Jump to content

mechtn's firewall script


Recommended Posts

Here is my iptables firewall script. I'm currently in the process of learning iptables and this is where i'm keeping my most recent and update to date working version. I plan on keeping the script well documented for other noobs like myself so try it out if your looking to get into iptables.

 

Iptables 1.2.11

Gentoo 2.6.11 r11

 

firewall.sh

------------------------------

 

#!/bin/sh

 

# Define variables with location to iptables

IPTABLES=/sbin/iptables

 

# Define external and internal interface

EXTIF="eth1"

INTIF="eth0"

 

# Enabling ip fowarding and dynamicaddr

echo "1" > /proc/sys/net/ipv4/ip_forward

echo "1" > /proc/sys/net/ipv4/ip_dynaddr

 

# Clearing any existing rules and setting default policy

$IPTABLES -P INPUT DROP

$IPTABLES -F INPUT

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -F OUTPUT

$IPTABLES -P FORWARD DROP

$IPTABLES -F FORWARD

$IPTABLES -t nat -F

 

# FOWARD

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -p tcp -m multiport --dports 21,25,80,110,1723,3389,3450,3500,6881 -j ACCEPT

$IPTABLES -A FORWARD -p tcp --dport 3389:3500 -i $EXTIF -j ACCEPT

$IPTABLES -A FORWARD -p tcp -d 10.10.23.95 --dport 1723 -j ACCEPT

$IPTABLES -A FORWARD -p udp -d 10.10.23.80 --dport 6881 -j ACCEPT

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT

$IPTABLES -A FORWARD -i eth0 -d 10.10.24.0/24 -j ACCEPT

 

$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

 

# VPN

$IPTABLES -A FORWARD -i $EXTIF -p 47 -d 10.10.23.95 -j ACCEPT

$IPTABLES -A FORWARD -i $EXTIF -p tcp -d 10.10.23.95 --dport 1723 -j ACCEPT

 

$IPTABLES -A FORWARD -j LOG

 

#INPUT

# Accept all traffic from internal network

$IPTABLES -A INPUT -i $INTIF -j ACCEPT

$IPTABLES -A INPUT -i lo -j ACCEPT

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -i eth0 -d 10.10.24.0/24 -j ACCEPT

 

#VPN

$IPTABLES -A INPUT -p 47 -j ACCEPT

$IPTABLES -A INPUT -p tcp --dport 1723 -j ACCEPT

 

#Example Allow tcp for a single port

$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 22 -j ACCEPT

$IPTABLES -A INPUT -i $INTIF -p tcp --dport 53 -j ACCEPT

$IPTABLES -A FORWARD -p tcp -d 10.10.23.48 --dport 5631 -j ACCEPT

$IPTABLES -A FORWARD -p udp -d 10.10.23.48 --dport 5632 -j ACCEPT

 

# PREROUTING

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 21 -j DNAT --to 10.10.23.3:21

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 5631 -j DNAT --to 10.10.23.48:5631

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --dport 5632 -j DNAT --to 10.10.23.48:5632

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 25 -j DNAT --to 10.10.23.3:25

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 80 -j DNAT --to 10.10.23.95:80

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 110 -j DNAT --to 10.10.23.95:110

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 6881 -j DNAT --to 10.10.23.80:6881

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --dport 6881 -j DNAT --to 10.10.23.80:6881

 

# RDP (open ports: 3399, 3405, 3410, 3423, 3430, 3448)

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3389 -j DNAT --to 10.10.23.95:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3390 -j DNAT --to 10.10.23.98:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3391 -j DNAT --to 10.10.23.80:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3392 -j DNAT --to 10.10.23.166:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3393 -j DNAT --to 10.10.23.159:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3394 -j DNAT --to 10.10.23.16:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3395 -j DNAT --to 10.10.23.88:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3396 -j DNAT --to 10.10.23.40:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3397 -j DNAT --to 10.10.23.97:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3398 -j DNAT --to 10.10.23.23:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3400 -j DNAT --to 10.10.23.146:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3401 -j DNAT --to 10.10.23.66:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3402 -j DNAT --to 10.10.23.121:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3403 -j DNAT --to 10.10.23.20:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3404 -j DNAT --to 10.10.23.120:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3406 -j DNAT --to 10.10.23.191:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3407 -j DNAT --to 10.10.23.180:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3408 -j DNAT --to 10.10.23.71:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3409 -j DNAT --to 10.10.23.45:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3411 -j DNAT --to 10.10.23.116:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3412 -j DNAT --to 10.10.23.101:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3413 -j DNAT --to 10.10.23.165:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3414 -j DNAT --to 10.10.23.43:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3415 -j DNAT --to 10.10.23.181:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3416 -j DNAT --to 10.10.23.143:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3417 -j DNAT --to 10.10.23.209:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3418 -j DNAT --to 10.10.23.85:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3419 -j DNAT --to 10.10.23.73:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3420 -j DNAT --to 10.10.23.129:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3421 -j DNAT --to 10.10.23.140:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3422 -j DNAT --to 10.10.23.172:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3423 -j DNAT --to 10.10.24.155:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3424 -j DNAT --to 10.10.24.155:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3425 -j DNAT --to 10.10.23.29:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3426 -j DNAT --to 10.10.23.158:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3427 -j DNAT --to 10.10.23.117:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3428 -j DNAT --to 10.10.23.207:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3429 -j DNAT --to 10.10.23.142:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3431 -j DNAT --to 10.10.23.122:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3432 -j DNAT --to 10.10.23.86:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3433 -j DNAT --to 10.10.23.134:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3434 -j DNAT --to 10.10.23.137:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3435 -j DNAT --to 10.10.23.149:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3436 -j DNAT --to 10.10.23.126:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3437 -j DNAT --to 10.10.23.57:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3438 -j DNAT --to 10.10.23.227:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3439 -j DNAT --to 10.10.23.34:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3440 -j DNAT --to 10.10.23.234:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3441 -j DNAT --to 10.10.24.99:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3442 -j DNAT --to 10.10.23.125:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3443 -j DNAT --to 10.10.23.189:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3444 -j DNAT --to 10.10.23.161:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3445 -j DNAT --to 10.10.23.202:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3446 -j DNAT --to 10.10.23.53:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3447 -j DNAT --to 10.10.23.182:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3449 -j DNAT --to 10.10.23.116:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3450 -j DNAT --to 10.10.23.114:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3451 -j DNAT --to 10.10.24.157:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3452 -j DNAT --to 10.10.23.65:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3453 -j DNAT --to 10.10.23.70:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3454 -j DNAT --to 10.10.23.220:3389

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3500 -j DNAT --to 10.10.23.22:3389

 

# VPN

$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 1723 -j DNAT --to 10.10.23.95:1723

$IPTABLES -t nat -A PREROUTING -p 47 -i $EXTIF -j DNAT --to 10.10.23.95

 

 

 

#$IPTABLES -t nat -A PREROUTING -p tcp -d 64.247.238.178 --dport 80 -j DNAT --to-destination 10.10.23.95

#$IPTABLES -t nat -A POSTROUTING -p tcp -d 10.10.23.1 -j SNAT --to-source 10.10.23.95:80

#$IPTABLES -t nat -A OUTPUT --dst 64.247.238.178 -p tcp --dport 80 -j DNAT --to-destination 10.10.23.95

#$IPTABLES -t nat -A PREROUTING --dst 64.247.238.178 -p tcp --dport 80 -j DNAT --to-destination 10.10.23.95

#$IPTABLES -t nat -A POSTROUTING -p tcp --dst 10.10.23.95 --dport 80 -j SNAT --to-source 10.10.23.1

 

 

# POSTROUTING

$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

 

------------------------------

 

 

If you have any questions, you can find me on #linux-noob on efnet as mechtn or just leave me a reply here. More documentation to come soon!

Link to post
Share on other sites

dude

 

what distro etc ?

 

more details, any errors ? what is/is not working ?

 

also, what exactly are you trying to do

 

cheers

 

anyweb

Link to post
Share on other sites
  • 3 months later...

# Generated by iptables-save v1.2.11 on Tue Oct 4 11:38:00 2005

*nat

:PREROUTING ACCEPT [4580542:426250850]

:POSTROUTING ACCEPT [282533:27972284]

:OUTPUT ACCEPT [9248:700140]

-A PREROUTING -i eth1 -p tcp -m tcp --dport 21 -j DNAT --to-destination 10.10.23.3:21

-A PREROUTING -i eth1 -p tcp -m tcp --dport 5631 -j DNAT --to-destination 10.10.23.48:5631

-A PREROUTING -i eth1 -p udp -m udp --dport 5632 -j DNAT --to-destination 10.10.23.48:5632

-A PREROUTING -i eth1 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.10.23.3:25

-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.10.23.95:80

-A PREROUTING -i eth1 -p tcp -m tcp --dport 110 -j DNAT --to-destination 10.10.23.95:110

-A PREROUTING -i eth1 -p tcp -m tcp --dport 6881 -j DNAT --to-destination 10.10.23.80:6881

-A PREROUTING -i eth1 -p udp -m udp --dport 6881 -j DNAT --to-destination 10.10.23.80:6881

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 10.10.23.95:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3390 -j DNAT --to-destination 10.10.23.98:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3391 -j DNAT --to-destination 10.10.23.80:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3392 -j DNAT --to-destination 10.10.23.166:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3393 -j DNAT --to-destination 10.10.23.159:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3394 -j DNAT --to-destination 10.10.23.16:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3395 -j DNAT --to-destination 10.10.23.88:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3396 -j DNAT --to-destination 10.10.23.40:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3397 -j DNAT --to-destination 10.10.23.97:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3398 -j DNAT --to-destination 10.10.23.23:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3400 -j DNAT --to-destination 10.10.23.146:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3401 -j DNAT --to-destination 10.10.23.66:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3402 -j DNAT --to-destination 10.10.23.121:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3403 -j DNAT --to-destination 10.10.23.20:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3404 -j DNAT --to-destination 10.10.23.120:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3406 -j DNAT --to-destination 10.10.23.191:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3407 -j DNAT --to-destination 10.10.23.180:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3408 -j DNAT --to-destination 10.10.23.71:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3409 -j DNAT --to-destination 10.10.23.45:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3411 -j DNAT --to-destination 10.10.23.116:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3412 -j DNAT --to-destination 10.10.23.101:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3413 -j DNAT --to-destination 10.10.23.165:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3414 -j DNAT --to-destination 10.10.23.43:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3415 -j DNAT --to-destination 10.10.23.181:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3416 -j DNAT --to-destination 10.10.23.143:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3417 -j DNAT --to-destination 10.10.23.209:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3418 -j DNAT --to-destination 10.10.23.85:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3419 -j DNAT --to-destination 10.10.23.73:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3420 -j DNAT --to-destination 10.10.23.129:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3421 -j DNAT --to-destination 10.10.23.140:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3422 -j DNAT --to-destination 10.10.23.172:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3423 -j DNAT --to-destination 10.10.24.155:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3424 -j DNAT --to-destination 10.10.24.155:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3425 -j DNAT --to-destination 10.10.23.29:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3426 -j DNAT --to-destination 10.10.23.158:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3427 -j DNAT --to-destination 10.10.23.117:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3428 -j DNAT --to-destination 10.10.23.207:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3429 -j DNAT --to-destination 10.10.23.142:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3431 -j DNAT --to-destination 10.10.23.122:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3432 -j DNAT --to-destination 10.10.23.86:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3433 -j DNAT --to-destination 10.10.23.134:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3434 -j DNAT --to-destination 10.10.23.137:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3435 -j DNAT --to-destination 10.10.23.149:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3436 -j DNAT --to-destination 10.10.23.126:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3437 -j DNAT --to-destination 10.10.23.57:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3438 -j DNAT --to-destination 10.10.23.227:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3439 -j DNAT --to-destination 10.10.23.34:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3440 -j DNAT --to-destination 10.10.23.234:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3441 -j DNAT --to-destination 10.10.24.99:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3442 -j DNAT --to-destination 10.10.23.125:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3443 -j DNAT --to-destination 10.10.23.189:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3444 -j DNAT --to-destination 10.10.23.161:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3445 -j DNAT --to-destination 10.10.23.202:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3446 -j DNAT --to-destination 10.10.23.53:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3447 -j DNAT --to-destination 10.10.23.182:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3449 -j DNAT --to-destination 10.10.23.116:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3450 -j DNAT --to-destination 10.10.23.114:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3451 -j DNAT --to-destination 10.10.24.157:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3452 -j DNAT --to-destination 10.10.23.65:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3453 -j DNAT --to-destination 10.10.23.70:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3454 -j DNAT --to-destination 10.10.23.220:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 3500 -j DNAT --to-destination 10.10.23.22:3389

-A PREROUTING -i eth1 -p tcp -m tcp --dport 1723 -j DNAT --to-destination 10.10.23.95:1723

-A PREROUTING -i eth1 -p gre -j DNAT --to-destination 10.10.23.95

-A POSTROUTING -o eth1 -j MASQUERADE

COMMIT

# Completed on Tue Oct 4 11:38:00 2005

# Generated by iptables-save v1.2.11 on Tue Oct 4 11:38:00 2005

*mangle

:PREROUTING ACCEPT [109072319:61314970621]

:INPUT ACCEPT [6816859:842823101]

:FORWARD ACCEPT [102406854:60502331385]

:OUTPUT ACCEPT [5668140:665317946]

:POSTROUTING ACCEPT [107990157:61163410755]

COMMIT

# Completed on Tue Oct 4 11:38:00 2005

# Generated by iptables-save v1.2.11 on Tue Oct 4 11:38:00 2005

*filter

:INPUT DROP [29:1564]

:FORWARD DROP [0:0]

:OUTPUT ACCEPT [2827:355089]

:bad_packets - [0:0]

:bad_tcp_packets - [0:0]

:icmp_packets - [0:0]

:tcp_inbound - [0:0]

:tcp_outbound - [0:0]

:udp_inbound - [0:0]

:udp_outbound - [0:0]

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

-A INPUT -i eth0 -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -d 10.10.24.0/255.255.255.0 -i eth0 -j ACCEPT

-A INPUT -p gre -j ACCEPT

-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT

-A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT

-A INPUT -i eth0 -p tcp -m tcp --dport 53 -j ACCEPT

-A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -p tcp -m multiport --dports 21,25,80,110,1723,3389,3450,3500,6881 -j ACCEPT

-A FORWARD -i eth1 -p tcp -m tcp --dport 3389:3500 -j ACCEPT

-A FORWARD -d 10.10.23.95 -p tcp -m tcp --dport 1723 -j ACCEPT

-A FORWARD -d 10.10.23.80 -p udp -m udp --dport 6881 -j ACCEPT

-A FORWARD -i eth0 -o eth1 -j ACCEPT

-A FORWARD -d 10.10.24.0/255.255.255.0 -i eth0 -j ACCEPT

-A FORWARD -d 10.10.23.95 -i eth1 -p gre -j ACCEPT

-A FORWARD -d 10.10.23.95 -i eth1 -p tcp -m tcp --dport 1723 -j ACCEPT

-A FORWARD -j LOG

-A FORWARD -d 10.10.23.48 -p tcp -m tcp --dport 5631 -j ACCEPT

-A FORWARD -d 10.10.23.48 -p udp -m udp --dport 5632 -j ACCEPT

-A bad_packets -s 10.10.23.0/255.255.255.0 -i eth1 -j LOG --log-prefix "Illegal source: "

-A bad_packets -s 10.10.23.0/255.255.255.0 -i eth1 -j DROP

-A bad_packets -m state --state INVALID -j LOG --log-prefix "Invalid packet: "

-A bad_packets -m state --state INVALID -j DROP

-A bad_packets -p tcp -j bad_tcp_packets

-A bad_packets -j RETURN

-A bad_tcp_packets -i eth0 -p tcp -j RETURN

-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not syn: "

-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP

-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j LOG --log-prefix "Stealth scan: "

-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP

-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j LOG --log-prefix "Stealth scan: "

-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP

-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j LOG --log-prefix "Stealth scan: "

-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP

-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j LOG --log-prefix "Stealth scan: "

-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP

-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "Stealth scan: "

-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP

-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LOG --log-prefix "Stealth scan: "

-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP

-A bad_tcp_packets -p tcp -j RETURN

-A icmp_packets -p icmp -f -j LOG --log-prefix "ICMP Fragment: "

-A icmp_packets -p icmp -f -j DROP

-A icmp_packets -p icmp -m icmp --icmp-type 8 -j DROP

-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT

-A icmp_packets -p icmp -j RETURN

-A tcp_inbound -p tcp -m tcp --dport 113 -j REJECT --reject-with icmp-port-unreachable

-A tcp_inbound -p tcp -m tcp --dport 25 -j ACCEPT

-A tcp_inbound -p tcp -m tcp --dport 110 -j ACCEPT

-A tcp_inbound -p tcp -m tcp --dport 143 -j ACCEPT

-A tcp_inbound -p tcp -m tcp --dport 22 -j ACCEPT

-A tcp_inbound -p tcp -j RETURN

-A tcp_outbound -p tcp -j ACCEPT

-A udp_inbound -p udp -m udp --dport 137 -j DROP

-A udp_inbound -p udp -m udp --dport 138 -j DROP

-A udp_inbound -p udp -m udp --dport 113 -j REJECT --reject-with icmp-port-unreachable

-A udp_inbound -p udp -m udp --sport 67 --dport 68 -j ACCEPT

-A udp_inbound -p udp -j RETURN

-A udp_outbound -p udp -j ACCEPT

COMMIT

# Completed on Tue Oct 4 11:38:00 2005

Link to post
Share on other sites
Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...