How to restrict a Wireguard Client access to a single port (WG-Easy)

WireguardClientPortRestrict

1. Make a shell script in the same path as compose with the following:
#!/bin/sh
iptables -A FORWARD -i wg0 -s CLIENTIPHERE -p tcp -d SERVICEIPHERE --dport SERVICEPORTHERE -j ACCEPT
iptables -A FORWARD -i wg0 -s CLIENTIPHERE -j DROP

exec /usr/bin/dumb-init node server/index.mjs

2. Change CLIENTIPHERE, SERVICEIPHERE and SERVICEPORTHERE to match your setup

3. chmod +x the shell script

4. Add the script to the WG-Easy compose Volumes section: 
- ./SHELLSCRIPTNAME.sh:/app/SHELLSCRIPTNAME.sh

5. Add the script to the WG-Easy compose entrypoint: 
entrypoint: ["/app/SHELLSCRIPTNAME.sh"]

6. Test and Enjoy