I think the main firewall modification to keep in mind with Docker (swarm mode or not) is that if you publish a port with `--publish`, Docker will pretty much a

I think the main firewall modification to keep in mind with Docker (swarm mode or not) is that if you publish a port with `--publish`, Docker will pretty much always punch a hole through your existing firewall rules for this port. If you don't want this, simply don't use `--publish` (or the equivalent through the Docker API). Container-to-container communication should be done using containers on the same `docker network` (generally, 'overlay' driver) and should not require exposing ports to the host directly.