Allow Docker Swarm node traffic only on the trusted network that connects your managers and workers: TCP 2377 for manager control, TCP and UDP 7946 for node discovery, and UDP 4789 for the overlay data path. If you use encrypted overlays, allow IP protocol 50 between participating nodes. Keep Docker’s iptables chains intact and put host policy in DOCKER-USER. Published service ports need a separate allowlist because the routing mesh listens on every node, including nodes with no local task.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Do not expose UDP 4789 to the internet or another untrusted perimeter. VXLAN provides no authentication. Docker’s current documentation also says its nftables backend cannot be enabled while the daemon is running in Swarm mode, so a Swarm host must follow the Engine’s supported iptables path or another supported frontend that ultimately preserves Docker’s rules.
As an Amazon Associate I earn from qualifying purchases.
What the firewall must allow
Swarm uses separate channels for cluster control, membership discovery and container-network data. Treat them as node-to-node traffic, not as general inbound service ports. The safest baseline is to permit these flows only on the interface and source CIDR used by the Swarm nodes.
| Traffic | Protocol and port | Required scope | Why it is needed |
|---|---|---|---|
| Manager control plane | TCP 2377 | Only between trusted Swarm nodes | Manager join and control traffic |
| Node discovery and membership | TCP and UDP 7946 | All participating managers and workers | Node discovery and membership communication |
| Overlay/VXLAN data path | UDP 4789 by default | Only between participating nodes on a trusted network | Overlay and ingress network data; the port can be changed at Swarm initialization |
| Encrypted overlay traffic | IP protocol 50 | Participating nodes when encrypted overlays are enabled | ESP packets used by encrypted overlay networking |
| Published applications | Application-specific TCP or UDP ports | Only intended clients or load balancers, to every node in the routing mesh | Client access to services published by Swarm |
Port 7946 is not configurable. UDP 4789 is the default data-path port and can be replaced with the port selected through docker swarm init --data-path-port. Use the configured value in every firewall rule; do not open both ports unless the cluster actually uses both.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Plan the firewall before changing rules
Inventory the cluster
Write down each manager and worker address, the CIDR that contains them, their roles, and the interface carrying Swarm traffic. A host with separate management, storage and public interfaces should not automatically permit Swarm ports on all three. Decide whether node traffic uses a private VLAN, a VPN, or another explicitly trusted network.
Inventory published services
List every port supplied to docker service create or docker service update. Record the protocol, the intended client networks and whether a load balancer reaches nodes directly. These application ports are independent of the three mandatory Swarm port groups.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchChoose a policy model
- Permit the required node-to-node ports from the node CIDR and, where practical, on the Swarm interface.
- Permit each published application port only from its actual client or load-balancer CIDRs.
- Keep unrelated inbound traffic denied by the host’s normal default policy.
- Permit established and related return traffic according to the host firewall’s normal stateful policy.
- Document the rules and their persistence method before applying a restrictive change.
Why source restriction matters
Swarm’s overlay data path uses VXLAN. Docker warns that VXLAN has no authentication, so an attacker who can reach UDP 4789 could inject or interfere with overlay traffic. A perimeter firewall must therefore block that port from untrusted networks. The same principle applies to TCP 2377 and both protocols on 7946: they are cluster-internal channels, not public APIs.
Use the narrowest source range that contains all current nodes. If managers and workers occupy different subnets, allow both explicit subnets rather than an entire corporate address space. If nodes are added later, update the allowlist deliberately and verify that the new address is not being admitted through a broad fallback rule.
Configure iptables without breaking Docker
Understand Docker’s chains
Docker creates and maintains the DOCKER-USER, DOCKER-FORWARD, DOCKER, DOCKER-BRIDGE, DOCKER-INTERNAL, DOCKER-CT and DOCKER-INGRESS chains. Docker processes DOCKER-USER before DOCKER-FORWARD and DOCKER-INGRESS, making it the administrator’s insertion point.
Do not delete or replace Docker’s generated chains as a way to impose policy. Rules accepted or rejected in DOCKER-USER may never reach later forwarding rules, so this chain is also the right place to stop a published port before Docker’s own accept rule handles it.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Inspect the current state first
- Confirm the active interfaces and addresses with the distribution’s normal address tools.
- Inspect Docker’s chains and counters with
iptables-saveandiptables -L DOCKER-USER -n -v. - Check whether IP forwarding is enabled. Docker requires forwarding for its default bridge configuration and may set the
FORWARDdefault policy toDROPwhen it enables forwarding. - Capture a known-good ruleset before editing so you can restore it if container networking stops.
Add node-to-node rules
Replace NODE_CIDR with the private network containing the Swarm nodes and SWARM_IF with the interface that carries that traffic. The following examples show the rule shape; adapt ordering, state rules and interface names to the host’s existing policy.
iptables -I DOCKER-USER 1 -i SWARM_IF -s NODE_CIDR -p tcp --dport 2377 -j ACCEPT
iptables -I DOCKER-USER 2 -i SWARM_IF -s NODE_CIDR -p tcp --dport 7946 -j ACCEPT
iptables -I DOCKER-USER 3 -i SWARM_IF -s NODE_CIDR -p udp --dport 7946 -j ACCEPT
iptables -I DOCKER-USER 4 -i SWARM_IF -s NODE_CIDR -p udp --dport 4789 -j ACCEPTIf the cluster was initialized with another data-path port, substitute that UDP port for 4789. If your policy is built in the host’s INPUT chain rather than forwarding chains, place equivalent node rules there as well; Swarm traffic must be allowed in the chain that actually sees it on your host.
Handle encrypted overlays
Encrypted overlay networking requires IP protocol 50 between participating nodes. Permit that protocol only on the trusted node paths. Docker also recommends accepting only encrypted packets on the data-path port. Its example for the default port is:
iptables -I INPUT -m udp --dport 4789 -m policy --dir in --pol none -j DROPAdapt the port, interface and rule order to the deployment. This rule drops inbound UDP 4789 packets that do not match an IPsec policy; it is not a substitute for the node-CIDR allowlist or for permitting protocol 50 where encrypted traffic is expected.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesControl published ports in DOCKER-USER
The routing mesh makes a published port reachable on every node, even when that node has no task for the service. A rule that allows a client to reach one node therefore allows it to reach the service through every node whose address is reachable. Create explicit rules for each application port and source network before any broad accept rule. For example, a web service intended only for a load-balancer subnet can be limited with a rule shaped like:
iptables -I DOCKER-USER 1 -s LOAD_BALANCER_CIDR -p tcp --dport APP_PORT -j ACCEPTDo not assume that allowing the port only on the node running a task is sufficient; the routing mesh can forward from another node. Conversely, do not open every published port to the entire internet merely because a service is present in the stack.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Preserve forwarding and return traffic
Review the complete forwarding path after inserting rules. A restrictive policy can block overlay packets, ingress forwarding or replies even when the destination port appears open. Ensure the host’s established/related rule and forwarding policy are compatible with Docker’s generated chains. If you change the default FORWARD policy, verify both container-to-container traffic and published-service replies rather than testing only a local connection.
Using UFW as the management frontend
UFW command syntax is consistent on many distributions, but Docker integration and persistence are distribution-specific. Use UFW for the administrator policy only after confirming which underlying iptables chains it changes. Docker’s generated chains must remain present, and published-port restrictions may need to be enforced in DOCKER-USER when a simple UFW allow rule would otherwise be bypassed by Docker’s forwarding rules.
Free tools Windows power users keep installed
One-click scans. No signup required.
Allow the Swarm channels from the node network
For a node network of 10.20.0.0/24, representative UFW rules are:
ufw allow from 10.20.0.0/24 to any port 2377 proto tcp
ufw allow from 10.20.0.0/24 to any port 7946 proto tcp
ufw allow from 10.20.0.0/24 to any port 7946 proto udp
ufw allow from 10.20.0.0/24 to any port 4789 proto udpReplace the CIDR and data-path port with the values used by the cluster. If managers and workers use separate ranges, create one rule per range. For encrypted overlays, add the distribution-appropriate rule for IP protocol 50; UFW’s high-level port syntax does not represent every protocol equally, so confirm the resulting rules with iptables-save.
Allow applications narrowly
Permit an application port from its client network, not from the node network by default. For example:
ufw allow from 192.0.2.0/24 to any port 443 proto tcpBecause routing-mesh listeners exist on every node, apply the same source restriction to every node’s host firewall. Test the actual node addresses that clients can reach, including nodes with no local replica.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Verify what UFW actually installed
After adding rules, inspect verbose status and the underlying chains. Confirm that the rules are persistent across reboot using the distribution’s supported UFW mechanism, then restart Docker and verify that Docker’s chains were recreated without removing your administrator policy. Never disable Docker’s iptables management unless you have supplied a complete replacement for its networking rules.
firewalld and other frontends
firewalld, raw iptables, and distribution-specific firewall managers can all express the same policy, but their zones, reload behavior and persistence differ. Put Swarm traffic in a zone or ruleset associated with the trusted node interface, and add application ports to a separate allowlist for client networks. Do not put UDP 4789 in a public zone.
Use the frontend’s reload operation only after checking that it preserves Docker’s chains. Compare iptables-save before and after a reload, then inspect packet counters while exercising a Swarm join, overlay connection and published service. A frontend that silently flushes or reorders Docker’s chains can make containers fail even though its own status command reports success.
nftables compatibility and Swarm mode
Docker documents its nftables backend as experimental and states that overlay-network rules have not been migrated. Consequently, nftables cannot be enabled while the Docker daemon is running in Swarm mode. A system may provide an iptables-nft compatibility command, but that does not mean Docker is using the native nftables backend or that native nftables Swarm support exists.
Recommended Free Tools
Check the Docker Engine release documentation and the distribution’s backend selection before changing a production host. If the daemon is in Swarm mode, keep the supported iptables path and administer policy through DOCKER-USER. Do not mix an assumed native nftables policy with Docker’s iptables overlay rules and expect packets to follow one consistent order.
Persist and verify the configuration
Save through the distribution mechanism
The exact commands for saving iptables rules, enabling a boot-time restore, reloading UFW or persisting firewalld configuration vary by distribution and package. Use the mechanism supported by the host rather than copying a persistence command from another Linux family. Record the node CIDRs, interface names, data-path port, published ports and rule order alongside the deployment configuration.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Test from three viewpoints
- From an allowed node, verify TCP 2377, TCP and UDP 7946 and the configured UDP data-path port to every relevant peer.
- From an untrusted or intentionally denied source, verify that those same ports do not respond or pass traffic.
- From an allowed application client, test each published service against every node address in the routing mesh.
- From a denied client network, confirm that restricted application ports remain unreachable.
- Repeat the tests after a firewall reload, Docker restart and host reboot.
Use socket inspection tools such as ss -lntup, Swarm status commands such as docker node ls and docker service ls, and packet counters from iptables -L ... -n -v. A listening socket alone does not prove that the firewall allows the intended source, and a successful local test does not prove that remote nodes can use the overlay.
Troubleshooting by symptom
A manager or worker cannot join
Check TCP 2377 from the joining node to a manager, then check that return traffic is permitted. Confirm that the advertised manager address is on the reachable interface and that the source CIDR rule covers the joining node. Do not expose 2377 publicly as a workaround.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Nodes join but membership flaps
Check both TCP and UDP 7946 in both directions between all participating nodes. A rule that permits only TCP, only managers, or only one subnet can leave discovery partially functional and produce intermittent membership failures.
Overlay networks or service-to-service traffic fail
Verify UDP 4789, or the custom data-path port, between every node that may carry the overlay. If the network is encrypted, verify IP protocol 50 and ensure the policy-based drop rule is not rejecting legitimate encrypted packets. Check interface selection and packet counters rather than opening the port globally.
A published service is unexpectedly exposed
Remember that the routing mesh listens on every node. Enumerate all node addresses reachable by clients, then place a source-restricted rule for the application port in DOCKER-USER or the equivalent effective chain. Remove broad host or perimeter allows that admit the port from unintended networks.
Containers lose connectivity after a firewall change
Compare iptables-save with the known-good copy. Look for deleted Docker chains, an unexpected FORWARD policy of DROP, a rule inserted ahead of established traffic, or a frontend reload that flushed Docker’s rules. Restore the generated chains and move administrator policy into DOCKER-USER instead of disabling Docker’s iptables management.
A native nftables migration breaks Swarm
Return to the Docker-supported backend for the Engine version in use. Docker’s current guidance does not support enabling its nftables backend while the daemon runs in Swarm mode because overlay rules remain on iptables. Treat an iptables-nft compatibility command as an implementation detail, not proof of native backend support.
Compare firewall approaches before production
| Decision axis | Raw iptables with DOCKER-USER | UFW or firewalld frontend | Native Docker nftables backend in Swarm mode |
|---|---|---|---|
| Engine and Swarm support | Aligns with Docker’s documented Swarm chain model | Depends on how the frontend programs and preserves those chains | Docker documents that it cannot be enabled while the daemon runs in Swarm mode |
| Node CIDR and interface restrictions | Direct control with source and interface matches | Available, but exact syntax and zone behavior vary by distribution | Not an available Swarm-mode choice under the cited support statement |
| Docker-generated chains | Explicitly preserved; administrator rules go in DOCKER-USER | Must be checked after reloads and package updates | Overlay rules remain on iptables |
| Routing-mesh port control | Can filter published ports before Docker’s forwarding chains | May require DOCKER-USER rules in addition to frontend allows | Not applicable while unsupported in Swarm mode |
| Persistence | Requires the distribution’s iptables-save or equivalent restore mechanism | Usually managed by the frontend, with distribution-specific behavior | Not applicable while unsupported in Swarm mode |
| Observability | Detailed counters and saved rules are directly visible | Frontend status plus underlying iptables inspection | Do not infer support from an nftables command being present |
Operational checklist
- TCP 2377 is allowed only between trusted managers and workers.
- TCP and UDP 7946 are allowed in both directions between all participating nodes.
- UDP 4789 is allowed only between participating nodes, or the configured data-path port is used instead.
- Encrypted overlays have the required IP protocol 50 path and an intentional policy for unencrypted packets.
- VXLAN data traffic is blocked at untrusted perimeters.
- Docker’s generated chains remain intact after firewall reloads and Docker restarts.
- Administrator policy is inserted in
DOCKER-USERwhere forwarding and published-port filtering require it. - Every published application port has a documented source allowlist covering every routing-mesh node.
- Rules persist through reboot using the host distribution’s supported mechanism.
- Allowed, denied and post-reboot tests have been recorded for node traffic and applications.
Final configuration principle
A Swarm firewall is correct when cluster channels are private, application ports are intentionally exposed, and Docker’s own forwarding logic still operates. Build the policy around trusted node CIDRs and interfaces, treat routing-mesh listeners as present on every node, and validate the effective iptables chains after every firewall or Docker change. That approach avoids the two common extremes: exposing VXLAN and control traffic broadly, or breaking overlay networking by replacing the rules Docker requires.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
