# UFW Docker compatibility rules
# Append these to /etc/ufw/after.rules (after the existing COMMIT)
# Blocks all external access to Docker-published ports except:
#   - Trusted IPs (add your own)
#   - Explicitly allowed public ports (80, 443)
#   - Docker internal and loopback traffic

*filter
:DOCKER-USER - [0:0]

# Allow established/related
-A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN

# Allow loopback
-A DOCKER-USER -i lo -j RETURN

# Allow Docker internal networks
-A DOCKER-USER -s 172.16.0.0/12 -j RETURN

# Allow trusted external sources (add more lines as needed)
# -A DOCKER-USER -s <TRUSTED_IP> -j RETURN

# Allow public ports
-A DOCKER-USER -i eth0 -p tcp --dport 80 -j RETURN
-A DOCKER-USER -i eth0 -p tcp --dport 443 -j RETURN

# Drop everything else from external
-A DOCKER-USER -i eth0 -j DROP

# Return for non-external traffic
-A DOCKER-USER -j RETURN

COMMIT