# Firewall rules to prevent access to container ports **URL:** \ **Category:** ShinyProxy\ **Created:** [September 20, 2023, 11:31am UTC](https://support.openanalytics.eu/t/firewall-rules-to-prevent-access-to-container-ports/2639 "2023-09-20T11:31:58Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![prinn](https://support.openanalytics.eu/letter_avatar_proxy/v4/letter/p/7ea924/32.png) [@prinn](https://support.openanalytics.eu/u/prinn)\ **Post date:** [September 20, 2023, 11:31am UTC](https://support.openanalytics.eu/t/firewall-rules-to-prevent-access-to-container-ports/2639/1 "2023-09-20T11:31:58Z")
Hi, I’m a little unsure how to block external IPs from accessing the running Docker containers on my ShinyProxy host. ShinyProxy does expose the ports to 0.0.0.0 and I’m not really sure why/if that’s needed. My naïve understanding from reading the [Docker documentation](https://docs.docker.com/network/packet-filtering-firewalls/#restrict-connections-to-the-docker-host) on that topic is that adding a `iptables -I DOCKER-USER -i ext_if -j DROP` should do the trick. But I fear, I might break ShinyProxy in some subtle ways, I didn’t think about. Most tutorials I found use UFW but that actually doesn’t play well with Docker, so I’d like to avoid using UFW. ---
**Author:** ![prinn](https://support.openanalytics.eu/letter_avatar_proxy/v4/letter/p/7ea924/32.png) [@prinn](https://support.openanalytics.eu/u/prinn)\ **Post date:** [September 25, 2023, 2:01pm UTC](https://support.openanalytics.eu/t/firewall-rules-to-prevent-access-to-container-ports/2639/2 "2023-09-25T14:01:45Z")
From what I understand now ``` iptables -I DOCKER-USER -i ext_if -j DROP iptables -I DOCKER-USER -i ext_if -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT ``` should actually do the trick to allow needed connections that are established from within the container e.g. DB connections etc.