Which connections/interfaces are in zone 'docker'?

Farhan Shirgill Ansari

11/18/22, 3:51 PM

Executing the below command on Ubuntu 20.04 LTS

sudo firewall-cmd --list-all-zone

gives me these

block,
dmz,
docker (active),
drop,
external,
home,
internal,
public,
trusted,
work,

The thing which is bothering me is the current one selected shown as

docker(active)

The Ubuntu 20.04 LTS is running on Virtual Box with Windows as Host OS.

When i try to add port 80/tcp to allow access to the same, the below message comes and it is followed with each command fired related to firewall-cmd.

You're performing an operation over default zone ('public'), but your connections/interfaces are in zone 'docker' (see --get-active-zones) You most likely need to use --zone=docker option.

I have the below interfaces

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:d5:27:1e brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute enp0s3
       valid_lft 64587sec preferred_lft 64587sec
    inet6 fe80::fd34:4d76:1e4b:3bb6/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
3: lxcbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 00:16:3e:00:00:00 brd ff:ff:ff:ff:ff:ff
    inet 10.0.3.1/24 scope global lxcbr0
       valid_lft forever preferred_lft forever
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:c7:78:76:c2 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever

Under what circumstances, does the docker zone becomes the active zone? What connections/interfaces is it referring to in the docker zone? Please suggest.

472

0 + 3

ubuntu

firewall

firewalld

docker-networking

Michael Hampton

11/18/22, 5:25 PM

The interfaces were shown on your screen when you ran `sudo firewall-cmd --list-all-zone`

Farhan Shirgill Ansari

11/18/22, 5:56 PM

@MichaelHampton Under the docker zone, `interfaces: docker0` is listed. Under what circumstances, does this docker zone becomes the active zone? My question is why is this active and what are the reasons for it being the active one.

Farhan Shirgill Ansari

11/19/22, 8:55 AM

I understood now. Whenever any interface is attached(is bind) to any of the zones, that zone is activated. Multiple zones can be activated likewise. Initially, the docker zone was shown to be activated as it was the only zone to which an interface was attached.