I would like to filter who can connect to the port I have bound to the host. But it seems that this is non-trivial to do with Docker. The reason is that it adds NAT rules into FORWARDing iptables table, so DROP inside INPUT does not match. One cannot DROP in PREROUTING, and after FORWARD table port is not the same as it is outside, but it is already mapped to the internal port. I would like to use external port so that if I change internals, outside firewall rules do not have to change.