rendered paste body# Generated by iptables-save v1.2.11 on Thu Aug 24 15:31:34 2006
*nat
:PREROUTING ACCEPT [1817097:172919018]
:POSTROUTING ACCEPT [417497:56993856]
:OUTPUT ACCEPT [207282:18837668]
-A PREROUTING -i eth1 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 10.0.10.2
-A POSTROUTING -s 10.0.10.0/255.255.255.0 -d ! 172.20.0.0/255.255.0.0 -o eth1 -j MASQUERADE
-A POSTROUTING -s 10.0.10.0/255.255.255.0 -d ! 172.20.0.0/255.255.0.0 -o eth2 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/255.0.0.0 -o eth1 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/255.0.0.0 -o eth2 -j MASQUERADE
-A POSTROUTING -s 10.0.10.0/255.255.255.0 -d ! 172.20.0.0/255.255.0.0 -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Aug 24 15:31:34 2006
# Generated by iptables-save v1.2.11 on Thu Aug 24 15:31:34 2006
*mangle
:PREROUTING ACCEPT [40415253:20952526973]
:INPUT ACCEPT [7208801:2614732104]
:FORWARD ACCEPT [33205096:18337571337]
:OUTPUT ACCEPT [4885597:2160537829]
:POSTROUTING ACCEPT [38141341:20671014577]
-A PREROUTING -s 216.x.x.214 -i eth2 -p ipv6-crypt -j MARK --set-mark 0x1
-A POSTROUTING -d 10.0.0.0/255.0.0.0 -o eth1 -j DROP
-A POSTROUTING -d 10.0.0.0/255.0.0.0 -o eth2 -j DROP
-A POSTROUTING -d 216.x.x.214 -o eth2 -p gre -j DROP
COMMIT
# Completed on Thu Aug 24 15:31:34 2006
# Generated by iptables-save v1.2.11 on Thu Aug 24 15:31:34 2006
*filter
:INPUT DROP [544005:73967001]
:FORWARD DROP [8588:1238767]
:OUTPUT ACCEPT [4885585:2160536782]
:dhcp-interfaces - [0:0]
:dns-interfaces - [0:0]
:inet_devices - [0:0]
:vnc-to-wireless - [0:0]
:wireless-printers - [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p udp -m udp --dport 67 -j dhcp-interfaces
-A INPUT -p udp -m udp --dport 53 -j dns-interfaces
-A INPUT -p tcp -m tcp --dport 53 -j dns-interfaces
-A INPUT -s 216.x.x.214 -i eth2 -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -s 216.x.x.214 -i eth2 -p ipv6-crypt -j ACCEPT
-A INPUT -s 216.x.x.214 -i eth2 -p gre -m mark --mark 0x1 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 123 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 113 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -p tcp -m tcp --dport 6660:6670 -j DROP
-A FORWARD -p udp -m udp --dport 8998 -j DROP
-A FORWARD -i eth0 -j inet_devices
-A FORWARD -i eth3 -j inet_devices
-A FORWARD -i eth0 -o corporate -j ACCEPT
-A FORWARD -i corporate -o eth0 -j ACCEPT
-A FORWARD -i eth3 -o eth0 -p tcp -m tcp --dport 515 -j wireless-printers
-A FORWARD -d 10.0.0.5 -i eth3 -o corporate -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -d 10.0.0.8 -i eth1 -o corporate -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -d 10.0.0.8 -i eth1 -o corporate -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -o eth3 -p tcp -m tcp --dport 5900 -j vnc-to-wireless
-A FORWARD -i eth0 -o eth0 -j ACCEPT
-A FORWARD -i eth3 -o eth3 -j ACCEPT
-A FORWARD -d 10.0.10.2 -i eth1 -p tcp -m tcp --dport 3389 -j ACCEPT
-A FORWARD -s 172.20.0.0/255.255.0.0 -d 10.0.10.0/255.255.255.0 -j ACCEPT
-A FORWARD -s 10.0.10.0/255.255.255.0 -d 172.20.0.0/255.255.0.0 -j ACCEPT
-A FORWARD -s 172.20.0.0/255.255.0.0 -d 10.2.10.0/255.255.255.0 -j ACCEPT
-A FORWARD -s 10.2.10.0/255.255.255.0 -d 172.20.0.0/255.255.0.0 -j ACCEPT
-A dhcp-interfaces -i eth0 -j ACCEPT
-A dhcp-interfaces -i eth3 -j ACCEPT
-A dhcp-interfaces -j RETURN
-A dns-interfaces -i eth0 -j ACCEPT
-A dns-interfaces -i eth3 -j ACCEPT
-A dns-interfaces -i corporate -j ACCEPT
-A dns-interfaces -j DROP
-A inet_devices -o eth1 -j ACCEPT
-A inet_devices -o eth2 -j ACCEPT
-A inet_devices -j RETURN
-A vnc-to-wireless -i eth0 -j ACCEPT
-A vnc-to-wireless -i corporate -j ACCEPT
-A vnc-to-wireless -j DROP
-A wireless-printers -d 10.0.10.129 -j ACCEPT
-A wireless-printers -d 10.0.10.131 -j ACCEPT
-A wireless-printers -j DROP
COMMIT