Each individual of All those 3 answers have drawbacks, so you might want to very carefully think about, if you really need To accomplish this certain forwarding.
What I'd like to know, though, is whether or not we could block all ports in place of just a few. Would it do the job as envisioned with no --ctorigdstport? Then I'm able to open a few ports (positioning a number of policies just before this 1) if necessary after which you can have anything else blocked.
I've crafted a Docker picture that takes advantage of this process to quickly control the iptables for you, employing possibly surroundings variables 파라곤솔루션 or dynamically with etcd (or both of those)