Untitled

# Generated by iptables-save v1.3.5 on Wed May 23 14:02:28 2007
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [11299:11774909]
# loopback
-A INPUT -s 127.0.0.1 -j ACCEPT
# Connections that exists
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# ssh
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
# mt-daap
-A INPUT -s 192.168.0.0/255.255.0.0 -p tcp -m state --state NEW -m tcp --dport
3689 -j ACCEPT
# httpd
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -m limit --limit 1/sec -j ACCEPT
# DNS
-A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT

# NFS
-A INPUT -s 192.168.1.0/255.255.0.0 -p tcp -m multiport --dports 4001:4003 -j
ACCEPT
-A INPUT -s 192.168.1.0/255.255.0.0 -p udp -m multiport --dports 4000:4002 -j
ACCEPT
-A INPUT -s 192.168.1.0/255.255.0.0 -p udp -m udp --dport 2049 -j ACCEPT
-A INPUT -s 192.168.1.0/255.255.0.0 -p tcp -m tcp --dport 2049 -j ACCEPT
-A INPUT -s 192.168.1.0/255.255.0.0 -p tcp -m tcp --dport 111 -j ACCEPT
-A INPUT -s 192.168.1.0/255.255.0.0 -p udp -m udp --dport 111 -j ACCEPT
# AVAHI
-A INPUT -s 192.168.1.0/255.255.0.0 -p udp -m udp --dport 5353 -j ACCEPT

# SAMBA
-A INPUT -s 192.168.1.0/255.255.0.0 -p tcp -m multiport --dports 137:139 -j
ACCEPT
-A INPUT -s 192.168.1.0/255.255.0.0 -p udp -m multiport --dports 137:139 -j
ACCEPT
-A INPUT -s 192.168.1.0/255.255.0.0 -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -s 192.168.1.0/255.255.0.0 -p udp -m udp --dport 445 -j ACCEPT
# VPN
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i eth1 -o tun+ -s 192.168.1.0/255.255.0.0 -j ACCEPT
#-t nat -A POSTROUTING -s 192.168.7.0/24 -o eth1 -j MASQUERADE
# LDAP
-A INPUT -s 192.168.0.0/255.255.0.0 -p tcp -m tcp --dport 389 -j ACCEPT
-A INPUT -s 192.168.0.0/255.255.0.0 -p udp -m udp --dport 389 -j ACCEPT

# ICMP
-A INPUT -p icmp -m limit --limit 1/second --limit-burst 3 -j ACCEPT
-A INPUT -p icmp -j DROP

#-A INPUT -j REJECT --reject-with icmp-port-unreachable
# Logittamista varten
-N LOGDROP
-A LOGDROP -j LOG --log-tcp-options --log-ip-options --log-level debug
-A LOGDROP -j DROP

# Logitus päälle. Tämä ehottomasti viimeisenä!
#-A INPUT -j LOGDROP

COMMIT
# Completed on Wed May 23 14:02:28 2007