rendered paste body
$ iptables-save # ON FIREWALL
# Generated by iptables-save v1.3.5 on Tue Sep 12 17:33:12 2006
*nat
:PREROUTING ACCEPT [3719:229334]
:POSTROUTING ACCEPT [6226:1191889]
:OUTPUT ACCEPT [13190:2505518]
-A PREROUTING -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.0.0.2
-A PREROUTING -p tcp -m tcp --dport 11234 -j DNAT --to-destination 10.0.0.2
-A PREROUTING -p tcp -m tcp --dport 6881:6889 -j DNAT --to-destination
10.0.0.2:6881-6889
-A PREROUTING -p tcp -m tcp --dport 21 -j DNAT --to-destination 10.0.0.6
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/255.255.255.248 -d 10.0.0.0/255.255.255.248 -p tcp
-m tcp --dport 25 -j SNAT --to-source 10.0.0.1
-A POSTROUTING -s 10.0.0.0/255.255.255.248 -d 10.0.0.0/255.255.255.248 -p tcp
-m tcp --dport 11234 -j SNAT --to-source 10.0.0.1
-A POSTROUTING -s 10.0.0.0/255.255.255.248 -d 10.0.0.0/255.255.255.248 -p tcp
-m tcp --dport 6881:6889 -j SNAT --to-source 10.0.0.1
-A POSTROUTING -s 10.0.0.0/255.255.255.248 -d 10.0.0.0/255.255.255.248 -o eth1
-p tcp -m tcp --dport 21 -j SNAT --to-source 10.0.0.1
COMMIT
# Completed on Tue Sep 12 17:33:12 2006
# Generated by iptables-save v1.3.5 on Tue Sep 12 17:33:12 2006
*filter
:INPUT DROP [1:222]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:Flood-Scan - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j DROP
-A INPUT -i eth1 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j Flood-Scan
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack
--ctstate NEW -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate RELATED -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.0.0.0/255.255.255.248 -i eth1 -p udp -m udp --dport 53 -j
ACCEPT
-A INPUT -s 10.0.0.0/255.255.255.248 -i eth1 -p udp -m udp --dport 67 -j
ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s 10.0.0.0/255.255.255.248 -i eth1 -p tcp -m tcp --dport 631 -j
ACCEPT
-A INPUT -s 10.0.0.0/255.255.255.248 -i eth1 -p udp -m udp --dport 631 -j
ACCEPT
-A INPUT -s 10.0.0.0/255.255.255.248 -p tcp -m tcp --dport 3632 -j ACCEPT
-A INPUT -s 10.0.0.0/255.255.255.248 -i eth1 -p tcp -m tcp --dport 10000 -j
ACCEPT
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -o eth1 -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -i eth0 -o eth0 -j DROP
-A FORWARD -d 10.0.0.2 -i eth0 -o eth1 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -d 10.0.0.2 -i eth0 -o eth1 -p tcp -m tcp --dport 11234 -j ACCEPT
-A FORWARD -d 10.0.0.2 -i eth0 -o eth1 -p tcp -m tcp --dport 6881:6889 -j
ACCEPT
-A FORWARD -d 10.0.0.6 -i eth0 -o eth1 -p tcp -m tcp --dport 20:21 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth1 -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT
-A Flood-Scan -m limit --limit 20/sec --limit-burst 10 -j RETURN
-A Flood-Scan -j LOG --log-prefix "OVER-LIMIT: "
-A Flood-Scan -j DROP
COMMIT
# Completed on Tue Sep 12 17:33:12 2006
$ lsmod # ON FIREWALL
Module Size Used by
shfs 40336 1
ipt_MASQUERADE 2688 1
ip_nat_ftp 2688 0
ip_conntrack_ftp 6128 1 ip_nat_ftp
xt_state 1920 1
xt_conntrack 2304 4
ipt_LOG 5504 1
xt_limit 2432 1
xt_tcpudp 3072 23
iptable_nat 5380 1
ip_nat 13356 3 ipt_MASQUERADE,ip_nat_ftp,iptable_nat
iptable_filter 2432 1
ip_tables 11100 2 iptable_nat,iptable_filter
x_tables 10244 8
ipt_MASQUERADE,xt_state,xt_conntrack,ipt_LOG,xt_limit,xt_tcpudp,iptable_nat,ip_tables
nfsd 78568 13
exportfs 4480 1 nfsd
lockd 50440 2 nfsd
sunrpc 122556 9 nfsd,lockd
reiserfs 188912 3
snd_ens1371 18432 0
snd_rawmidi 17952 1 snd_ens1371
snd_seq_device 6028 1 snd_rawmidi
snd_ac97_codec 79392 1 snd_ens1371
snd_ac97_bus 2176 1 snd_ac97_codec
snd_pcm 68356 2 snd_ens1371,snd_ac97_codec
nvidia 4545492 12
intel_agp 18332 1
snd_timer 18180 1 snd_pcm
snd 41188 6
snd_ens1371,snd_rawmidi,snd_seq_device,snd_ac97_codec,snd_pcm,snd_timer
agpgart 26060 2 nvidia,intel_agp
ohci1394 27696 0
snd_page_alloc 7304 1 snd_pcm
$ ftp domain.com # FROM INTERNAL AUXBOX TO DOMAINNAME (
RESOLVES TO INTERNAL FIREWALL )
Connected to domain.com (10.0.0.1).
220 Bahave!
Name (domain.com:user): ftpuser
234 Proceed with negotiation.
[SSL Cipher DES-CBC3-SHA]
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
500 Illegal PORT command.
ftp: bind: Address already in use
ftp>
$ ftp ftpserver # FROM INTERNAL AUXBOX TO FTP SERVER
Connected to ftpserver (10.0.0.6).
220 Bahave!
Name (ftpserver:user): ftpuser
234 Proceed with negotiation.
[SSL Cipher DES-CBC3-SHA]
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-x--- 2 1001 21 4096 Sep 12 05:32 Directory
226 Directory send OK.
ftp> QUIT
?Invalid command
ftp> quit
221 Goodbye.
# cat /etc/vsftpd/vsftpd.conf # ON FTP SERVER
# /etc/vsftpd/vsftpd.conf
listen=YES
# SSL Opts
ssl_enable=YES
allow_anon_ssl=NO
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
# General
anonymous_enable=NO
local_enable=YES
write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
chown_uploads=NO
idle_session_timeout=600
data_connection_timeout=120
ascii_upload_enable=NO
ascii_download_enable=NO
ftpd_banner=Bahave!
chroot_list_enable=YES
ls_recurse_enable=NO
# Passive
pasv_enable=YES
pasv_address=domain.com
pasv_addr_resolve=YES
#tcp_wrappers=YES
#userlist_file=/etc/vsftpd/user_list
#userlist_enable=YES
# iptables-save # FTP SERVER
# Generated by iptables-save v1.3.5 on Tue Sep 12 19:48:12 2006
*nat
:PREROUTING ACCEPT [26614:4101229]
:POSTROUTING ACCEPT [221:13585]
:OUTPUT ACCEPT [221:13585]
COMMIT
# Completed on Tue Sep 12 19:48:12 2006
# Generated by iptables-save v1.3.5 on Tue Sep 12 19:48:12 2006
*filter
:INPUT DROP [17527:3591636]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:Flood-Scan - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j Flood-Scan
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack
--ctstate NEW -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate RELATED -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 20 --dport 1024:65535 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT
-A Flood-Scan -m limit --limit 3/sec --limit-burst 10 -j RETURN
-A Flood-Scan -j LOG --log-prefix "OVER-LIMIT: "
-A Flood-Scan -j DROP
COMMIT
# Completed on Tue Sep 12 19:48:12 2006