docs(readme): replace UFW with firewalld for port forwarding

Switch the detailed setup guide from UFW to firewalld for:
- Simpler port forwarding syntax with --add-forward-port
- Native support for rootless container redirection
- Cleaner configuration without editing before.rules

Also adds Tailscale trusted zone configuration note.

commit: 3d58823db157b9a83e0f652b0a131234bf47a4e6
author: brice · 9mo ago · 2026-01-14 06:39 UTC
parent: 06011c0
signature: unsigned

1 file · +26 -23

M README.md +26 -23


@@ -210,39 +210,42 @@ See [examples/github-workflow.yml](examples/github-workflow.yml) and [.github/ac
210	210		# Update system
211	211		sudo apt update && sudo apt upgrade -y
212	212
213		-	# Install podman and firewall
214		-	sudo apt install -y podman ufw
	213	+	# Install podman and firewalld
	214	+	sudo apt install -y podman firewalld
215	215
216		-	# Configure firewall
217		-	sudo ufw allow 22/tcp 80/tcp 443/tcp
218		-	sudo ufw default deny incoming
219		-	sudo ufw --force enable
	216	+	# Enable and start firewalld
	217	+	sudo systemctl enable --now firewalld
220	218		```
221	219
222		-	### 2. Port Forwarding (rootless requires this)
	220	+	### 2. Firewall & Port Forwarding (rootless requires this)
223	221
224		-	Rootless containers can't bind to privileged ports (< 1024). Redirect 80/443 to unprivileged ports:
	222	+	Rootless containers can't bind to privileged ports (< 1024). Use firewalld to redirect 80/443 to unprivileged ports:
225	223
226	224		```bash
227		-	# Add NAT rules to UFW's before.rules (persists across reboots)
228		-	sudo tee -a /etc/ufw/before.rules > /dev/null << 'EOF'
229		-
230		-	# NAT rules for rootless container port redirection
231		-	*nat
232		-	:PREROUTING ACCEPT [0:0]
233		-	-A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
234		-	-A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443
235		-	COMMIT
236		-	EOF
	225	+	# Allow HTTP and HTTPS traffic
	226	+	sudo firewall-cmd --permanent --add-service=http
	227	+	sudo firewall-cmd --permanent --add-service=https
	228	+
	229	+	# Port forward 80/443 to rootless container ports
	230	+	sudo firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080
	231	+	sudo firewall-cmd --permanent --add-forward-port=port=443:proto=tcp:toport=8443
	232	+
	233	+	# Set default policy to drop incoming traffic
	234	+	sudo firewall-cmd --permanent --zone=public --set-target=DROP
237	235
238		-	# Reload UFW to apply
239		-	sudo ufw reload
	236	+	# Reload to apply
	237	+	sudo firewall-cmd --reload
240	238
241		-	# Verify rules are active
242		-	sudo iptables -t nat -L PREROUTING -n
	239	+	# Verify rules
	240	+	sudo firewall-cmd --list-all
243	241		```
244	242
245		-	> Warning: Do NOT use `iptables-persistent` - it conflicts with UFW and will remove it. The method above integrates with UFW properly.
	243	+	> Note: If using Tailscale for management, add its interface to the trusted zone:
	244	+	> ```bash
	245	+	> sudo firewall-cmd --permanent --zone=trusted --add-interface=tailscale0
	246	+	> sudo firewall-cmd --permanent --add-port=41641/udp # Tailscale WireGuard
	247	+	> sudo firewall-cmd --reload
	248	+	> ```
246	249
247	250		### 3. Rootless Container Setup
248	251		```bash


@@ -210,39 +210,42 @@ See [examples/github-workflow.yml](examples/github-workflow.yml) and [.github/ac
210		# Update system	210		# Update system
211		sudo apt update && sudo apt upgrade -y	211		sudo apt update && sudo apt upgrade -y
212			212
213	-	# Install podman and firewall	213	+	# Install podman and firewalld
214	-	sudo apt install -y podman ufw	214	+	sudo apt install -y podman firewalld
215			215
216	-	# Configure firewall	216	+	# Enable and start firewalld
217	-	sudo ufw allow 22/tcp 80/tcp 443/tcp	217	+	sudo systemctl enable --now firewalld
218	-	sudo ufw default deny incoming
219	-	sudo ufw --force enable
220		```	218		```
221			219
222	-	### 2. Port Forwarding (rootless requires this)	220	+	### 2. Firewall & Port Forwarding (rootless requires this)
223			221
224	-	Rootless containers can't bind to privileged ports (< 1024). Redirect 80/443 to unprivileged ports:	222	+	Rootless containers can't bind to privileged ports (< 1024). Use firewalld to redirect 80/443 to unprivileged ports:
225			223
226		```bash	224		```bash
227	-	# Add NAT rules to UFW's before.rules (persists across reboots)	225	+	# Allow HTTP and HTTPS traffic
228	-	sudo tee -a /etc/ufw/before.rules > /dev/null << 'EOF'	226	+	sudo firewall-cmd --permanent --add-service=http
229	-		227	+	sudo firewall-cmd --permanent --add-service=https
230	-	# NAT rules for rootless container port redirection	228	+
231	-	*nat	229	+	# Port forward 80/443 to rootless container ports
232	-	:PREROUTING ACCEPT [0:0]	230	+	sudo firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080
233	-	-A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080	231	+	sudo firewall-cmd --permanent --add-forward-port=port=443:proto=tcp:toport=8443
234	-	-A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443	232	+
235	-	COMMIT	233	+	# Set default policy to drop incoming traffic
236	-	EOF	234	+	sudo firewall-cmd --permanent --zone=public --set-target=DROP
237			235
238	-	# Reload UFW to apply	236	+	# Reload to apply
239	-	sudo ufw reload	237	+	sudo firewall-cmd --reload
240			238
241	-	# Verify rules are active	239	+	# Verify rules
242	-	sudo iptables -t nat -L PREROUTING -n	240	+	sudo firewall-cmd --list-all
243		```	241		```
244			242
245	-	> Warning: Do NOT use `iptables-persistent` - it conflicts with UFW and will remove it. The method above integrates with UFW properly.	243	+	> Note: If using Tailscale for management, add its interface to the trusted zone:
			244	+	> ```bash
			245	+	> sudo firewall-cmd --permanent --zone=trusted --add-interface=tailscale0
			246	+	> sudo firewall-cmd --permanent --add-port=41641/udp # Tailscale WireGuard
			247	+	> sudo firewall-cmd --reload
			248	+	> ```
246			249
247		### 3. Rootless Container Setup	250		### 3. Rootless Container Setup
248		```bash	251		```bash