[Unit]
Description=Restringir puerto 2222 a IPs autorizadas
After=docker.service
Requires=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/sbin/ipset create -exist sftp_allowed hash:ip
ExecStart=/sbin/ipset add -exist sftp_allowed 88.26.243.132
ExecStart=/sbin/ipset add -exist sftp_allowed 203.0.113.10
ExecStart=/sbin/iptables -I DOCKER-USER -i eth0 -p tcp -m conntrack --ctorigdstport 2222 --ctdir ORIGINAL -m set ! --match-set sftp_allowed src -j DROP
ExecStop=/sbin/iptables -D DOCKER-USER -i eth0 -p tcp -m conntrack --ctorigdstport 2222 --ctdir ORIGINAL -m set ! --match-set sftp_allowed src -j DROP
ExecStop=/sbin/ipset destroy sftp_allowed

[Install]
WantedBy=multi-user.target