# Docker LXC Firewall Configuration

This README outlines the process for configuring the firewall on a Docker LXC to allow external access to Docker applications while maintaining security.

## Initial Setup

1. Backup existing configuration:

   iptables-save > ~/iptables_backup_$(date +%Y%m%d).rules
   iptables -L -v -n > ~/iptables_config_$(date +%Y%m%d).txt

2. Set default policies:

   iptables -P INPUT DROP
   iptables -P FORWARD DROP
   iptables -P OUTPUT ACCEPT

3. Allow established and related connections:

   iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

4. Allow loopback traffic:

   iptables -A INPUT -i lo -j ACCEPT

5. Allow SSH (if needed):

   iptables -A INPUT -p tcp --dport 22 -j ACCEPT

6. Allow incoming traffic for Docker applications:

   iptables -A INPUT -p tcp --dport 3000 -j ACCEPT  # Homepage
   iptables -A INPUT -p tcp --dport 9443 -j ACCEPT  # Portainer
   iptables -A INPUT -p tcp --dport 2283 -j ACCEPT  # Immich
   iptables -A INPUT -p tcp --dport 8099 -j ACCEPT  # Octoprint
   iptables -A INPUT -p tcp --dport 8443 -j ACCEPT  # code-server

7. Allow local network traffic:

   iptables -A INPUT -s 192.168.68.0/22 -j ACCEPT

8. Allow incoming traffic for Nginx Proxy Manager:

   iptables -A INPUT -p tcp --dport 80 -j ACCEPT
   iptables -A INPUT -p tcp --dport 443 -j ACCEPT

9. Allow Docker-related traffic:

   iptables -A FORWARD -i docker0 -o eth0 -j ACCEPT
   iptables -A FORWARD -i eth0 -o docker0 -j ACCEPT

10. Save and persist rules:

    iptables-save > /etc/iptables/rules.v4
    apt-get update
    apt-get install iptables-persistent

11. Enable IP forwarding:
    Edit `/etc/sysctl.conf` and ensure this line is present:

    net.ipv4.ip_forward=1

    Then apply changes:

    sysctl -p

## Adding New Ports for Future Docker Apps

To add a new port for a future Docker application:

1. Add a new iptables rule:

   iptables -A INPUT -p tcp --dport [NEW_PORT] -j ACCEPT

   Replace [NEW_PORT] with the actual port number.

2. Save the updated rules:

   iptables-save > /etc/iptables/rules.v4

3. Restart the iptables service or reboot the LXC to apply changes.

## Restoring from Backup

If needed, restore from backup using:

iptables-restore < ~/iptables_backup_YYYYMMDD.rules

Replace YYYYMMDD with the actual date of your backup file.

## Troubleshooting

- If external access fails, temporarily disable the firewall to test:

  iptables -P INPUT ACCEPT
  iptables -P FORWARD ACCEPT
  iptables -F

- Check Docker LXC logs and Nginx Proxy Manager logs for any error messages.
- Verify that port forwarding is correctly set up on your router.
- Ensure DNS records are up to date if using domain names.

Remember to always test changes thoroughly and maintain regular backups of your configuration.