Docker Swarm is a feature of Docker that makes it easy to run Docker hosts and containers at scale. A Docker Swarm, or Docker cluster, is made up of one or more Dockerized hosts that function as manager nodes, and any number of worker nodes. Setting up such a system requires careful manipulation of the Linux firewall.
The network ports required for a Docker Swarm to function correctly are:
2376
for secure Docker client communication. This port is required for Docker Machine to work. Docker Machine is used to orchestrate Docker hosts.2377
. This port is used for communication between the nodes of a Docker Swarm or cluster. It only needs to be opened on manager nodes.7946
for communication among nodes (container network discovery).4789
for overlay network traffic (container ingress networking).Note: Aside from those ports, port 22
(for SSH traffic) and any other ports needed for specific services to run on the cluster have to be open.
In this article, you’ll learn how to configure the Linux firewall on Ubuntu 16.04 using the different firewall management applications available on all Linux distributions. Those firewall management applications are FirewallD, IPTables Tools, and UFW, the Uncomplicated Firewall. UFW is the default firewall application on Ubuntu distributions, including Ubuntu 16.04. While this tutorial covers three methods, each one delivers the same outcome, so you can choose the one you are most familiar with.
Before proceeding with this article, you should:
Note: You’ll notice that the commands (and all the commands in this article) are not prefixed with sudo
. That’s because it’s assumed that you’re logged into the server using the docker-machine ssh
command after provisioning it using Docker Machine.
If you just set up your Docker hosts, UFW is already installed. You just need to enable and configure it. Follow this guide to learn more about using UFW on Ubuntu 16.04.
Execute the following commands on the nodes that will function as Swarm managers:
- ufw allow 22/tcp
- ufw allow 2376/tcp
- ufw allow 2377/tcp
- ufw allow 7946/tcp
- ufw allow 7946/udp
- ufw allow 4789/udp
Afterwards, reload UFW:
- ufw reload
If UFW isn’t enabled, do so with the following command:
- ufw enable
This might not be necessary, but it never hurts to restart the Docker daemon anytime you make changes to and restart the firewall:
systemctl restart docker
Then on each node that will function as a worker, execute the following commands:
- ufw allow 22/tcp
- ufw allow 2376/tcp
- ufw allow 7946/tcp
- ufw allow 7946/udp
- ufw allow 4789/udp
Afterwards, reload UFW:
- ufw reload
If UFW isn’t enabled, enable it:
- ufw enable
Then restart the Docker daemon:
systemctl restart docker
That’s all you need to do to open the necessary ports for Docker Swarm using UFW.
FirewallD is the default firewall application on Fedora, CentOS and other Linux distributions that are based on them. But FirewallD is also available on other Linux distributions, including Ubuntu 16.04.
If you opt to use FirewallD instead of UFW, first uninstall UFW:
- apt-get purge ufw
Then install FirewallD:
- apt-get install firewalld
Verify that it’s running:
- systemctl status firewalld
If it’s not running, start it:
- systemctl start firewalld
Then enable it so that it starts on boot:
- systemctl enable firewalld
On the node that will be a Swarm manager, use the following commands to open the necessary ports:
- firewall-cmd --add-port=22/tcp --permanent
- firewall-cmd --add-port=2376/tcp --permanent
- firewall-cmd --add-port=2377/tcp --permanent
- firewall-cmd --add-port=7946/tcp --permanent
- firewall-cmd --add-port=7946/udp --permanent
- firewall-cmd --add-port=4789/udp --permanent
Note: If you make a mistake and need to remove an entry, type:
firewall-cmd --remove-port=port-number/tcp —permanent
.
Afterwards, reload the firewall:
- firewall-cmd --reload
Then restart Docker.
- systemctl restart docker
Then on each node that will function as a Swarm worker, execute the following commands:
- firewall-cmd --add-port=22/tcp --permanent
- firewall-cmd --add-port=2376/tcp --permanent
- firewall-cmd --add-port=7946/tcp --permanent
- firewall-cmd --add-port=7946/udp --permanent
- firewall-cmd --add-port=4789/udp --permanent
Afterwards, reload the firewall:
- firewall-cmd --reload
Then restart Docker.
systemctl restart docker
You’ve successfully used FirewallD to open the necessary ports for Docker Swarm.
To use IPtables on any Linux distribution, you’ll have to first uninstall any other firewall utilities. If you’re switching from FirewallD or UFW, first uninstall them.
Then install the iptables-persistent
package, which manages the automatic loading of IPtables rules:
- apt-get install iptables-persistent
Next, flush any existing rules using this command:
- netfilter-persistent flush
Now you can add rules using the iptables
utility. This first set of command should be executed on the nodes that will serve as Swarm managers.
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A INPUT -p tcp --dport 2376 -j ACCEPT
- iptables -A INPUT -p tcp --dport 2377 -j ACCEPT
- iptables -A INPUT -p tcp --dport 7946 -j ACCEPT
- iptables -A INPUT -p udp --dport 7946 -j ACCEPT
- iptables -A INPUT -p udp --dport 4789 -j ACCEPT
After you enter all of the commands, save the rules to disk:
- netfilter-persistent save
Then restart Docker.
- sudo systemctl restart docker
On the nodes that will function as Swarm workers, execute these commands:
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A INPUT -p tcp --dport 2376 -j ACCEPT
- iptables -A INPUT -p tcp --dport 7946 -j ACCEPT
- iptables -A INPUT -p udp --dport 7946 -j ACCEPT
- iptables -A INPUT -p udp --dport 4789 -j ACCEPT
Save these new rules to disk:
- netfilter-persistent save
Then restart Docker:
- sudo systemctl restart docker
That’s all it takes to open the necessary ports for Docker Swarm using IPTables. You can learn more about how these rules work in the tutorial How the Iptables Firewall Works.
If you wish to switch to FirewallD or UFW after using this method, the proper way to go about it is to first stop the firewall:
- sudo netfilter-persistent stop
Then flush the rules:
- sudo netfilter-persistent flush
Finally, save the now empty tables to disk:
- sudo netfilter-persistent save
Then you can switch to UFW or FirewallD.
FirewallD, IPTables Tools and UFW are the three firewall management applications in the Linux world. You just learned how to use each to open the network ports needed to set up Docker Swarm. Which method you use is just a matter of personal preference, as they are all equally capable.
Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Sign up for Infrastructure as a Newsletter.
Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
Also note, with encrypted overlay networks you will need to allow inbound traffic on the workers for the ESP protocol.
sudo ufw allow proto esp
I’m having a tough time getting docker-machine to work properly, able to
docker-machine ssh
to a node but unable to usedocker-machine env
. And, my swarm is able to spin up containers on a worker, but unable to redirect traffic from a web browser to any services located only on a worker.I’m now trying to add security group permissions based on this chart https://docs.docker.com/datacenter/ucp/2.2/guides/admin/install/system-requirements/#ports-used and the ports you suggested… but can you help explain why 4789 is not on the list and why the other ports you mentioned aren’t detailed with ingress and egress?
I have to log into EACH AND EVERY SERVER to configure the firewall ? What if I have 200 servers ? Or something I don’t get here ?
I ran a series of “ufw allow” commands, restarted docker, checked “ufw status” and see the firewall rules there. When I look at the droplet in my DO dashboard, the Networking->Firewalls section says “You haven’t applied any Firewalls to this Droplet yet.” Is the droplet firewall something different?
When I follow the instructions for setting up a swarm, the swarm works initially, but after a few minutes it becomes unreachable from docker cloud and from the docker for mac application. It says “Docker Cloud is receiving heartbeats, but cannot connect to the swarm Resolution: Swarm is not publicly reachable, it may be behind a firewall or NAT”
Anything else I should try? This is my ufw configuration:
Did you notice that when using ufw as a firewall and for example:
The traffic will still go through to your docker container. Docker does some fancy stuff with iptables when running the containers. This does not seem very secure. Either you need to have your docker virtual networks carefully crafted or you need to bind the ports to 127.0.0.1:PORT:PORT, which I’m not sure how well with works in multi node swarm mode.
// JKON