rendered paste body# Generated by iptables-save v1.3.2 on Tue Oct 25 20:16:23 2005
*mangle
:PREROUTING ACCEPT [5428:428081]
:INPUT ACCEPT [5275:391537]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [27944:5739033]
:POSTROUTING ACCEPT [27924:5736953]
COMMIT
# Completed on Tue Oct 25 20:16:23 2005
# Generated by iptables-save v1.3.2 on Tue Oct 25 20:16:23 2005
*filter
:ACCEPT_ALL - [0:0]
:BADTCP - [0:0]
:BLUEINPUT - [0:0]
:CUSTOMFORWARD - [0:0]
:CUSTOMINPUT - [0:0]
:CUSTOMOUTPUT - [0:0]
:DHCPBLUEINPUT - [0:0]
:DMZHOLES - [0:0]
:INPUT DROP [8:706]
:FORWARD DROP [0:0]
:IPSECBLUE - [0:0]
:IPSECRED - [0:0]
:LOG_DROP - [0:0]
:LOG_REJECT - [0:0]
:NEWNOTSYN - [0:0]
:OPENVPN - [0:0]
:ORANGEINPUT - [0:0]
:OUTGOINGFW - [0:0]
:OUTPUT ACCEPT [27925:5737105]
:PORTFWACCESS - [0:0]
:PSCAN - [0:0]
:REDINPUT - [0:0]
:SIPROXD - [0:0]
:XTACCESS - [0:0]
:ipac~fi - [0:0]
:ipac~fo - [0:0]
:ipac~i - [0:0]
:ipac~o - [0:0]
-A ACCEPT_ALL -i br0 -o ! ppp0 -m state --state NEW -j ACCEPT
-A ACCEPT_ALL -i ipsec+ -o ! ppp0 -j ACCEPT
-A ACCEPT_ALL -o ppp0 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j PSCAN
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j PSCAN
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j PSCAN
-A BADTCP -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j PSCAN
-A BADTCP -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j NEWNOTSYN
-A INPUT -j ipac~o
-A INPUT -j BADTCP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec
-A INPUT -j CUSTOMINPUT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -s 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
-A INPUT -d 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
-A INPUT -i br0 -p ! icmp -m state --state NEW -j ACCEPT
-A INPUT -i ipsec+ -j ACCEPT
-A INPUT -p ! icmp -m state --state NEW -j BLUEINPUT
-A INPUT -p ! icmp -m state --state NEW -j ORANGEINPUT
-A INPUT -m state --state NEW -j OUTGOINGFW
-A INPUT -j DHCPBLUEINPUT
-A INPUT -m state --state NEW -j OPENVPN
-A INPUT -j IPSECRED
-A INPUT -j IPSECBLUE
-A INPUT -j REDINPUT
-A INPUT -m state --state NEW -j XTACCESS
-A INPUT -m limit --limit 10/min -j LOG --log-prefix "INPUT "
-A FORWARD -j ipac~fi
-A FORWARD -j ipac~fo
-A FORWARD -j BADTCP
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -j CUSTOMFORWARD
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -m state --state NEW -j ACCEPT
-A FORWARD -s 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
-A FORWARD -d 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
-A FORWARD -j ACCEPT_ALL
-A FORWARD -m state --state NEW -j OUTGOINGFW
-A FORWARD -m state --state NEW -j OPENVPN
-A FORWARD -m state --state NEW -j DMZHOLES
-A FORWARD -m state --state NEW -j PORTFWACCESS
-A FORWARD -m limit --limit 10/min -j LOG --log-prefix "FORWARD "
-A LOG_DROP -m limit --limit 10/min -j LOG
-A LOG_DROP -j DROP
-A LOG_REJECT -m limit --limit 10/min -j LOG
-A LOG_REJECT -j REJECT --reject-with icmp-port-unreachable
-A NEWNOTSYN -m limit --limit 10/min -j LOG --log-prefix "NEW not SYN? "
-A NEWNOTSYN -j DROP
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 20 -j ACCEPT
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 110 -j ACCEPT
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 143 -j ACCEPT
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTGOINGFW -i br0 -o ppp0 -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -j ipac~i
-A OUTPUT -j CUSTOMOUTPUT
-A PSCAN -p tcp -m limit --limit 10/min -j LOG --log-prefix "TCP Scan? "
-A PSCAN -p udp -m limit --limit 10/min -j LOG --log-prefix "UDP Scan? "
-A PSCAN -p icmp -m limit --limit 10/min -j LOG --log-prefix "ICMP Scan? "
-A PSCAN -f -m limit --limit 10/min -j LOG --log-prefix "FRAG Scan? "
-A PSCAN -j DROP
-A REDINPUT -i eth3 -j ACCEPT
-A REDINPUT -i eth3 -j ACCEPT
-A XTACCESS -d 85.124.37.74 -i ppp0 -p tcp -m tcp --dport 113 -j ACCEPT
-A ipac~fi -i br0
-A ipac~fi -i ppp0
-A ipac~fo -o br0
-A ipac~fo -o ppp0
-A ipac~i -o br0
-A ipac~i -o ppp0
-A ipac~o -i br0
-A ipac~o -i ppp0
COMMIT
# Completed on Tue Oct 25 20:16:23 2005
# Generated by iptables-save v1.3.2 on Tue Oct 25 20:16:23 2005
*nat
:CONTENTFILTER - [0:0]
:CUSTOMPOSTROUTING - [0:0]
:CUSTOMPREROUTING - [0:0]
:ORANGENAT - [0:0]
:PORTFW - [0:0]
:POSTPORTFW - [0:0]
:PREROUTING ACCEPT [291:45998]
:POSTROUTING ACCEPT [3:197]
:OUTPUT ACCEPT [8:548]
:REDNAT - [0:0]
:SIPROXDPORTFW - [0:0]
:SQUID - [0:0]
-A PREROUTING -j CUSTOMPREROUTING
-A PREROUTING -j SIPROXDPORTFW
-A PREROUTING -j CONTENTFILTER
-A PREROUTING -j SQUID
-A PREROUTING -j PORTFW
-A POSTROUTING -j CUSTOMPOSTROUTING
-A POSTROUTING -j ORANGENAT
-A POSTROUTING -j REDNAT
-A POSTROUTING -j POSTPORTFW
-A REDNAT -o ppp0 -j MASQUERADE
COMMIT
# Completed on Tue Oct 25 20:16:23 2005