this post was submitted on 29 Mar 2025
24 points (100.0% liked)

Selfhosted

45390 readers
767 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
 

Note: I am using VPS for services, since I do not want to expose my home network to internet. I am using podman, . But firewall (using UFW frontend) seems to block all the routing and inter-container traffic, so I want to Currently I have UFW rules set as blanket open for all podman networks, like this:

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere                  
222/tcp                    ALLOW       Anywhere                  
80/tcp                     ALLOW       Anywhere                  
Anywhere on podman1        ALLOW       Anywhere                  
443/tcp                    ALLOW       Anywhere                  
8080/tcp                   ALLOW       Anywhere                  
Anywhere on podman0        ALLOW       Anywhere                  
Anywhere on podman2        ALLOW       Anywhere                  
Anywhere on podman3        ALLOW       Anywhere                  
Anywhere on podman4        ALLOW       Anywhere                  
Anywhere on podman5        ALLOW       Anywhere                  
22/tcp (v6)                ALLOW       Anywhere (v6)             
222/tcp (v6)               ALLOW       Anywhere (v6)             
80/tcp (v6)                ALLOW       Anywhere (v6)             
Anywhere (v6) on podman1   ALLOW       Anywhere (v6)             
443/tcp (v6)               ALLOW       Anywhere (v6)             
8080/tcp (v6)              ALLOW       Anywhere (v6)             
Anywhere (v6) on podman0   ALLOW       Anywhere (v6)             
Anywhere (v6) on podman2   ALLOW       Anywhere (v6)             
Anywhere (v6) on podman3   ALLOW       Anywhere (v6)             
Anywhere (v6) on podman4   ALLOW       Anywhere (v6)             
Anywhere (v6) on podman5   ALLOW       Anywhere (v6)             

Anywhere on podman1        ALLOW FWD   Anywhere on ens3          
Anywhere on podman0        ALLOW FWD   Anywhere on ens3          
Anywhere on podman2        ALLOW FWD   Anywhere on ens3          
Anywhere on podman3        ALLOW FWD   Anywhere on ens3          
Anywhere on podman4        ALLOW FWD   Anywhere on ens3          
Anywhere on podman5        ALLOW FWD   Anywhere on ens3          
Anywhere (v6) on podman1   ALLOW FWD   Anywhere (v6) on ens3     
Anywhere (v6) on podman0   ALLOW FWD   Anywhere (v6) on ens3     
Anywhere (v6) on podman2   ALLOW FWD   Anywhere (v6) on ens3     
Anywhere (v6) on podman3   ALLOW FWD   Anywhere (v6) on ens3     
Anywhere (v6) on podman4   ALLOW FWD   Anywhere (v6) on ens3     
Anywhere (v6) on podman5   ALLOW FWD   Anywhere (v6) on ens3 

This neither seems secure, nor extensible when I add another network. Is there some 'best practices' for firewall setup with podman networks? How do you gurus set up your firewall for containers? Thanks in advance!

EDIT: Sorry for missing an important detail, I am running rootful podman with (userns=auto).

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 4 points 4 days ago (1 children)

If you really want to stick to UFW, you can ignore me, but this looks like a situation where finding another firewall may be best. UFW is a front end for IPtables and is mostly meant for desktop or simple server app usage. I'd recommend Shorewall, which is also a front end for IPtables but implements a zone based firewall and allows for more complex setups to be handled easier than with UFW. You can put your podman containers into a zone and define all of the network access you need for that zone separate from the host system.

[–] [email protected] 2 points 4 days ago (1 children)

Thanks, though Shorewall looks intimidating. Do you have any good resources to go over how to set it up?

[–] [email protected] 1 points 4 days ago

For so many Linux server packages I find the manual to be more of a reference than a guide, so not very useful if you're just getting started and aren't sure what to do, but Shorewall is an exception, its manual is wonderful and Tom the creator really goes into detail about how to fit it into many different setups.

https://shorewall.org/GettingStarted.html

You'll probably want to follow the two interface guide, the two interfaces in your case are your public IP interface, and the virtual interface connected to the Podman network side. You'll essentially treat shorewall as a firewall/router for your Podman containers which will act as your "LAN" in this case. The warning about not installing Shorewall on a remote system is not to be ignored, you're generally fine to install the package, but do not start the shorewall service without first setting up some rules to allow SSH. The safest way is to log in via your VPS console instead of SSH to keep you from getting locked out. Most VPS providers have some sort of out-of-band connection utility like VNC or a simple console access you'll want to use.