#!/bin/sh
# nisse-firewall ADDRESS PORT: only ADDRESS may reach a port Docker publishes
# as PORT. Docker publishes ports past the host's own firewall rules, so the
# limit goes in its DOCKER-USER chain. Installed by setup.sh and run by
# nisse-firewall.service whenever Docker starts. Its own rules (tagged) are
# replaced each run, so a changed address leaves no old rule behind.
set -eu
address=$1 port=$2
iptables -S DOCKER-USER | grep -- '--comment nisse-firewall' | sed 's/^-A /-D /' |
  while read -r old; do eval "iptables $old"; done
iptables -I DOCKER-USER -p tcp -m conntrack --ctorigdstport "$port" \
  --ctdir ORIGINAL ! -s "$address" -m comment --comment nisse-firewall -j DROP