Hetzner + Docker firewall

Hetzner has two firewall layers

Layer	Where	Blocks Docker bypass?
Hetzner Cloud Firewall	Network level, before your server	✓ Yes — if configured
UFW (on-server)	Inside your server via iptables	✗ No — Docker bypasses UFW

The Hetzner Cloud Firewall approach

Hetzner's cloud firewall operates at the network level — traffic never reaches your server if blocked. This means it does protect Docker-exposed ports, unlike UFW.

Recommended for Hetzner: Use Hetzner Cloud Firewall to block all ports except 22, 80, 443. Then use 127.0.0.1 bindings for additional defence-in-depth.

Hetzner Cloud Firewall rules for Docker servers

✅ Hetzner Cloud Firewall inbound rules

ALLOW  TCP  22    # SSH
ALLOW  TCP  80    # HTTP
ALLOW  TCP  443   # HTTPS
DENY   ALL        # Everything else (including Docker ports)

Add 127.0.0.1 binding for defence-in-depth

Even with a cloud firewall, bind database ports to localhost in your compose file. This protects you if the cloud firewall is ever misconfigured.

services:
  db:
    image: postgres:15
    ports:
      - "127.0.0.1:5432:5432"  # localhost only — double protection

Hetzner-specific: PTR records for email

If you're sending email from a Hetzner server, set a PTR record in the Hetzner Cloud console under Server → Networking → Primary IPv4 → Edit PTR. This is required for good email deliverability.

Frequently Asked Questions

Does Hetzner's cloud firewall block all UDP by default?

Hetzner's default firewall blocks all inbound traffic. You explicitly allow what you need. Add UDP 51820 if running WireGuard VPN, UDP 53 if running a DNS server, and any other UDP ports your services require.

Can I use both Hetzner Cloud Firewall and UFW?

Yes — defence in depth is recommended. Hetzner firewall as the outer layer, UFW for the inner layer. UFW won't help with Docker, but it adds protection for non-containerised services running directly on the host.

Does Hetzner support nftables?

Yes. Hetzner's Ubuntu and Debian images support both UFW and nftables. nftables is the successor to iptables and is recommended for new installations. Use sudo nft list ruleset to inspect rules.

ConfigClarity