SPA is essentially next generation Port Knocking (PK), but solves many of the limitations exhibited by PK while retaining its core benefits.

PK limitations include a general difficulty in protecting against replay attacks, asymmetric ciphers and HMAC schemes are not usually possible to reliably support, and it is trivially easy to mount a DoS attack against a PK server just by spoofing an additional packet into a PK sequence as it traverses the network (thereby convincing the PK server that the client doesn't know the proper sequence).

All of these shortcomings are solved by SPA. At the same time, SPA hides services behind a default-drop firewall policy, acquires SPA data passively (usually via libpcap or other means), and implements standard cryptographic operations for SPA packet authentication and encryption/decryption.

@service header_regexp Host subdomain\..*
handle @service {
    reverse_proxy http://container:port
}

map {host}             {service}  {
    ~(.+)(?:\..+){2}$  "${1}"
}

@service vars {service} subdomain
handle @service {
    reverse_proxy http://container:port
}

ufw logging <off|low|medium|high|full>
journalctl -o cat -k -f

[1] # cust-ssh
To      XXXX/tcp on eth0
Action  LIMIT IN
From    Anywhere

[2] # docker-to-host
To      172.17.0.0/24
Action  DENY IN
From    172.0.0.0/8

[3] # docker-to-world
To      Anywhere
Action  ALLOW IN
From    172.0.0.0/8

[4] # cust-ssh
To      XXXX/tcp (v6) on eth0
Action  LIMIT IN
From    Anywhere (v6)