17 lines
860 B
Bash
Executable File
17 lines
860 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Restrict only this stack's published LAN ports, not SSH or other containers.
|
|
set -euo pipefail
|
|
source /etc/host-metrics-access.conf
|
|
iptables -w 5 -N DOCKER-USER 2>/dev/null || iptables -w 5 -S DOCKER-USER >/dev/null
|
|
iptables -w 5 -N HOST-METRICS-ACCESS 2>/dev/null || iptables -w 5 -F HOST-METRICS-ACCESS
|
|
for port in 4900 5601 9090 9092 9200 9273; do
|
|
iptables -w 5 -A HOST-METRICS-ACCESS -p tcp -s "$WORKSTATION_IP" \
|
|
-m conntrack --ctdir ORIGINAL --ctorigdst "$VM_LAN_IP" --ctorigdstport "$port" -j RETURN
|
|
iptables -w 5 -A HOST-METRICS-ACCESS -p tcp \
|
|
-m conntrack --ctdir ORIGINAL --ctorigdst "$VM_LAN_IP" --ctorigdstport "$port" -j DROP
|
|
done
|
|
iptables -w 5 -A HOST-METRICS-ACCESS -j RETURN
|
|
if ! iptables -w 5 -C DOCKER-USER -j HOST-METRICS-ACCESS 2>/dev/null; then
|
|
iptables -w 5 -I DOCKER-USER 1 -j HOST-METRICS-ACCESS
|
|
fi
|