Rootless Podman ignoring ufw/ip-tables

[drhirn]

I'm trying to get up fail2ban for a rootless podman Traefik container. This is working so far, fail2ban is creating new ufw-rules.

UFW:
[ 1] Anywhere REJECT IN 192.0.2.1 # by Fail2Ban after 3 attempts against traefik

iptables:
REJECT all -- 192.0.2.1.wireless.example.com anywhere reject-with icmp-port-unreachable

But I still can access Traefik and all containers behind using this ip.

The container is running via podman-compose and has it's own network defined.

services:

  traefik:
    image: traefik:3.0
    container_name: traefik
    restart: always
    ports:
      - "80:80/tcp"
      - "443:443/tcp"
      - "443:443/udp"
    volumes:
      - traefik_log:/log
      - /etc/localtime:/etc/localtime:ro
      - ./.acme:/acme
      - ./config:/config
      - /run/user/1000/podman/podman.sock:/var/run/docker.sock:z
    networks:
      traefik:
        ipv4_address: 192.0.2.1
    env_file: .env
    security_opt:
      - no-new-privileges:true
      - label=type:container_runtime_t
    labels:
[...]
    command:
[...]
      - "--entryPoints.web.address=:80"
      - "--entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,192.0.2.1/32"
[...]
      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=127.0.0.1/32,192.0.2.1/32"
[...]

networks:
  traefik:
    name: traefik
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 192.0.2.0/24
    labels:
      io.podman.compose.project: "traefik network"

volumes:
  traefik_log:

May be a stupid question, but: What am I missing?

[officer47p]

I have this exact problem but using k3s and Traefik.
The 80 port has a reject all rule, but I still can access all of the services.