Connections to containers are not being blocked

[Loptom]

As the per the title, connections to ports used by containers are not being properly blocked.

ufw-check

########## iptables -n -L DOCKER-USER ##########
Chain DOCKER-USER (1 references)
target     prot opt source               destination         


########## diff /etc/ufw/after.rules ##########
--- /etc/ufw/after.rules	2026-07-10 21:56:09.968184911 +0000
+++ /tmp/tmp.ahJxtAttxS	2026-07-11 11:13:23.463789337 +0000
@@ -28,3 +28,28 @@
 
 # don't delete the 'COMMIT' line or these rules won't be processed
 COMMIT
+# BEGIN UFW AND DOCKER
+*filter
+:ufw-user-forward - [0:0]
+:ufw-docker-logging-deny - [0:0]
+:DOCKER-USER - [0:0]
+-A DOCKER-USER -j ufw-user-forward
+
+-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
+-A DOCKER-USER -m conntrack --ctstate INVALID -j DROP
+-A DOCKER-USER -i docker0 -o docker0 -j ACCEPT
+
+-A DOCKER-USER -j RETURN -s 10.0.0.0/8
+-A DOCKER-USER -j RETURN -s 172.16.0.0/12
+-A DOCKER-USER -j RETURN -s 192.168.0.0/16
+-A DOCKER-USER -j ufw-docker-logging-deny -m conntrack --ctstate NEW -d 10.0.0.0/8
+-A DOCKER-USER -j ufw-docker-logging-deny -m conntrack --ctstate NEW -d 172.16.0.0/12
+-A DOCKER-USER -j ufw-docker-logging-deny -m conntrack --ctstate NEW -d 192.168.0.0/16
+
+-A DOCKER-USER -j RETURN
+
+-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
+-A ufw-docker-logging-deny -j DROP
+
+COMMIT
+# END UFW AND DOCKER

########## ip6tables -n -L DOCKER-USER ##########
Chain DOCKER-USER (1 references)
target     prot opt source               destination         


########## diff /etc/ufw/after6.rules ##########
# BEGIN UFW AND DOCKER
*filter
:ufw6-user-forward - [0:0]
:ufw6-docker-logging-deny - [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -j ufw6-user-forward

-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
-A DOCKER-USER -m conntrack --ctstate INVALID -j DROP
-A DOCKER-USER -i docker0 -o docker0 -j ACCEPT

-A DOCKER-USER -j RETURN -s fd00::/8
-A DOCKER-USER -j ufw6-docker-logging-deny -m conntrack --ctstate NEW -d fd00::/8

-A DOCKER-USER -j RETURN

-A ufw6-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
-A ufw6-docker-logging-deny -j DROP

COMMIT
# END UFW AND DOCKER
--- /etc/ufw/after6.rules	2026-07-10 21:56:09.970184993 +0000
+++ /tmp/tmp.ZPUc48Jnxq	2026-07-11 11:13:23.497790746 +0000
@@ -25,3 +25,24 @@
 
 # don't delete the 'COMMIT' line or these rules won't be processed
 COMMIT
+# BEGIN UFW AND DOCKER
+*filter
+:ufw6-user-forward - [0:0]
+:ufw6-docker-logging-deny - [0:0]
+:DOCKER-USER - [0:0]
+-A DOCKER-USER -j ufw6-user-forward
+
+-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
+-A DOCKER-USER -m conntrack --ctstate INVALID -j DROP
+-A DOCKER-USER -i docker0 -o docker0 -j ACCEPT
+
+-A DOCKER-USER -j RETURN -s fd00::/8
+-A DOCKER-USER -j ufw6-docker-logging-deny -m conntrack --ctstate NEW -d fd00::/8
+
+-A DOCKER-USER -j RETURN
+
+-A ufw6-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
+-A ufw6-docker-logging-deny -j DROP
+
+COMMIT
+# END UFW AND DOCKER

ufw status

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     LIMIT       Anywhere                  
22/tcp (v6)                LIMIT       Anywhere (v6)             

172.21.0.2 25565/tcp       ALLOW FWD   Anywhere                   # allow mc-server 25565/tcp minecraft_default
172.21.0.2 25565/udp       ALLOW FWD   Anywhere                   # allow mc-server 25565/udp minecraft_default
172.18.0.3 81/tcp          ALLOW FWD   Anywhere                   # allow npm-app-1 81/tcp npm-network

docker compose

services:
  app:
    image: 'docker.io/jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    networks:
      - npm-network

networks:
  npm-network:
    external: true

In this case, connections to port 443 and 80 are being accepted even though they should be dropped, because the npm container accepts them. ufw logs show that connections to ports that aren't used by any container are dropped.