dev_agentandClaude Opus 5.5
63808ccd20
Restrict the published MealQuest port 8090 in DOCKER-USER to Traefik (10.60.1.33) and the Docker host (10.60.1.14), dropping all other sources. DOCKER-USER sees post-DNAT traffic, so rules match the original destination port with conntrack rather than --dport. A docker.service drop-in re-applies the rules after every docker restart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
22 lines
933 B
Bash
Executable File
22 lines
933 B
Bash
Executable File
#!/bin/sh
|
|
# Restrict the MealQuest published host port to Traefik (10.60.1.33) and the
|
|
# Docker host itself (10.60.1.14); drop every other source.
|
|
#
|
|
# DOCKER-USER runs after Docker's DNAT, so the destination port there is the
|
|
# container port (8080), not the published one. Match the original
|
|
# destination port with conntrack instead of --dport.
|
|
#
|
|
# Idempotent: each rule is checked (-C) before it is added, so re-runs add
|
|
# nothing. Installed as /usr/local/sbin/mealquest-firewall.
|
|
set -eu
|
|
|
|
port=8090
|
|
match="-p tcp -m conntrack --ctorigdstport $port --ctdir ORIGINAL"
|
|
|
|
iptables -C DOCKER-USER -s 10.60.1.33/32 $match -j RETURN 2>/dev/null ||
|
|
iptables -I DOCKER-USER 1 -s 10.60.1.33/32 $match -j RETURN
|
|
iptables -C DOCKER-USER -s 10.60.1.14/32 $match -j RETURN 2>/dev/null ||
|
|
iptables -I DOCKER-USER 2 -s 10.60.1.14/32 $match -j RETURN
|
|
iptables -C DOCKER-USER $match -j DROP 2>/dev/null ||
|
|
iptables -A DOCKER-USER $match -j DROP
|