A firewall rule for a service that moved in 2023

A rule allowing a port from a specific address, for a service that had been containerised and moved two years earlier.

$ nft list ruleset | grep -c 'tcp dport'
14

$ for p in $(nft list ruleset | grep -oP 'tcp dport Kd+'); do
    ss -lntp "sport = :$p" | tail -n +2 | head -1 || echo "$p: nothing listening"
  done
  6379: nothing listening
  9200: nothing listening
  ...

# 4 of 14 rules allow traffic to ports with no listener.

A rule allowing traffic to a closed port is harmless today and is a rule that becomes wrong the moment something else binds that port. Cross-referencing the ruleset against what is actually listening is one loop and finds the drift, and it belongs in the same quarterly pass as the certificate scan.