Appearance
Firewall
iptables
Firewall is managed with nftables/iptables.
Current policies:
| Chain | Policy |
|---|---|
| INPUT | ACCEPT (Tailscale rules applied) |
| FORWARD | DROP (Docker exceptions) |
| OUTPUT | ACCEPT |
Docker adds rules for port publishing to the FORWARD chain.
Firewall
The host manages its own firewall rules. Default open ports include:
| Port | Service |
|---|---|
| 22/tcp | SSH |
| 25/tcp | SMTP (Postfix) |
| 53/tcp+udp | DNS (dnsmasq) |
| 80/tcp | HTTP (Nginx) |
| 143/tcp | IMAP (Dovecot) |
| 443/tcp | HTTPS (Nginx) |
| 587/tcp | Submission (Postfix) |
| 636/tcp | LDAPS (OpenLDAP) |
| 993/tcp | IMAPS (Dovecot) |
| 4190/tcp | Sieve (Dovecot) |
Docker FORWARD
Docker inserts DOCKER-USER and DOCKER-FORWARD chains into the FORWARD policy. Currently DOCKER chain allows port 80 traffic to 172.18.0.4 and drops the rest.