Re: [CentOS] PostgreSQL port accessible even though it should be blocked by firewall

On 10/30/18 8:31 AM, Frank Thommen wrote:

I am still puzzled that it is possible to circumvent firewalld so easily.  Basically it means, that firewalld is not to be trusted as soon as containers with port forwarding are running on a system.

It's hard to see this as a security or trust problem.  The root user can modify the firewall, which is provided by the kernel. firewalld is just a front-end.  Adding rules to the kernel's firewall is not "circumventing" the management front-end.

You do have to bear in mind that the firewall-cmd output reflects the *configuration* and not the *state*.  When docker adds rules, it modifies the state, but not the configuration.