Unverified50% confidenceFactExact time
Ports published by Docker bypass ufw firewall rules by default, directly exposing ports by writing DNAT and FORWARD rules into iptables' nat table and filter table.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedOn Linux, Docker-published ports bypass ufw and firewalld firewall rules.73% similarUnverifiedDocker was once affected by the runc vulnerability CVE-2019-5736, which allowed processes inside a container to overwrite the host's runc binary and obtain root privileges.67% similarUnverified通过Tailcat传输的数据天然享有WireGuard提供的端到端加密保护，并能穿透NAT和防火墙无需手动配置端口映射60% similarUnverifiedTailscale uses STUN and ICE-like protocols for NAT traversal, and when direct connection is not possible, it forwards traffic through DERP relay servers while maintaining end-to-end encryption.59% similarUnverifiedWhen a port scan detects that the target has port 3306 (MySQL's default port) open, it is flagged as a risk; however, the port may actually be unreachable from the external network due to access control whitelists, WAF, or cloud security group rules, resulting in a false positive.59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1044751API
curl https://kongchang.com/api/v1/knowledge/claims/1044751MCP
get_claim(id=1044751)