gt; Database (onHost)
                     -&gt; .......
  </code></pre>
  
  <p>I</p>
  
  <p>By default docker uses iptables which can be disabled.</p>
  
  <pre><code>/etc/docker/daemon.json 
  {
    "iptables": false
  }
  </code></pre>
  
  <p>then set</p>
  
  <pre><code>/etc/default/ufw
  DEFAULT_FORWARD_POLICY to ACCEPT
  </code></pre>
  
  <p>finally add this lines in the after.rules file</p>
  
  <pre><code>/etc/ufw/after.rules
  
  *nat
  :POSTROUTING ACCEPT [0:0]
  -A POSTROUTING ! -o docker0 -s 172.17.0.0/16 -j MASQUERADE
  COMMIT
  </code></pre>
  
  <p>Back to Docker:
  Now i add the localhost:port mapping and the database host in the docker-compose.yml file</p>
  
  <pre><code>ports:
    - "127.0.0.1:8080:8080"
  MEDIAWIKI_DB_HOST: 172.17.0.1 &lt;- this was the docker0 interface
  </code></pre>
  
  <p>I see with docker ps, that docker runs as localhost:</p>
  
  <pre><code>CONTAINER ID        IMAGE                  COMMAND                  CREATED             STATUS              PORTS                                NAMES
  cffb491c84b2        db_mediawiki   "/docker-entrypoint.…"   22     minutes ago      Up 22 minutes       127.0.0.1:8080-&gt;8080/tcp, 9000/tcp     mediawiki_wiki
  </code></pre>
  
  <p>Now i can connect with an reverse nginx on the host system to this docker image. Or simply using curl localhost:8080/wiki/Main_Page</p>
  
  <p>Without UFW all seems working, but with enabled UFW all connections are blocked from the bridge to docker0 interface?</p>
  
  <pre><code>[UFW BLOCK] IN=br-9da71acf3f9f OUT= MAC=02:42:f2:7b:35:7b:02:42:ac:12:00:02:08:00 SRC=172.18.0.2 DST=172.17.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=53146 DF PROTO=TCP SPT=36126 DPT=3306 WINDOW=29200 RES=0x00 SYN URGP=0
  </code></pre>
  
  <p>Can anyone provide some help to get this step working?</p>
  
  <p>Many thanks, </p>
  
  <p>David </p>