docs(readme): fix port forwarding to use UFW instead of iptables-persistent

iptables-persistent conflicts with UFW and removes it. Updated guide to
use UFW's before.rules for NAT port redirection instead.

1 file · +20 -6

M README.md +20 -6


@@ -220,16 +220,30 @@ sudo ufw --force enable
220	220		```
221	221
222	222		### 2. Port Forwarding (rootless requires this)
	223	+
	224	+	Rootless containers can't bind to privileged ports (< 1024). Redirect 80/443 to unprivileged ports:
	225	+
223	226		```bash
224		-	# Forward 80/443 to unprivileged port 8080
225		-	sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
226		-	sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8080
	227	+	# Add NAT rules to UFW's before.rules (persists across reboots)
	228	+	sudo tee -a /etc/ufw/before.rules > /dev/null << 'EOF'
	229	+
	230	+	# NAT rules for rootless container port redirection
	231	+	*nat
	232	+	:PREROUTING ACCEPT [0:0]
	233	+	-A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
	234	+	-A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443
	235	+	COMMIT
	236	+	EOF
227	237
228		-	# Make persistent
229		-	sudo apt install -y iptables-persistent
230		-	sudo netfilter-persistent save
	238	+	# Reload UFW to apply
	239	+	sudo ufw reload
	240	+
	241	+	# Verify rules are active
	242	+	sudo iptables -t nat -L PREROUTING -n
231	243		```
232	244
	245	+	> Warning: Do NOT use `iptables-persistent` - it conflicts with UFW and will remove it. The method above integrates with UFW properly.
	246	+
233	247		### 3. Rootless Container Setup
234	248		```bash
235	249		# Enable user namespaces


@@ -220,16 +220,30 @@ sudo ufw --force enable
220		```	220		```
221			221
222		### 2. Port Forwarding (rootless requires this)	222		### 2. Port Forwarding (rootless requires this)
			223	+
			224	+	Rootless containers can't bind to privileged ports (< 1024). Redirect 80/443 to unprivileged ports:
			225	+
223		```bash	226		```bash
224	-	# Forward 80/443 to unprivileged port 8080	227	+	# Add NAT rules to UFW's before.rules (persists across reboots)
225	-	sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080	228	+	sudo tee -a /etc/ufw/before.rules > /dev/null << 'EOF'
226	-	sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8080	229	+
			230	+	# NAT rules for rootless container port redirection
			231	+	*nat
			232	+	:PREROUTING ACCEPT [0:0]
			233	+	-A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
			234	+	-A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443
			235	+	COMMIT
			236	+	EOF
227			237
228	-	# Make persistent	238	+	# Reload UFW to apply
229	-	sudo apt install -y iptables-persistent	239	+	sudo ufw reload
230	-	sudo netfilter-persistent save	240	+
			241	+	# Verify rules are active
			242	+	sudo iptables -t nat -L PREROUTING -n
231		```	243		```
232			244
			245	+	> Warning: Do NOT use `iptables-persistent` - it conflicts with UFW and will remove it. The method above integrates with UFW properly.
			246	+
233		### 3. Rootless Container Setup	247		### 3. Rootless Container Setup
234		```bash	248		```bash
235		# Enable user namespaces	249		# Enable user namespaces