All pastes #568378 Raw Edit

Stuff

public text v1 · immutable
·published 2007-06-15 14:24 UTC
rendered paste body
#: Interfaces found:
#:   eth0       85.65.217.229/255.255.255.0
#:   eth0       85.65.217.229/255.255.255.0
#:   eth3       192.168.0.1/255.255.0.0
#: DO NOT Turn off forwarding for 2.1 kernels!
#: DO NOT Turn off IP defragmentation
#: Set a default policy of 'accept' and flush all 
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -F FORWARD
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -F PREROUTING
/sbin/iptables -t mangle -F OUTPUT
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -F OUTPUT
#: Forward packets among internal networks
#: Accept all packets coming in from the loopback interface
/sbin/iptables -A INPUT -j ACCEPT -i lo
#: Deny and log all packets trying to come in from a 127.0.0.0/8 address
#: over a non-'lo' interface
/sbin/iptables -A INPUT -j LOG -i ! lo -s 127.0.0.1/255.0.0.0 --log-prefix I15losoof 
/sbin/iptables -A INPUT -j DROP -i ! lo -s 127.0.0.1/255.0.0.0
#: Accept dumb broadcast packets on internal interfaces
/sbin/iptables -A INPUT -j ACCEPT -i eth3 -d 255.255.255.255/32
#: Accept packets from internal networks on internal interfaces
/sbin/iptables -A INPUT -j ACCEPT -i eth3 -s 192.168.0.1/255.255.0.0
#: Accept multicast packets (adresses 224.0.0.0) from internal interfaces
/sbin/iptables -A INPUT -j ACCEPT -i eth3 -d 224.0.0.0/4 -p ! 6
#: Disallow and log packets trying to come in over external interfaces
#: from hosts claiming to be internal
/sbin/iptables -A INPUT -j LOG -i eth0 -s 192.168.0.1/255.255.0.0 --log-prefix I70mask CHAIN=INPUT
/sbin/iptables -A INPUT -j DROP -i eth0 -s 192.168.0.1/255.255.0.0
#: Accept dumb broadcast packets on external interfaces
/sbin/iptables -A INPUT -j ACCEPT -i eth0 -d 255.255.255.255/32
#: Accept incoming packets from external networks on external interfaces
/sbin/iptables -A INPUT -j ACCEPT -i eth0 -d 85.65.217.229/32
/sbin/iptables -A FORWARD -p tcp --dport 16805 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 6699 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p udp --dport 6257 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 5190 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 5280 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 59 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 68 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 69 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 1122 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 6060 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8080 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8133 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8134 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8135 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8136 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 4662 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 4665 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p udp --dport 4672 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 4798 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 17881 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p udp --dport 17881 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 17882 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 17883 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 49161 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p udp --dport 49161 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 49162 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 6701 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 4490 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 3389 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 16805 -j DNAT --to 192.168.0.3:22
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 6699 -j DNAT --to 192.168.0.3:6699
/sbin/iptables -A PREROUTING -t nat -p udp -d 192.168.0.1 --dport 6257 -j DNAT --to 192.168.0.3:6257
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 5190 -j DNAT --to 192.168.0.3:5190
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 5280 -j DNAT --to 192.168.0.3:5280
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 59 -j DNAT --to 192.168.0.3:59
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 68 -j DNAT --to 192.168.0.3:68
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 69 -j DNAT --to 192.168.0.3:69
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 1122 -j DNAT --to 192.168.0.3:1122
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 6060 -j DNAT --to 192.168.0.3:6060
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 8080 -j DNAT --to 192.168.0.3:8080
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 8133 -j DNAT --to 192.168.0.3:8133
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 8134 -j DNAT --to 192.168.0.3:8134
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 8135 -j DNAT --to 192.168.0.3:8135
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 8136 -j DNAT --to 192.168.0.3:8136
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 4662 -j DNAT --to 192.168.0.3:4662
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 4665 -j DNAT --to 192.168.0.3:4665
/sbin/iptables -A PREROUTING -t nat -p udp -d 192.168.0.1 --dport 4672 -j DNAT --to 192.168.0.3:4672
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 4798 -j DNAT --to 192.168.0.3:4798
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 17881 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p udp -d 192.168.0.1 --dport 17881 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 17882 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 17883 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 49161 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p udp -d 192.168.0.1 --dport 49161 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 49162 -j DNAT --to 192.168.0.5:49162
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 6701 -j DNAT --to 192.168.0.2:6701
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 4490 -j DNAT --to 192.168.0.3:3389
/sbin/iptables -A PREROUTING -t nat -p tcp -d 192.168.0.1 --dport 3389 -j DNAT --to 192.168.0.3:3389
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 16805 -j DNAT --to 192.168.0.3:22
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 6699 -j DNAT --to 192.168.0.3:6699
/sbin/iptables -A PREROUTING -t nat -p udp -d 85.65.217.229 --dport 6257 -j DNAT --to 192.168.0.3:6257
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 5190 -j DNAT --to 192.168.0.3:5190
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 5280 -j DNAT --to 192.168.0.3:5280
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 59 -j DNAT --to 192.168.0.3:59
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 68 -j DNAT --to 192.168.0.3:68
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 69 -j DNAT --to 192.168.0.3:69
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 1122 -j DNAT --to 192.168.0.3:1122
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 6060 -j DNAT --to 192.168.0.3:6060
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 8080 -j DNAT --to 192.168.0.3:8080
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 8133 -j DNAT --to 192.168.0.3:8133
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 8134 -j DNAT --to 192.168.0.3:8134
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 8135 -j DNAT --to 192.168.0.3:8135
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 8136 -j DNAT --to 192.168.0.3:8136
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 4662 -j DNAT --to 192.168.0.3:4662
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 4665 -j DNAT --to 192.168.0.3:4665
/sbin/iptables -A PREROUTING -t nat -p udp -d 85.65.217.229 --dport 4672 -j DNAT --to 192.168.0.3:4672
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 4798 -j DNAT --to 192.168.0.3:4798
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 17881 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p udp -d 85.65.217.229 --dport 17881 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 17882 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 17883 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 49161 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p udp -d 85.65.217.229 --dport 49161 -j DNAT --to 192.168.0.3:49161
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 49162 -j DNAT --to 192.168.0.5:49162
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 6701 -j DNAT --to 192.168.0.2:6701
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 4490 -j DNAT --to 192.168.0.3:3389
/sbin/iptables -A PREROUTING -t nat -p tcp -d 85.65.217.229 --dport 3389 -j DNAT --to 192.168.0.3:3389
#: Masquerade packets from internal networks
/sbin/iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.1/255.255.0.0 -j MASQUERADE
/sbin/iptables -A FORWARD -i eth3 -o eth0 -s 192.168.0.1/255.255.0.0 -j ACCEPT
/sbin/iptables -A FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
#: Allow packets to go out over the loopback interface
/sbin/iptables -A OUTPUT -j ACCEPT -o lo
#: Allow dumb broadcast packets to leave on internal interfaces
/sbin/iptables -A OUTPUT -j ACCEPT -o eth3 -d 255.255.255.255/32
#: Allow packets for internal hosts to be delivered using internal interfaces
/sbin/iptables -A OUTPUT -j ACCEPT -o eth3 -d 192.168.0.1/255.255.0.0
#: Allow multicast packets (adresses 224.0.0.0) to be delivered using
#: internal interfaces
/sbin/iptables -A OUTPUT -j ACCEPT -o eth3 -d 224.0.0.0/4 -p ! 6
#: Deny and log packets attempting to leave over external interfaces claiming
#: to be for internal networks
/sbin/iptables -A FORWARD -j LOG -o eth0 -d 192.168.0.1/255.255.0.0 --log-prefix O70mask CHAIN=FORWARD
/sbin/iptables -A FORWARD -j DROP -o eth0 -d 192.168.0.1/255.255.0.0
/sbin/iptables -A OUTPUT -j LOG -o eth0 -d 192.168.0.1/255.255.0.0 --log-prefix O70mask CHAIN=OUTPUT
/sbin/iptables -A OUTPUT -j DROP -o eth0 -d 192.168.0.1/255.255.0.0
#: Allow dumb broadcast packets to leave on external interfaces
/sbin/iptables -A OUTPUT -j ACCEPT -o eth0 -d 255.255.255.255/32
#: Allow packets for external networks leave over external interfaces
/sbin/iptables -A OUTPUT -j ACCEPT -o eth0 -s 85.65.217.229/32
#: Turn on forwarding for 2.1 kernels
#: Enable automatic IP defragmentation
echo "1" > /proc/sys/net/ipv4/ip_forward
#: Set masqerading timeouts:
#:   2 hrs for TCP
#:   10 sec for TCP after FIN has been sent
#:   160 sec for UDP (important for ICQ users)
#: Run the deprecated /etc/ipmasq.rules, if present
#: Deny and log anything that may have snuck past any of our other rules
/sbin/iptables -A INPUT -j LOG -s 0.0.0.0/0 -d 0.0.0.0/0 --log-prefix ZZZdenyandlog CHAIN=INPUT 
/sbin/iptables -A INPUT -j DROP -s 0.0.0.0/0 -d 0.0.0.0/0
/sbin/iptables -A OUTPUT -j LOG -s 0.0.0.0/0 -d 0.0.0.0/0 --log-prefix ZZZdenyandlog CHAIN=OUTPUT 
/sbin/iptables -A OUTPUT -j DROP -s 0.0.0.0/0 -d 0.0.0.0/0
/sbin/iptables -A FORWARD -j LOG -s 0.0.0.0/0 -d 0.0.0.0/0 --log-prefix ZZZdenyandlog CHAIN=FORWARD 
/sbin/iptables -A FORWARD -j DROP -s 0.0.0.0/0 -d 0.0.0.0/0
#: Reset policies to 'deny' where necessary
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP