diff --git a/assets/firewall-and-network-docker-bypass.svg b/assets/firewall-and-network-docker-bypass.svg index 72d8bae..cbf9cfd 100644 --- a/assets/firewall-and-network-docker-bypass.svg +++ b/assets/firewall-and-network-docker-bypass.svg @@ -1,4 +1,4 @@ -
Incoming Traffic
pfSense
Layer 1 — always applies
TARGET HOST — everything below this line is decided by what's running on it
firewalld
Layer 2 — native services only
Native Service
e.g. Alloy, Wazuh agent
Docker-published port
dozens of containerized apps
native path
Docker-published path

Solid orange — every packet, everywhere, always crosses pfSense first
Solid blue — native services get a second gate at the host level
Dashed red — the actual gap: Docker-published ports never reach firewalld
 \ No newline at end of file +
Incoming Traffic
pfSense
Layer 1 — always applies
TARGET HOST — everything below this line is decided by what's running on it
firewalld
Layer 2 — native services only
Native Service
e.g. Alloy, Wazuh agent
Docker-published port
dozens of containerized apps
native path
Docker-published path
Solid orange — every packet, everywhere, always crosses pfSense first
Solid blue — native services get a second gate at the host level
Dashed red — the actual gap: Docker-published ports never reach firewalld
 \ No newline at end of file