This deploy uses two containers:

- `router` is the user-facing machine. Participants connect to `R3` and add `iptables` rules there.
- `checker` is a separate verifier. It does not expose a shell and only validates the firewall behavior.

Inside `router`, the lab topology is created with Linux network namespaces:

- `allowed` namespace: `203.0.113.6`
- `denied` namespace: `203.0.113.7`
- `router` namespace: public `203.0.113.2`, internal `192.168.10.1`
- `server` namespace: `192.168.10.10`

Run locally:

```bash
cd deploy
docker compose up --build
```

Connect:

```bash
ssh steve@localhost -p 2230
```

Password:

```text
pass123
```

Inside `router`, add the candidate rule and then run:

```bash
iptables -t nat -A PREROUTING -p tcp -s 203.0.113.6/32 -d 203.0.113.2 --dport 443 -j DNAT --to-destination 192.168.10.10:443
python3 /opt/router/check_rule.py
```

What the checker validates:

- `203.0.113.6 -> 203.0.113.2:443/tcp` must work
- `203.0.113.7 -> 203.0.113.2:443/tcp` must fail
