A database or development service listens on all interfaces (port ‹port›, default-deny firewall)
What this means
A database or development service listens on every network interface (port ‹port›, on ‹listen address›). The host firewall denies incoming connections by default, so unless something opened this port it isn't directly reachable — but its safety now depends on that firewall. Bulwark can't see your allow rules: if you (or a tool) allowed this port, it is open to the network, and ports published by Docker bypass ufw unless DOCKER-USER rules restrict them. Check with: sudo ufw status numbered
How to fix it
Bind it to this computer only, so it doesn't depend on the firewall.
- For Docker Compose, change the port line from
‹port›:‹port›to127.0.0.1:‹port›:‹port›and restart the stack. - For a service installed directly, set its listen or bind address to 127.0.0.1.
- If it must stay reachable from other machines, restrict it in DOCKER-USER (for Docker) or with a ufw rule scoped to your private network (e.g. your tailnet), and accept the risk here.
Check it yourself
Run a scan and look for BLWK-NET-005 in the results:
bulwark scanInstalled the standalone CLI package instead of the app? The command is bulwarkctl.
How Bulwark decides
Bulwark reads listening_ports and reports this check when:
listen_address in ["0.0.0.0", "::"] and port in [1025, 2375, 3306, 5432, 5672, 6379, 8025, 9000, 9001, 9200, 11211, 15672, 27017] and inbound_firewalled == trueIf a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.
References
Related checks
- Docker's API is open to every program on this computer (‹path›) ·
BLWK-DEV-009 - A VNC/remote-desktop port is listening ·
BLWK-NET-001 - A port commonly used by ngrok's local API is listening ·
BLWK-NET-002 - A database or development service is open to the network (port ‹port›) ·
BLWK-NET-003 - No host firewall is filtering incoming connections ·
BLWK-NET-004