# Firewall rules, apache proxy and docker

**URL:** <https://vaultwarden.discourse.group/t/firewall-rules-apache-proxy-and-docker/349>\
**Category:** Third Party Help\
**Created:** [October 6, 2020, 5:02pm UTC](https://vaultwarden.discourse.group/t/firewall-rules-apache-proxy-and-docker/349 "2020-10-06T17:02:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bartAV](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bartAV](https://vaultwarden.discourse.group/u/bartAV)\
**Post date:** [October 6, 2020, 5:02pm UTC](https://vaultwarden.discourse.group/t/firewall-rules-apache-proxy-and-docker/349/1 "2020-10-06T17:02:39Z")

</div>

Hello all,  
I have setup Bitwarden\_rs and it is working well.  
I’ve setup a systemd service on my Ubuntu 20.04 host woth the option:

```auto
-p 9011:80 -p 3012:3012 
```

In Apache conf file I have configured bitwarden as subdomain like: [bitwarden.myserver.com](http://bitwarden.myserver.com)

` 
   ServerName bitwarden.myserver.com
   SSLEngine On
   Include /etc/letsencrypt/options-ssl-apache.conf
   ErrorLog /data/bitwarden-error.log
   CustomLog /data/bitwarden-access.log combined
   RewriteEngine On
   RewriteCond %{HTTP:Upgrade} =websocket [NC]
   RewriteRule /notifications/hub(.*) ws://localhost:3012/$1 [P,L]
   ProxyPass / http://localhost:9011/
   SSLProxyEngine on
   ProxyPreserveHost On
   ProxyRequests Off
   RequestHeader set X-Real-IP %{REMOTE_ADDR}s`

Now I can reach bitwarden als [bitwarden.myserver.com](http://bitwarden.myserver.com), but also as ip-address:9011.

So it looks like as if port 9011 has been opened in the firewall. But I do not see this in iptables -S. I do see some lines of docker. Did docker open this port to the outside?  
How can I close 9011 for the outside world?

---

<div class="post-metadata">

**Author:** ![jjlin](https://avatars.discourse-cdn.com/v4/letter/j/e19adc/32.png) [@jjlin](https://vaultwarden.discourse.group/u/jjlin)\
**Post date:** [October 6, 2020, 5:47pm UTC](https://vaultwarden.discourse.group/t/firewall-rules-apache-proxy-and-docker/349/2 "2020-10-06T17:47:54Z")

</div>

You would use `-p 127.0.0.1:9011:80`; see [https://docs.docker.com/engine/reference/commandline/run/#publish-or-expose-port--p---expose](https://docs.docker.com/engine/reference/commandline/run/#publish-or-expose-port--p---expose).

---

<div class="post-metadata">

**Author:** ![bartAV](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bartAV](https://vaultwarden.discourse.group/u/bartAV)\
**Post date:** [October 6, 2020, 6:03pm UTC](https://vaultwarden.discourse.group/t/firewall-rules-apache-proxy-and-docker/349/3 "2020-10-06T18:03:28Z")

</div>

Oh it is that simple! Thank you [jjlin](https://vaultwarden.discourse.group/u/jjlin)  
Should I also add this for 3012?

```auto
-p 127.0.0.1:9011:80 -p 127.0.0.1:3012:3012

```