Set up mail-receiver, but now site won't send any emails?

[Simon_Manning]

That’s a separate situation, albeit related. That’s connections coming in from the outside and Docker adds rules to allow exposed ports through.

@supermathie

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  docker0 any     anywhere             anywhere            
    0     0 DNAT       tcp  --  !docker0 any     anywhere             anywhere             tcp dpt:https to:172.17.0.2:443
  107  6848 DNAT       tcp  --  !docker0 any     anywhere             anywhere             tcp dpt:http to:172.17.0.2:80

I’m not enormously familiar with netfilter/iptables chain rules but I believe the above is showing:

1. If the connection is coming in from docker0, i.e. from the default docker network, return to the previous chain (stop processing rules in that chain).
2. Otherwise if the connection is coming in from anything except docker0, if it’s also https or http, specify DNAT causing it to move on to the FORWARD chain.

So with the arrangement shown in the other topic, what happens is that if https or http traffic comes in from outside, it gets directed in to docker. If the traffic comes from the docker network however, it will be returned and rejected or dropped by the INPUT chain.

What ufw allow https does is adds a rule to the INPUT chain accepting it. That way when the connection is returned to the INPUT chain as above, it will be accepted and find docker listening, ultimately being routed to the container.