rendered paste body# Generated by iptables-save v1.2.11 on Thu Jul 28 13:17:42 2005
*filter
:tcp_outbound - [0:0]
:INPUT DROP [0:0]
:udp_inbound - [0:0]
:OUTPUT DROP [0:0]
:bad_packets - [0:0]
:FORWARD DROP [0:0]
:ssh_brute - [0:0]
:udp_outbound - [0:0]
:icmp_packets - [0:0]
:bad_tcp_packets - [0:0]
:tcp_inbound - [0:0]
-A INPUT -i eth0 -j LOG --log-prefix "BANDWIDTH_IN:" --log-level 7
-A INPUT -i lo -j ACCEPT
-A INPUT -j bad_packets
-A INPUT -d 224.0.0.1 -j DROP
-A INPUT -d 192.168.0.0/255.255.0.0 -j DROP
-A INPUT -d 192.168.1.1 -j DROP
-A INPUT -s 192.168.1.1/255.255.255.0 -j DROP
-A INPUT -s 10.10.6.0/255.255.255.0 -i eth1 -j ACCEPT
-A INPUT -d 10.10.6.255 -i eth1 -j ACCEPT
-A INPUT -m state -i eth0 --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -i eth0 -j tcp_inbound
-A INPUT -p udp -i eth0 -j udp_inbound
-A INPUT -p icmp -i eth0 -j icmp_packets
-A INPUT -d 255.255.255.255 -j DROP
-A FORWARD -o eth0 -j LOG --log-prefix "BANDWIDTH_OUT:" --log-level 7
-A FORWARD -i eth0 -j LOG --log-prefix "BANDWIDTH_IN:" --log-level 7
-A FORWARD -j bad_packets
-A FORWARD -p tcp -i eth1 -j tcp_outbound
-A FORWARD -p udp -i eth1 -j udp_outbound
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -m state -i eth0 --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -j LOG --log-prefix "BANDWIDTH_OUT:" --log-level 7
-A OUTPUT -p icmp -m state --state INVALID -j DROP
-A OUTPUT -s 127.0.0.1 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s 10.10.6.1 -j ACCEPT
-A OUTPUT -o eth1 -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT
-A bad_packets -m state --state INVALID -j DROP
-A bad_packets -p tcp -j bad_tcp_packets
-A bad_packets -j RETURN
-A bad_tcp_packets -p tcp -i eth1 -j RETURN
-A bad_tcp_packets -p tcp -m tcp -m state ! --tcp-flags SYN,RST,ACK SYN --state NEW -j DROP
-A bad_tcp_packets -p tcp -j RETURN
-A icmp_packets -p icmp -f -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A icmp_packets -p icmp -j RETURN
-A ssh_brute -m recent --set --name SSH --rsource
-A ssh_brute -m recent -j RETURN ! --rcheck --seconds 60 --hitcount 4 --name SSH --rsource
-A ssh_brute -m limit --limit 3/min -j LOG --log-prefix "SSH Brute Force Attempt: "
-A ssh_brute -p tcp -j REJECT --reject-with icmp-port-unreachable
-A tcp_inbound -p tcp -m tcp --dport 113 -j REJECT --reject-with icmp-port-unreachable
-A tcp_inbound -p tcp -m tcp --dport 80 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 443 -j ACCEPT
-A tcp_inbound -p tcp -m tcp -m state -i eth0 --state NEW -j ssh_brute
-A tcp_inbound -p tcp -m tcp --dport 22 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 10000 -j ACCEPT
-A tcp_inbound -p tcp -j RETURN
-A tcp_outbound -p tcp -j ACCEPT
-A udp_inbound -p udp -m udp --dport 137 -j DROP
-A udp_inbound -p udp -m udp --dport 138 -j DROP
-A udp_inbound -p udp -m udp --dport 113 -j REJECT --reject-with icmp-port-unreachable
-A udp_inbound -p udp -m udp --dport 123 -j ACCEPT
-A udp_inbound -p udp -m udp --dport 68 --sport 67 -j ACCEPT
-A udp_inbound -p udp -j RETURN
-A udp_outbound -p udp -j ACCEPT
COMMIT
# Completed on Thu Jul 28 13:17:42 2005
# Generated by iptables-save v1.2.11 on Thu Jul 28 13:17:42 2005
*mangle
:PREROUTING ACCEPT [2457:1930535]
:INPUT ACCEPT [2348:1906295]
:FORWARD ACCEPT [109:24240]
:OUTPUT ACCEPT [2505:409814]
:POSTROUTING ACCEPT [2614:434054]
COMMIT
# Completed on Thu Jul 28 13:17:42 2005
# Generated by iptables-save v1.2.11 on Thu Jul 28 13:17:42 2005
*nat
:PREROUTING ACCEPT [15:1472]
:POSTROUTING ACCEPT [155:9526]
:OUTPUT ACCEPT [155:9526]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Jul 28 13:17:42 2005
# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
LOG all -- anywhere anywhere LOG level debug prefix `BANDWIDTH_IN:'
ACCEPT all -- anywhere anywhere
bad_packets all -- anywhere anywhere
DROP all -- anywhere ALL-SYSTEMS.MCAST.NET
DROP all -- anywhere 192.168.0.0/16
DROP all -- anywhere 192.168.1.1
DROP all -- 192.168.1.0/24 anywhere
ACCEPT all -- localnet/24 anywhere
ACCEPT all -- anywhere 10.10.6.255
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
tcp_inbound tcp -- anywhere anywhere
udp_inbound udp -- anywhere anywhere
icmp_packets icmp -- anywhere anywhere
DROP all -- anywhere 255.255.255.255
Chain FORWARD (policy DROP)
target prot opt source destination
LOG all -- anywhere anywhere LOG level debug prefix `BANDWIDTH_OUT:'
LOG all -- anywhere anywhere LOG level debug prefix `BANDWIDTH_IN:'
bad_packets all -- anywhere anywhere
tcp_outbound tcp -- anywhere anywhere
udp_outbound udp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Chain OUTPUT (policy DROP)
target prot opt source destination
LOG all -- anywhere anywhere LOG level debug prefix `BANDWIDTH_OUT:'
DROP icmp -- anywhere anywhere state INVALID
ACCEPT all -- localhost anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- kin-gw.office.mwater.ca anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain bad_packets (2 references)
target prot opt source destination
DROP all -- anywhere anywhere state INVALID
bad_tcp_packets tcp -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain bad_tcp_packets (1 references)
target prot opt source destination
RETURN tcp -- anywhere anywhere
DROP tcp -- anywhere anywhere tcp flags:!SYN,RST,ACK/SYN state NEW
RETURN tcp -- anywhere anywhere
Chain icmp_packets (1 references)
target prot opt source destination
DROP icmp -f anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp echo-request
DROP icmp -- anywhere anywhere icmp echo-request
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
RETURN icmp -- anywhere anywhere
Chain ssh_brute (1 references)
target prot opt source destination
all -- anywhere anywhere recent: SET name: SSH side: source
RETURN all -- anywhere anywhere !recent: CHECK seconds: 60 hit_count: 4 name: SSHside: source
LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix`SSH Brute Force Attempt: '
REJECT tcp -- anywhere anywhere reject-with icmp-port-unreachable
Chain tcp_inbound (1 references)
target prot opt source destination
REJECT tcp -- anywhere anywhere tcp dpt:auth reject-with icmp-port-unreachable
ACCEPT tcp -- anywhere anywhere tcp dpt:www
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ssh_brute tcp -- anywhere anywhere tcp state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:10000
RETURN tcp -- anywhere anywhere
Chain tcp_outbound (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere
Chain udp_inbound (1 references)
target prot opt source destination
DROP udp -- anywhere anywhere udp dpt:netbios-ns
DROP udp -- anywhere anywhere udp dpt:netbios-dgm
REJECT udp -- anywhere anywhere udp dpt:113 reject-with icmp-port-unreachable
ACCEPT udp -- anywhere anywhere udp dpt:ntp
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
RETURN udp -- anywhere anywhere
Chain udp_outbound (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere