gti
d21a9d1140
git-subtree-dir: fiscal git-subtree-mainline:d95165fc8fgit-subtree-split:102ba84500
24 lines
1.3 KiB
Bash
24 lines
1.3 KiB
Bash
#!/usr/bin/env sh
|
|
# Restrict the published Hub port so that only the reverse proxy host reaches it.
|
|
#
|
|
# HUB_BIND=10.0.10.117 HUB_PORT=8000 PROXY_IP=10.0.10.100 IFACE=ens18 sh restrict_hub_port.sh
|
|
#
|
|
# Docker-published ports never pass through UFW/INPUT: the packets are DNATed
|
|
# and forwarded, so the only supported place for this rule is DOCKER-USER.
|
|
# Matching on the conntrack *original* destination selects this published port
|
|
# (after DNAT the packet already points at the container); --ctdir ORIGINAL keeps
|
|
# the container's replies out of the DROP rule. Idempotent: safe to re-run.
|
|
# DOCKER-USER is not persisted across reboots — gti-fiscal-hub-port.service
|
|
# re-applies it every time docker.service starts.
|
|
set -eu
|
|
: "${HUB_BIND:?HUB_BIND is required}" "${PROXY_IP:?PROXY_IP is required}" "${IFACE:?IFACE is required}"
|
|
HUB_PORT="${HUB_PORT:-8000}"
|
|
MATCH="-i $IFACE -p tcp -m conntrack --ctdir ORIGINAL --ctorigdst $HUB_BIND --ctorigdstport $HUB_PORT"
|
|
|
|
iptables -N DOCKER-USER 2>/dev/null || true
|
|
while iptables -D DOCKER-USER $MATCH -s "$PROXY_IP" -j RETURN 2>/dev/null; do :; done
|
|
while iptables -D DOCKER-USER $MATCH -j DROP 2>/dev/null; do :; done
|
|
iptables -I DOCKER-USER 1 $MATCH -j DROP
|
|
iptables -I DOCKER-USER 1 $MATCH -s "$PROXY_IP" -j RETURN
|
|
iptables -S DOCKER-USER
|