Linux firewall (docker swarm example with 3 vms)

readme.md

• on VM1 (node manager)

# communication between the nodes of a Docker Swarm or cluster. It only needs to be opened on manager nodes.
$ sudo ufw allow proto tcp from <VM2 IP> to <VM1 IP> port 2377    
$ sudo ufw allow proto tcp from <VM3 IP> to <VM1 IP> port 2377
# communication among nodes (container network discovery).
$ sudo ufw allow proto tcp to <VM1 IP> port 7946                                
$ sudo ufw allow proto udp to <VM1 IP> port 7946
# overlay network traffic
$ sudo ufw allow proto udp to <VM1 IP> port 4789

• on VM2

# communication between the nodes of a Docker Swarm or cluster. It only needs to be opened on manager nodes.
$ sudo ufw allow proto tcp from <VM1 IP> to <VM2 IP> port 2377    
$ sudo ufw allow proto tcp from <VM3 IP> to <VM2 IP> port 2377
# communication among nodes (container network discovery).
$ sudo ufw allow proto tcp to <VM2 IP> port 7946                                
$ sudo ufw allow proto udp to <VM2 IP> port 7946
# overlay network traffic 
$ sudo ufw allow proto udp to <VM2 IP> port 4789 

• on VM3

# communication between the nodes of a Docker Swarm or cluster. It only needs to be opened on manager nodes.
$ sudo ufw allow proto tcp from <VM1 IP> to <VM3 IP> port 2377    
$ sudo ufw allow proto tcp from <VM2 IP> to <VM3 IP> port 2377
# communication among nodes (container network discovery).
$ sudo ufw allow proto tcp to <VM3 IP> port 7946                                
$ sudo ufw allow proto udp to <VM3 IP> port 7946
# overlay network traffic
$ sudo ufw allow proto udp to <VM3 IP> port 4789                              

• swarm init manager

$ docker swarm init --advertise-addr PRIVATE_IP

• swarm join manager

$ docker swarm init --advertise-addr PRIVATE_IP