Hetzner

Why UFW Fails Against Docker: Anatomy of Network Bypass and Bot Exploitation of Exposed Database Ports

A common Docker Compose setup with PostgreSQL and Redis using default port mappings like 5432:5432 and 6379:6379 bypasses UFW firewall rules due to Docker's manipulation of Netfilter chains. Docker inserts DNAT rules in the PREROUTING chain and places DOCKER-FORWARD rules ahead of UFW's deny policies in the FORWARD chain, allowing external traffic to reach containers even when ufw status shows default deny incoming and routed. The issue affects both IPv4 and IPv6, with docker-proxy binding to [::] addresses and ip6tables rules enabling similar bypasses in Docker 27+. Bots scan cloud IP ranges within minutes of deployment, targeting open database ports and deploying miners such as kinsing or kdevtmpfsi via Redis commands like REPLICAOF or CONFIG SET for cron persistence. Historical cases include a Hetzner CPX21 instance compromised in under two minutes and Spree Commerce starter issues where unprotected Redis led to immediate infections. Mitigation requires careful use of DOCKER-USER chains, disabling IPv6 where unnecessary, or switching to nftables for unified filtering.