Ubuntu 26.04 LTS – UFW rules block Docker container egress unexpectedly

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Administrators observe: Ubuntu 26.04 LTS – UFW rules block Docker container egress unexpectedly. Containers cannot reach package mirrors or APIs.

Environment & Reproduction

Issue appears when UFW default deny policies interact with Docker bridge rules.

# Baseline context
lsb_release -a
sudo ufw status verbose
sudo iptables -S
sudo iptables -t nat -S
docker network ls

Root Cause Analysis

Docker manipulates iptables chains and can bypass or conflict with UFW routing/filter policy expectations.

Quick Triage

Test connectivity from host and container while reviewing forwarding policy.

# Quick triage
docker run --rm alpine ping -c 2 1.1.1.1
docker run --rm alpine nslookup archive.ubuntu.com || true
sudo grep -n 'DEFAULT_FORWARD_POLICY' /etc/default/ufw
sudo ufw show raw

Step-by-Step Diagnosis

Inspect DOCKER-USER and UFW forward chains in packet path order.

# Detailed diagnosis
sudo iptables -nvL FORWARD
sudo iptables -nvL DOCKER-USER
sudo ufw status numbered
ip -br a | grep docker

Solution – Primary Fix

Allow routed traffic for Docker interfaces in UFW and enforce policy in DOCKER-USER.

# Primary fix
sudo sed -i 's/^DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
sudo ufw route allow in on docker0 out on 
sudo ufw reload
sudo iptables -I DOCKER-USER -j RETURN

Solution – Alternative Approaches

Disable Docker iptables management and define explicit nftables/ufw rules.

# Alternative
sudo mkdir -p /etc/docker
echo '{"iptables": false}' | sudo tee /etc/docker/daemon.json
sudo systemctl restart docker
# Add explicit forwarding/NAT rules before production use

Verification & Acceptance Criteria

Containers can resolve DNS and reach external endpoints while firewall policy remains controlled.

# Verify
docker run --rm alpine ping -c 2 1.1.1.1
docker run --rm alpine wget -qO- https://example.com | head
sudo ufw status verbose

Rollback Plan

Revert UFW forwarding policy and custom Docker firewall changes.

# Rollback
sudo sed -i 's/^DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="DROP"/' /etc/default/ufw
sudo ufw reload
sudo iptables -D DOCKER-USER -j RETURN || true

Prevention & Hardening

Adopt a documented Docker plus UFW baseline and verify after daemon updates.

# Hardening
sudo ufw status numbered
sudo iptables-save | grep -E 'DOCKER|UFW'
docker info | grep -i iptables

Related Errors & Cross-Refs

Related patterns include Docker bridge isolation issues and unexpected bypass of host firewall intent.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu UFW documentation and Docker networking/firewall integration notes.