Enabling the firewall disables access to everything

[andrewvaughan]

I have gluetun acting as a central network point for traffic I want to wireguard through mullvad. I also have Traefik setup to proxy ports to various routes on my local DNS. This works fine... unless I have the firewall enabled on gluetun.

Here's my config that I've tried, and fails, along with some notes during my testing:

services:
  
  gluetun:
    container_name : "gluetun"
    image          : "qmcgaw/gluetun:v3"    # v4 will bring breaking changes

    <<: *common # Sets DNS to Cloudflare and restart-always

    # Required for creating VPN interface.
    # https://man7.org/linux/man-pages/man7/capabilities.7.html
    cap_add:
      - NET_ADMIN

    networks:
      - "reverse-proxy"

    ports:
      - "50505:50505"       # These ports only ever get exposed if the firewall is disabled.
      - "50505:50505/udp"

    # Creates the tunnel device on the host.
    devices:
      - "/dev/net/tun:/dev/net/tun"

    volumes:
      - "gluetun-app:/gluetun"

    environment:
      # I've tried being as explicit as possible (this also fails if these aren't set)
      FIREWALL_INPUT_PORTS: "50505,50580"
      FIREWALL_OUTBOUND_SUBNETS: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
      FIREWALL_VPN_INPUT_PORTS: "50505,50580"

      FIREWALL: on   # Only by turning this `off` can I get this to work
      FIREWALL_DEBUG: on
      SERVER_CITIES: "Stockholm"
      TZ: "America/New_York"
      VPN_SERVICE_PROVIDER: "mullvad"
      VPN_TYPE: "wireguard"

      WIREGUARD_ADDRESSES: "REDACTED"
      WIREGUARD_PRIVATE_KEY: "REDACTED"

    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=reverse-proxy"

      # Notce that Trafik wants to access port 50580 here - this also only works if the
      # firewall is completely disabled. I thought container-to-container traffic wasn't
      # blocked...?
      - "traefik.http.routers.qbit.rule=Host(`dashboard.lab`)"
      - "traefik.http.services.qbit.loadbalancer.server.port=50580"
      - "traefik.http.routers.qbit.entrypoints=web"
      - "traefik.http.routers.qbit.middlewares=restrict-lan@file"

However, the only time I can ever get this to work is when I set FIREWALL=off for the Gluetun configuration. I've tried opening up the firewall to the ports being used and to all my LAN traffic, but it all seems to be blocked whenever the firewall is enabled.

Any help would be extremely appreciated. The logs seem to show the iptables configurations being set... I just can't access anything in the container on any subnet. Thanks!

[andrewvaughan]

Closing my own discussion - I'm not sure why, but bouncing the other container with Gluetun remaining open fixed this issue.