0

Please help to understand why FirewallD allows me to connect to one port but blocks the second.

There is a Docker container with transmission:

5cf144eed6f2        maksim77/transmission   "/bin/sh -c 'transmis"   14 hours ago        Up 16 minutes       0.0.0.0:9091->9091/tcp, 0.0.0.0:51413->51413/tcp   transmission

Both ports (9091 and 51413) are not listed in FirewallD rules:

root@host:maksim #firewall-cmd --list-all-zones | grep active
public (default, active)
trusted (active)

root@host:maksim #firewall-cmd --list-all --zone trusted
  trusted (active)
  interfaces: docker0
  sources:
  services:
  ports: 4243/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

root@host:maksim #firewall-cmd --list-all --zone public
  public (default, active)
  interfaces: enp9s0
  sources:
  services: dhcpv6-client ftp http ssh
  ports: 41387/tcp 1900/udp 50213/tcp 8200/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

But! The connection is successful for port 9091 but not for port 51413. Port 51413 is available only for 127.0.0.1

MSemochkin
  • 885
  • 7
  • 8
  • Can yo tell which interface accepts the connection for port 9091? Do you know which interface should've handled 51413? – Dani_l Oct 15 '15 at 09:55
  • netstat shows `tcp6 0 0 :::9091 :::* LISTEN 9807/docker-proxy` I think 51413 needs to be the same. – MSemochkin Oct 15 '15 at 10:10
  • Make sure you did `EXPOSE 51413` and you did _not_ set `bind-address-ipv4` in transmission's [config file](https://trac.transmissionbt.com/wiki/EditConfigFiles). – Michael Hampton Oct 15 '15 at 14:06
  • Of course i EXPOSE both port. bind-address-ipv4 = "0.0.0.0" – MSemochkin Oct 15 '15 at 15:05

1 Answers1

1

You don't see these in firewalld because Docker opens the ports itself, outside of firewalld.

To see what Docker is doing, run:

iptables -L DOCKER
iptables -t nat -L DOCKER

Docker will open firewall ports itself for any port your containers EXPOSE, unless you explicitly disable this. It also allows containers which need to communicate with each other to do so, so you should leave this enabled unless you really know what you're doing.

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
  • Thank you! It is now clear why it is not visible in the output ports on the FirewallD. According to iptables both ports are open but port 51413 is closed from the outside. Whereas at the request of localhost it is available. – MSemochkin Oct 15 '15 at 15:13