If a container exposes any web interfaces — for example, as implemented in WG-Easy — closing ports with standard tools like UFW and iptables can be quite problematic. The ufw-docker utility comes to the rescue with a very simple algorithm: everything that is not allowed is blocked.
Installation
First you must have the standard UFW installed and running:
sudo apt install ufw
ufw enable
Download ufw-docker from the repository:
sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
sudo chmod +x /usr/local/bin/ufw-docker
Then install and restart UFW:
ufw-docker install
sudo systemctl restart ufw
Done!
Opening ports for containers
The ufw-docker utility has a command that selectively adds ports to the allowlist for specific Docker containers:
ufw-docker allow httpd 80
However, if you want to use a more advanced rule — for example, an IP-based allowlist — you will need to use ufw route allow:
ufw route allow proto tcp from 1.2.3.4 to any port 9443
Manual
The manual is simple:
Usage:
ufw-docker <list|allow> [docker-instance-id-or-name [port[/tcp|/udp]] [network]]
ufw-docker delete allow [docker-instance-id-or-name [port[/tcp|/udp]] [network]]
ufw-docker service allow <swarm-service-id-or-name <port</tcp|/udp>>>
ufw-docker service delete allow <swarm-service-id-or-name>
ufw-docker <status|install|check|help>
Example with WG-Easy
For the wireguard-ui option, everything will be straightforward.
Allow:
ufw-docker allow wg-easy
Remove:
ufw-docker delete allow wg-easy
That’s it — done.
Article first published on 13.12.2022 on openode.xyz; moved and updated on 04.08.2026.