All pastes #59143 Raw Edit

Mine

public text v1 · immutable
#59143 ·published 2006-05-27 00:06 UTC
rendered paste body
root@cata:/catalin# sh fw.sh stop
+ IPTABLES=/usr/sbin/iptables
+ EXTIF=eth0
+ INTIF=eth1
+ case "$1" in
+ z_stop
+ /usr/sbin/iptables -F
+ /usr/sbin/iptables -Z
+ /usr/sbin/iptables -X
+ /usr/sbin/iptables -P INPUT ACCEPT
+ /usr/sbin/iptables -P FORWARD ACCEPT
+ echo 'PhiroWall: Stoped'
PhiroWall: Stoped
root@cata:/catalin# sh fw.sh
+ IPTABLES=/usr/sbin/iptables
+ EXTIF=eth0
+ INTIF=eth1
+ case "$1" in
+ z_restart
+ z_stop
+ /usr/sbin/iptables -F
+ /usr/sbin/iptables -Z
+ /usr/sbin/iptables -X
+ /usr/sbin/iptables -P INPUT ACCEPT
+ /usr/sbin/iptables -P FORWARD ACCEPT
+ sleep 1
+ z_start
+ /usr/sbin/iptables -F
+ /usr/sbin/iptables -X
+ /usr/sbin/iptables -Z
+ /usr/sbin/iptables -P INPUT DROP
+ /usr/sbin/iptables -P FORWARD DROP
+ /usr/sbin/iptables -P OUTPUT ACCEPT
+ /usr/sbin/iptables -N LOGDROP
+ /usr/sbin/iptables -t filter -A LOGDROP -m limit --limit 20/minute --limit-burst 3 -j LO                                                                   G --log-level info --log-prefix '[DR] ' --log-tcp-sequence --log-tcp-options --log-ip-opti                                                                   ons
+ /usr/sbin/iptables -t filter -A LOGDROP -j DROP
+ /usr/sbin/iptables -N LOGACCEPT
+ /usr/sbin/iptables -t filter -A LOGACCEPT -m limit --limit 40/minute --limit-burst 3 -j                                                                    LOG --log-level info --log-prefix '[AC] ' --log-tcp-sequence --log-tcp-options --log-ip-op                                                                   tions
+ /usr/sbin/iptables -t filter -A LOGACCEPT -j ACCEPT
+ /usr/sbin/iptables -N TCPINC
+ /usr/sbin/iptables -t filter -A TCPINC -p tcp -m state --state ESTABLISHED -j ACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -i lo -p tcp -j ACCEPT
+ /usr/sbin/iptables -t filter -A INPUT -i '!' eth0 -p tcp -m tcp -m multiport --dports 21                                                                   ,25,80,110,111,143,443,465,953,993,995,2082,2083,2084 -j ACCEPT
+ /usr/sbin/iptables -t filter -A INPUT -i '!' eth0 -p tcp -m tcp -m multiport --dports 20                                                                   86,2087,2095,2096,3306,6666,1 -j ACCEPT
+ /usr/sbin/iptables -t filter -A INPUT -i '!' eth0 -p tcp -m udp -m multiport --dports 21                                                                   ,25,80,110,111,143,443,465,953,993,995,2082,2083,2084 -j ACCEPT
iptables: Invalid argument
+ /usr/sbin/iptables -t filter -A INPUT -i '!' eth0 -p tcp -m udp -m multiport --dports 20                                                                   ,2086,2087,2095,2096,3306,6666,1 -j ACCEPT
iptables: Invalid argument
+ /usr/sbin/iptables -t filter -A TCPINC -i '!' eth0 -p tcp --syn -s 85.186.59.143 --dport                                                                    22 -j LOGACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -i '!' eth0 -p tcp --syn -s 82.152.101.20 --dport                                                                    22 -j LOGACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -i '!' eth0 -p tcp --syn -s 82.152.101.17 --dport                                                                    22 -j LOGACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -i '!' eth0 -p tcp --syn -s 217.128.241.42 --dpor                                                                   t 22 -j LOGACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -i '!' eth0 -p tcp --syn -s 209.51.153.82 --dport                                                                    22 -j LOGACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -i '!' eth0 -p tcp --syn -s 72.9.241.26 --dport 2                                                                   2 -j LOGACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -i '!' eth0 -p tcp --syn -s 66.179.171.157 --dpor                                                                   t 22 -j LOGACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -i '!' eth0 -p tcp --syn -s 207.234.208.246 --dpo                                                                   rt 22 -j LOGACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -i '!' eth0 -p tcp --syn -s 209.217.116.130 --dpo                                                                   rt 22 -j LOGACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -i '!' eth0 -p tcp --syn -s 209.217.116.142 --dpo                                                                   rt 22 -j LOGACCEPT
+ /usr/sbin/iptables -t filter -A TCPINC -p tcp -j LOGDROP
+ /usr/sbin/iptables -N UDPINC
+ /usr/sbin/iptables -t filter -A UDPINC -i lo -p udp -j ACCEPT
+ /usr/sbin/iptables -t filter -A UDPINC -p udp -m state --state ESTABLISHED --source-port                                                                    53 -j ACCEPT
+ /usr/sbin/iptables -N ICMPINC
+ /usr/sbin/iptables -t filter -A ICMPINC -i lo -p icmp -j ACCEPT
+ /usr/sbin/iptables -t filter -A ICMPINC -i '!' eth0 -p icmp -m unclean -j LOGDROP
iptables: No chain/target/match by that name
+ /usr/sbin/iptables -t filter -A ICMPINC -i '!' eth0 -p icmp --icmp-type echo-reply -m st                                                                   ate --state ESTABLISHED -m limit --limit 90/minute --limit-burst 20 -j ACCEPT
+ /usr/sbin/iptables -t filter -A ICMPINC -i '!' eth0 -p icmp --icmp-type timestamp-reply                                                                    -m state --state ESTABLISHED -m limit --limit 90/minute --limit-burst 20 -j ACCEPT
+ /usr/sbin/iptables -t filter -A ICMPINC -i '!' eth0 -p icmp --icmp-type destination-unreachable -m state --state RELATED -m limit --limit 15/minute --limit-burst 5 -j ACCEPT
+ /usr/sbin/iptables -t filter -A ICMPINC -i '!' eth0 -p icmp --icmp-type time-exceeded -m state --state RELATED -m limit --limit 15/minute --limit-burst 5 -j ACCEPT
+ /usr/sbin/iptables -t filter -A ICMPINC -i '!' eth0 -j LOGDROP
+ /usr/sbin/iptables -t filter -A INPUT -p tcp -j TCPINC
+ /usr/sbin/iptables -t filter -A INPUT -p udp -j UDPINC
+ /usr/sbin/iptables -t filter -A INPUT -p icmp -j ICMPINC
root@cata:/catalin#