[globular-toast]

Erm, because he wanted to use SSH?

Using firewall rules on the hosts is like a fake firewall. Stuff on the hosts can override those rules. Like docker. After all, the host is actually receiving the traffic.

A router isn't a firewall. Lesson learnt: don't assume any "router" device is also a firewall. Last I heard about half of ISP issued routers don't run any kind of stateful firewall for IPv6. The only reason they do for IPv4 is NAT.

[tonymet]

linux firewall (ufw or iptables) is used to restrict the client IP address range. It's best to restrict access to a limited network range .

the firewall is a kernel config. if configured properly no app can bypass

A router that includes a firewall is a firewall. In my case the firewall was broken.