rendered paste body# Generated by iptables-save v1.3.5 on Wed Dec 6 12:17:04 2006
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:in_dst-outside - [0:0]
:in_dst-outside_ICMP_s2 - [0:0]
:in_dst-outside_dns_c8 - [0:0]
:in_dst-outside_dns_s6 - [0:0]
:in_dst-outside_ftp_s1 - [0:0]
:in_dst-outside_http_c10 - [0:0]
:in_dst-outside_ntp_s3 - [0:0]
:in_dst-outside_smtp_c9 - [0:0]
:in_dst-outside_ssh_c7 - [0:0]
:in_dst-outside_ssh_s5 - [0:0]
:in_dst-outside_webmin_s4 - [0:0]
:in_dst-privateip - [0:0]
:in_dst-privateip_ICMP_s2 - [0:0]
:in_dst-privateip_dns_c8 - [0:0]
:in_dst-privateip_dns_s6 - [0:0]
:in_dst-privateip_ftp_s1 - [0:0]
:in_dst-privateip_http_c10 - [0:0]
:in_dst-privateip_ntp_s3 - [0:0]
:in_dst-privateip_smtp_c9 - [0:0]
:in_dst-privateip_ssh_c7 - [0:0]
:in_dst-privateip_ssh_s5 - [0:0]
:in_dst-privateip_webmin_s4 - [0:0]
:out_dst-outside - [0:0]
:out_dst-outside_ICMP_s2 - [0:0]
:out_dst-outside_dns_c8 - [0:0]
:out_dst-outside_dns_s6 - [0:0]
:out_dst-outside_ftp_s1 - [0:0]
:out_dst-outside_http_c10 - [0:0]
:out_dst-outside_ntp_s3 - [0:0]
:out_dst-outside_smtp_c9 - [0:0]
:out_dst-outside_ssh_c7 - [0:0]
:out_dst-outside_ssh_s5 - [0:0]
:out_dst-outside_webmin_s4 - [0:0]
:out_dst-privateip - [0:0]
:out_dst-privateip_ICMP_s2 - [0:0]
:out_dst-privateip_dns_c8 - [0:0]
:out_dst-privateip_dns_s6 - [0:0]
:out_dst-privateip_ftp_s1 - [0:0]
:out_dst-privateip_http_c10 - [0:0]
:out_dst-privateip_ntp_s3 - [0:0]
:out_dst-privateip_smtp_c9 - [0:0]
:out_dst-privateip_ssh_c7 - [0:0]
:out_dst-privateip_ssh_s5 - [0:0]
:out_dst-privateip_webmin_s4 - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 192.168.0.144 -i eth0 -j in_dst-privateip
-A INPUT -i eth0 -j in_dst-outside
-A INPUT -m state --state RELATED -j ACCEPT
-A INPUT -m limit --limit 1/sec -j LOG --log-prefix "'IN-unknown:'"
-A INPUT -j DROP
-A FORWARD -m state --state RELATED -j ACCEPT
-A FORWARD -m limit --limit 1/sec -j LOG --log-prefix "'PASS-unknown:'"
-A FORWARD -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s 192.168.0.144 -o eth0 -j out_dst-privateip
-A OUTPUT -o eth0 -j out_dst-outside
-A OUTPUT -m state --state RELATED -j ACCEPT
-A OUTPUT -m limit --limit 1/sec -j LOG --log-prefix "'OUT-unknown:'"
-A OUTPUT -j DROP
-A in_dst-outside -d 192.168.0.144 -j RETURN
-A in_dst-outside -j in_dst-outside_ftp_s1
-A in_dst-outside -j in_dst-outside_ICMP_s2
-A in_dst-outside -j in_dst-outside_ntp_s3
-A in_dst-outside -j in_dst-outside_webmin_s4
-A in_dst-outside -j in_dst-outside_ssh_s5
-A in_dst-outside -j in_dst-outside_dns_s6
-A in_dst-outside -j in_dst-outside_ssh_c7
-A in_dst-outside -j in_dst-outside_dns_c8
-A in_dst-outside -j in_dst-outside_smtp_c9
-A in_dst-outside -j in_dst-outside_http_c10
-A in_dst-outside -m state --state RELATED -j ACCEPT
-A in_dst-outside -m limit --limit 1/sec -j LOG --log-prefix "''IN-dst-outside':'"
-A in_dst-outside -j DROP
-A in_dst-outside_ICMP_s2 -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-outside_dns_c8 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-outside_dns_c8 -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-outside_dns_s6 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-outside_dns_s6 -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-outside_ftp_s1 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-outside_ftp_s1 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-outside_ftp_s1 -p tcp -m tcp --sport 1024:65535 --dport 32768:61000 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A in_dst-outside_http_c10 -p tcp -m tcp --sport 80 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-outside_ntp_s3 -p udp -m udp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-outside_ntp_s3 -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-outside_ntp_s3 -p tcp -m tcp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-outside_ntp_s3 -p tcp -m tcp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-outside_smtp_c9 -p tcp -m tcp --sport 25 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-outside_ssh_c7 -p tcp -m tcp --sport 22 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-outside_ssh_s5 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-outside_webmin_s4 -p tcp -m tcp --sport 1024:65535 --dport 10000 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-privateip -j in_dst-privateip_ftp_s1
-A in_dst-privateip -j in_dst-privateip_ICMP_s2
-A in_dst-privateip -j in_dst-privateip_ntp_s3
-A in_dst-privateip -j in_dst-privateip_webmin_s4
-A in_dst-privateip -j in_dst-privateip_ssh_s5
-A in_dst-privateip -j in_dst-privateip_dns_s6
-A in_dst-privateip -j in_dst-privateip_ssh_c7
-A in_dst-privateip -j in_dst-privateip_dns_c8
-A in_dst-privateip -j in_dst-privateip_smtp_c9
-A in_dst-privateip -j in_dst-privateip_http_c10
-A in_dst-privateip -m state --state RELATED -j ACCEPT
-A in_dst-privateip -m limit --limit 1/sec -j LOG --log-prefix "''IN-dst-privateip':'"
-A in_dst-privateip -j DROP
-A in_dst-privateip_ICMP_s2 -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-privateip_dns_c8 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-privateip_dns_c8 -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-privateip_dns_s6 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-privateip_dns_s6 -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-privateip_ftp_s1 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-privateip_ftp_s1 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-privateip_ftp_s1 -p tcp -m tcp --sport 1024:65535 --dport 32768:61000 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A in_dst-privateip_http_c10 -p tcp -m tcp --sport 80 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-privateip_ntp_s3 -p udp -m udp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-privateip_ntp_s3 -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-privateip_ntp_s3 -p tcp -m tcp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-privateip_ntp_s3 -p tcp -m tcp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-privateip_smtp_c9 -p tcp -m tcp --sport 25 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-privateip_ssh_c7 -p tcp -m tcp --sport 22 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT
-A in_dst-privateip_ssh_s5 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A in_dst-privateip_webmin_s4 -p tcp -m tcp --sport 1024:65535 --dport 10000 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-outside -s 192.168.0.144 -j RETURN
-A out_dst-outside -j out_dst-outside_ftp_s1
-A out_dst-outside -j out_dst-outside_ICMP_s2
-A out_dst-outside -j out_dst-outside_ntp_s3
-A out_dst-outside -j out_dst-outside_webmin_s4
-A out_dst-outside -j out_dst-outside_ssh_s5
-A out_dst-outside -j out_dst-outside_dns_s6
-A out_dst-outside -j out_dst-outside_ssh_c7
-A out_dst-outside -j out_dst-outside_dns_c8
-A out_dst-outside -j out_dst-outside_smtp_c9
-A out_dst-outside -j out_dst-outside_http_c10
-A out_dst-outside -m state --state RELATED -j ACCEPT
-A out_dst-outside -m limit --limit 1/sec -j LOG --log-prefix "''OUT-dst-outside':'"
-A out_dst-outside -j DROP
-A out_dst-outside_ICMP_s2 -p icmp -m state --state ESTABLISHED -j ACCEPT
-A out_dst-outside_dns_c8 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-outside_dns_c8 -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-outside_dns_s6 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-outside_dns_s6 -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-outside_ftp_s1 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-outside_ftp_s1 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A out_dst-outside_ftp_s1 -p tcp -m tcp --sport 32768:61000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-outside_http_c10 -p tcp -m tcp --sport 32768:61000 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-outside_ntp_s3 -p udp -m udp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-outside_ntp_s3 -p udp -m udp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-outside_ntp_s3 -p tcp -m tcp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-outside_ntp_s3 -p tcp -m tcp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-outside_smtp_c9 -p tcp -m tcp --sport 32768:61000 --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-outside_ssh_c7 -p tcp -m tcp --sport 32768:61000 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-outside_ssh_s5 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-outside_webmin_s4 -p tcp -m tcp --sport 10000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip -j out_dst-privateip_ftp_s1
-A out_dst-privateip -j out_dst-privateip_ICMP_s2
-A out_dst-privateip -j out_dst-privateip_ntp_s3
-A out_dst-privateip -j out_dst-privateip_webmin_s4
-A out_dst-privateip -j out_dst-privateip_ssh_s5
-A out_dst-privateip -j out_dst-privateip_dns_s6
-A out_dst-privateip -j out_dst-privateip_ssh_c7
-A out_dst-privateip -j out_dst-privateip_dns_c8
-A out_dst-privateip -j out_dst-privateip_smtp_c9
-A out_dst-privateip -j out_dst-privateip_http_c10
-A out_dst-privateip -m state --state RELATED -j ACCEPT
-A out_dst-privateip -m limit --limit 1/sec -j LOG --log-prefix "''OUT-dst-privateip':'"
-A out_dst-privateip -j DROP
-A out_dst-privateip_ICMP_s2 -p icmp -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip_dns_c8 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-privateip_dns_c8 -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-privateip_dns_s6 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip_dns_s6 -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip_ftp_s1 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip_ftp_s1 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A out_dst-privateip_ftp_s1 -p tcp -m tcp --sport 32768:61000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip_http_c10 -p tcp -m tcp --sport 32768:61000 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-privateip_ntp_s3 -p udp -m udp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip_ntp_s3 -p udp -m udp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip_ntp_s3 -p tcp -m tcp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip_ntp_s3 -p tcp -m tcp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip_smtp_c9 -p tcp -m tcp --sport 32768:61000 --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-privateip_ssh_c7 -p tcp -m tcp --sport 32768:61000 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A out_dst-privateip_ssh_s5 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-A out_dst-privateip_webmin_s4 -p tcp -m tcp --sport 10000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Dec 6 12:17:04 2006