Citation :
# Generated by iptables-save v1.2.9 on Fri Mar 4 01:52:13 2005
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:all2all - [0:0]
:common - [0:0]
:dynamic - [0:0]
:eth0_fwd - [0:0]
:eth0_in - [0:0]
:eth1_fwd - [0:0]
:eth1_in - [0:0]
:fw2net - [0:0]
:icmpdef - [0:0]
:loc2fw - [0:0]
:loc2net - [0:0]
:net2all - [0:0]
:net2fw - [0:0]
:newnotsyn - [0:0]
:reject - [0:0]
:shorewall - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p ! icmp -m state --state INVALID -j DROP
-A INPUT -i eth0 -j eth0_in
-A INPUT -i eth1 -j eth1_in
-A INPUT -j common
-A INPUT -j LOG --log-prefix "Shorewall:INPUT:REJECT:" --log-level 6
-A INPUT -j reject
-A FORWARD -p ! icmp -m state --state INVALID -j DROP
-A FORWARD -i eth0 -j eth0_fwd
-A FORWARD -i eth1 -j eth1_fwd
-A FORWARD -j common
-A FORWARD -j LOG --log-prefix "Shorewall:FORWARD:REJECT:" --log-level 6
-A FORWARD -j reject
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p ! icmp -m state --state INVALID -j DROP
-A OUTPUT -o eth0 -j fw2net
-A OUTPUT -o eth1 -j all2all
-A OUTPUT -j common
-A OUTPUT -j LOG --log-prefix "Shorewall:OUTPUT:REJECT:" --log-level 6
-A OUTPUT -j reject
-A all2all -m state --state RELATED,ESTABLISHED -j ACCEPT
-A all2all -p tcp -m state --state NEW -m tcp ! --tcp-flags SYN,RST,ACK SYN -j newnotsyn
-A all2all -j common
-A all2all -j LOG --log-prefix "Shorewall:all2all:REJECT:" --log-level 6
-A all2all -j reject
-A common -p icmp -j icmpdef
-A common -p udp -m udp --dport 135 -j reject
-A common -p udp -m udp --dport 137:139 -j reject
-A common -p udp -m udp --dport 445 -j reject
-A common -p tcp -m tcp --dport 139 -j reject
-A common -p tcp -m tcp --dport 445 -j reject
-A common -p tcp -m tcp --dport 135 -j reject
-A common -p udp -m udp --dport 1900 -j DROP
-A common -d 255.255.255.255 -j DROP
-A common -d 224.0.0.0/240.0.0.0 -j DROP
-A common -p tcp -m tcp --dport 113 -j reject
-A common -p udp -m udp --sport 53 -m state --state NEW -j DROP
-A eth0_fwd -m state --state NEW -j dynamic
-A eth0_fwd -o eth1 -j net2all
-A eth0_in -m state --state NEW -j dynamic
-A eth0_in -j net2fw
-A eth1_fwd -m state --state NEW -j dynamic
-A eth1_fwd -o eth0 -j loc2net
-A eth1_in -m state --state NEW -j dynamic
-A eth1_in -j loc2fw
-A fw2net -m state --state RELATED,ESTABLISHED -j ACCEPT
-A fw2net -p tcp -m state --state NEW -m tcp ! --tcp-flags SYN,RST,ACK SYN -j newnotsyn
-A fw2net -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A fw2net -j ACCEPT
-A loc2fw -m state --state RELATED,ESTABLISHED -j ACCEPT
-A loc2fw -p tcp -m state --state NEW -m tcp ! --tcp-flags SYN,RST,ACK SYN -j newnotsyn
-A loc2fw -p udp -m multiport --dports 137,138,139 -m state --state NEW -j ACCEPT
-A loc2fw -p tcp -m multiport --dports 80,443,22,20,21,23,137,138,139 -m state --state NEW -j ACCEPT
-A loc2fw -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A loc2fw -p tcp -m state --state NEW -m tcp --dport 3128 -j ACCEPT
-A loc2fw -j all2all
-A loc2net -m state --state RELATED,ESTABLISHED -j ACCEPT
-A loc2net -p tcp -m state --state NEW -m tcp ! --tcp-flags SYN,RST,ACK SYN -j newnotsyn
-A loc2net -j ACCEPT
-A net2all -m state --state RELATED,ESTABLISHED -j ACCEPT
-A net2all -p tcp -m state --state NEW -m tcp ! --tcp-flags SYN,RST,ACK SYN -j newnotsyn
-A net2all -j common
-A net2all -j LOG --log-prefix "Shorewall:net2all:DROP:" --log-level 6
-A net2all -j DROP
-A net2fw -m state --state RELATED,ESTABLISHED -j ACCEPT
-A net2fw -p tcp -m state --state NEW -m tcp ! --tcp-flags SYN,RST,ACK SYN -j newnotsyn
-A net2fw -p udp -m multiport --dports 137,138,139 -m state --state NEW -j ACCEPT
-A net2fw -p tcp -m multiport --dports 80,443,22,20,21,23,137,138,139 -m state --state NEW -j ACCEPT
-A net2fw -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A net2fw -j net2all
-A newnotsyn -j LOG --log-prefix "Shorewall:newnotsyn:DROP:" --log-level 6
-A newnotsyn -j DROP
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A reject -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Fri Mar 4 01:52:13 2005
# Generated by iptables-save v1.2.9 on Fri Mar 4 01:52:13 2005
*mangle
:PREROUTING ACCEPT [24210:9040344]
:INPUT ACCEPT [23687:8865815]
:FORWARD ACCEPT [502:172266]
:OUTPUT ACCEPT [24952:8429822]
:POSTROUTING ACCEPT [25451:8608304]
:outtos - [0:0]
:pretos - [0:0]
-A PREROUTING -j pretos
-A OUTPUT -j outtos
-A outtos -p tcp -m tcp --dport 22 -j TOS --set-tos 0x10
-A outtos -p tcp -m tcp --sport 22 -j TOS --set-tos 0x10
-A outtos -p tcp -m tcp --dport 21 -j TOS --set-tos 0x10
-A outtos -p tcp -m tcp --sport 21 -j TOS --set-tos 0x10
-A outtos -p tcp -m tcp --sport 20 -j TOS --set-tos 0x08
-A outtos -p tcp -m tcp --dport 20 -j TOS --set-tos 0x08
-A pretos -p tcp -m tcp --dport 22 -j TOS --set-tos 0x10
-A pretos -p tcp -m tcp --sport 22 -j TOS --set-tos 0x10
-A pretos -p tcp -m tcp --dport 21 -j TOS --set-tos 0x10
-A pretos -p tcp -m tcp --sport 21 -j TOS --set-tos 0x10
-A pretos -p tcp -m tcp --sport 20 -j TOS --set-tos 0x08
-A pretos -p tcp -m tcp --dport 20 -j TOS --set-tos 0x08
COMMIT
# Completed on Fri Mar 4 01:52:13 2005
# Generated by iptables-save v1.2.9 on Fri Mar 4 01:52:13 2005
*nat
:PREROUTING ACCEPT [5020:362046]
:POSTROUTING ACCEPT [4545:209426]
:OUTPUT ACCEPT [993:77490]
:eth0_masq - [0:0]
:loc_dnat - [0:0]
-A PREROUTING -i eth1 -j loc_dnat
-A POSTROUTING -o eth0 -j eth0_masq
-A eth0_masq -s 192.168.0.0/255.255.255.0 -j MASQUERADE
-A loc_dnat -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
COMMIT
# Completed on Fri Mar 4 01:52:13 2005
|
