rendered paste body# Generated by iptables-save v1.3.6 on Thu Nov 1 21:34:16 2007
*mangle
:PREROUTING ACCEPT [925:109312]
:INPUT ACCEPT [868:105754]
:FORWARD ACCEPT [42:2016]
:OUTPUT ACCEPT [270:30276]
:POSTROUTING ACCEPT [312:32292]
COMMIT
# Completed on Thu Nov 1 21:34:16 2007
# Generated by iptables-save v1.3.6 on Thu Nov 1 21:34:16 2007
*nat
:PREROUTING ACCEPT [286:45643]
:POSTROUTING ACCEPT [36:2079]
:OUTPUT ACCEPT [22:1407]
COMMIT
# Completed on Thu Nov 1 21:34:16 2007
# Generated by iptables-save v1.3.6 on Thu Nov 1 21:34:16 2007
*filter
:INPUT ACCEPT [869:105794]
:FORWARD ACCEPT [42:2016]
:OUTPUT ACCEPT [278:31812]
COMMIT
# Completed on Thu Nov 1 21:34:16 2007
snaps:~# /etc/init.d/firewall start
Staring Firewall : iptables.
snaps:~# iptables-save -c
# Generated by iptables-save v1.3.6 on Thu Nov 1 21:34:33 2007
*mangle
:PREROUTING ACCEPT [969:112322]
:INPUT ACCEPT [912:108764]
:FORWARD ACCEPT [42:2016]
:OUTPUT ACCEPT [308:34936]
:POSTROUTING ACCEPT [350:36952]
COMMIT
# Completed on Thu Nov 1 21:34:33 2007
# Generated by iptables-save v1.3.6 on Thu Nov 1 21:34:33 2007
*nat
:PREROUTING ACCEPT [288:45829]
:POSTROUTING ACCEPT [36:2079]
:OUTPUT ACCEPT [22:1407]
:CUSTOMPREROUTING - [0:0]
:PORTFORWARDPR - [0:0]
:REDNAT - [0:0]
[1:78] -A PREROUTING -j CUSTOMPREROUTING
[1:78] -A PREROUTING -j PORTFORWARDPR
[0:0] -A PREROUTING -d ! 192.168.1.4 -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.4:8080
[0:0] -A POSTROUTING -j REDNAT
[0:0] -A POSTROUTING -m mark --mark 0x1 -j SNAT --to-source 192.168.1.4
[0:0] -A POSTROUTING -m mark --mark 0x3 -j SNAT --to-source 111.11.1.40
[0:0] -A CUSTOMPREROUTING -s 10.10.136.13 -d 10.10.136.94 -p tcp -m mac --mac-source 00:16:76:91:7C:CB -m tcp --dport 80 -j DNAT --to-destination 192.168.1.4:80
[0:0] -A CUSTOMPREROUTING -s 10.10.136.6 -d 10.10.136.94 -p tcp -m mac --mac-source 00:00:E8:11:95:B8 -m tcp --dport 80 -j DNAT --to-destination 192.168.1.4:80
[0:0] -A CUSTOMPREROUTING -s 10.10.136.45 -d 10.10.136.94 -p tcp -m mac --mac-source 00:19:5B:7D:61:D6 -m tcp --dport 80 -j DNAT --to-destination 192.168.1.4:80
[0:0] -A PORTFORWARDPR -d 10.10.136.94 -p tcp -m tcp --dport 3000 -j DNAT --to-destination 192.168.1.1:80
[0:0] -A REDNAT -o eth1 -j MASQUERADE
COMMIT
# Completed on Thu Nov 1 21:34:33 2007
# Generated by iptables-save v1.3.6 on Thu Nov 1 21:34:33 2007
*filter
:INPUT DROP [1:78]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [28:4364]
:BADTCP - [0:0]
:DMZHOLES - [0:0]
:EXTERNALACCESS - [0:0]
:INTERNALACCESS - [0:0]
:IPSECRED - [0:0]
:LOG_DROP - [0:0]
:LOG_REJECT - [0:0]
:NEWNOTSYN - [0:0]
:PORTFORWARD - [0:0]
:PPTPD - [0:0]
:PSCAN - [0:0]
:REDFORWARD - [0:0]
:REDINPUT - [0:0]
[14:754] -A INPUT -j BADTCP
[0:0] -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec
[13:676] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i lo -m state --state NEW -j ACCEPT
[0:0] -A INPUT -s 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
[0:0] -A INPUT -d 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
[0:0] -A INPUT -i eth0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i ipsec+ -j ACCEPT
[1:78] -A INPUT -i eth1 -j IPSECRED
[1:78] -A INPUT -i eth1 -j PPTPD
[0:0] -A INPUT -i ppp0 -j ACCEPT
[1:78] -A INPUT -j REDINPUT
[1:78] -A INPUT -m state --state NEW -j INTERNALACCESS
[1:78] -A INPUT -m state --state NEW -j EXTERNALACCESS
[0:0] -A FORWARD -j BADTCP
[0:0] -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
[0:0] -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i lo -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -s 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
[0:0] -A FORWARD -d 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
[0:0] -A FORWARD -i eth0 -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -i ipsec+ -j ACCEPT
[0:0] -A FORWARD -i ppp0 -j ACCEPT
[0:0] -A FORWARD -j REDFORWARD
[0:0] -A FORWARD -i eth2 -m state --state NEW -j DMZHOLES
[0:0] -A FORWARD -m state --state NEW -j PORTFORWARD
[0:0] -A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j PSCAN
[0:0] -A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j PSCAN
[0:0] -A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j PSCAN
[0:0] -A BADTCP -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
[0:0] -A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j PSCAN
[0:0] -A BADTCP -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j NEWNOTSYN
[0:0] -A EXTERNALACCESS -s 10.10.136.13 -i eth1 -p tcp -m mac --mac-source 00:16:76:91:7C:CB -m tcp --dport 80 -j ACCEPT
[0:0] -A EXTERNALACCESS -s 10.10.136.6 -i eth1 -p tcp -m mac --mac-source 00:00:E8:11:95:B8 -m tcp --dport 80 -j ACCEPT
[0:0] -A EXTERNALACCESS -s 10.10.136.45 -i eth1 -p tcp -m mac --mac-source 00:19:5B:7D:61:D6 -m tcp --dport 80 -j ACCEPT
[0:0] -A INTERNALACCESS -s 192.168.1.1 -i eth0 -j ACCEPT
[0:0] -A INTERNALACCESS -s 10.10.136.43 -i eth0 -m mac --mac-source 00:19:5B:82:54:59 -j ACCEPT
[0:0] -A IPSECRED -p gre -j ACCEPT
[0:0] -A IPSECRED -p esp -j ACCEPT
[0:0] -A IPSECRED -p ah -j ACCEPT
[0:0] -A IPSECRED -p udp -m udp --sport 500 --dport 500 -j ACCEPT
[0:0] -A IPSECRED -p udp -m udp --dport 4500 -j ACCEPT
[0:0] -A LOG_DROP -j LOG
[0:0] -A LOG_DROP -j DROP
[0:0] -A LOG_REJECT -j LOG
[0:0] -A LOG_REJECT -j REJECT --reject-with icmp-port-unreachable
[0:0] -A NEWNOTSYN -j DROP
[0:0] -A PORTFORWARD -d 192.168.1.1 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
[0:0] -A PPTPD -p udp -m udp --dport 1723 -j ACCEPT
[0:0] -A PPTPD -p tcp -m tcp --dport 1723 -j ACCEPT
[0:0] -A PPTPD -p gre -j ACCEPT
[0:0] -A PSCAN -j DROP
[0:0] -A REDFORWARD -i eth2 -o eth1 -p tcp -j ACCEPT
[0:0] -A REDFORWARD -i eth2 -o eth1 -p udp -j ACCEPT
COMMIT
# Completed on Thu Nov 1 21:34:33 2007