API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Dec 2nd, 2014
169
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.35 KB | None | 0 0
raw download clone embed print report
  1.  
  2. # Generated by iptables-save v1.4.21 on Fri Nov 28 16:27:19 2014
  3. *nat
  4. :PREROUTING ACCEPT [177:14755]
  5. :INPUT ACCEPT [4:204]
  6. :OUTPUT ACCEPT [21:1254]
  7. :POSTROUTING ACCEPT [0:0]
  8. -A POSTROUTING -o eth0 -j MASQUERADE
  9. -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
  10. -A POSTROUTING -s 192.168.10.0/24 -o eth0 -j MASQUERADE
  11. COMMIT
  12. # Completed on Fri Nov 28 16:27:19 2014
  13. # Generated by iptables-save v1.4.21 on Fri Nov 28 16:27:19 2014
  14. *filter
  15. :INPUT DROP [10:328]
  16. :FORWARD DROP [0:0]
  17. :OUTPUT DROP [6:192]
  18. :fail2ban-ssh - [0:0]
  19. :ufw-after-forward - [0:0]
  20. :ufw-after-input - [0:0]
  21. :ufw-after-logging-forward - [0:0]
  22. :ufw-after-logging-input - [0:0]
  23. :ufw-after-logging-output - [0:0]
  24. :ufw-after-output - [0:0]
  25. :ufw-before-forward - [0:0]
  26. :ufw-before-input - [0:0]
  27. :ufw-before-logging-forward - [0:0]
  28. :ufw-before-logging-input - [0:0]
  29. :ufw-before-logging-output - [0:0]
  30. :ufw-before-output - [0:0]
  31. :ufw-logging-allow - [0:0]
  32. :ufw-logging-deny - [0:0]
  33. :ufw-not-local - [0:0]
  34. :ufw-reject-forward - [0:0]
  35. :ufw-reject-input - [0:0]
  36. :ufw-reject-output - [0:0]
  37. :ufw-skip-to-policy-forward - [0:0]
  38. :ufw-skip-to-policy-input - [0:0]
  39. :ufw-skip-to-policy-output - [0:0]
  40. :ufw-track-forward - [0:0]
  41. :ufw-track-input - [0:0]
  42. :ufw-track-output - [0:0]
  43. :ufw-user-forward - [0:0]
  44. :ufw-user-input - [0:0]
  45. :ufw-user-limit - [0:0]
  46. :ufw-user-limit-accept - [0:0]
  47. :ufw-user-logging-forward - [0:0]
  48. :ufw-user-logging-input - [0:0]
  49. :ufw-user-logging-output - [0:0]
  50. :ufw-user-output - [0:0]
  51. -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
  52. -A INPUT -j ufw-before-logging-input
  53. -A INPUT -j ufw-before-input
  54. -A INPUT -j ufw-after-input
  55. -A INPUT -j ufw-after-logging-input
  56. -A INPUT -j ufw-reject-input
  57. -A INPUT -j ufw-track-input
  58. -A INPUT -p udp -m udp --dport 53 -j ACCEPT
  59. -A INPUT -p udp -m udp --dport 53 -j ACCEPT
  60. -A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
  61. -A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
  62. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  63. -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
  64. -A INPUT -i tun+ -j ACCEPT
  65. -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  66. -A FORWARD -i tun+ -o eth0 -p udp -m udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
  67. -A FORWARD -j ufw-before-logging-forward
  68. -A FORWARD -j ufw-before-forward
  69. -A FORWARD -j ufw-after-forward
  70. -A FORWARD -j ufw-after-logging-forward
  71. -A FORWARD -j ufw-reject-forward
  72. -A FORWARD -j ufw-track-forward
  73. -A FORWARD -i tun+ -j ACCEPT
  74. -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
  75. -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
  76. -A OUTPUT -j ufw-before-logging-output
  77. -A OUTPUT -j ufw-before-output
  78. -A OUTPUT -j ufw-after-output
  79. -A OUTPUT -j ufw-after-logging-output
  80. -A OUTPUT -j ufw-reject-output
  81. -A OUTPUT -j ufw-track-output
  82. -A OUTPUT -p udp -m udp --sport 53 -j ACCEPT
  83. -A OUTPUT -o tun+ -j ACCEPT
  84. -A fail2ban-ssh -j RETURN
  85. -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
  86. -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
  87. -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
  88. -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
  89. -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
  90. -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
  91. -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
  92. -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  93. -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  94. -A ufw-after-logging-output -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  95. -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  96. -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
  97. -A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
  98. -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
  99. -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
  100. -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
  101. -A ufw-before-forward -j ufw-user-forward
  102. -A ufw-before-input -i lo -j ACCEPT
  103. -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  104. -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
  105. -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
  106. -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
  107. -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
  108. -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
  109. -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
  110. -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
  111. -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
  112. -A ufw-before-input -j ufw-not-local
  113. -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
  114. -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
  115. -A ufw-before-input -j ufw-user-input
  116. -A ufw-before-output -o lo -j ACCEPT
  117. -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  118. -A ufw-before-output -j ufw-user-output
  119. -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
  120. -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
  121. -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  122. -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
  123. -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
  124. -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
  125. -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
  126. -A ufw-not-local -j DROP
  127. -A ufw-skip-to-policy-forward -j DROP
  128. -A ufw-skip-to-policy-input -j DROP
  129. -A ufw-skip-to-policy-output -j DROP
  130. -A ufw-user-input -s 192.168.0.114/32 -p tcp -m tcp --dport 22 -j ACCEPT
  131. -A ufw-user-input -s 192.168.0.114/32 -p udp -m udp --dport 22 -j ACCEPT
  132. -A ufw-user-input -p tcp -m tcp --dport 80 -j ACCEPT
  133. -A ufw-user-input -p udp -m udp --dport 80 -j ACCEPT
  134. -A ufw-user-input -p tcp -m tcp --dport 443 -j ACCEPT
  135. -A ufw-user-input -p udp -m udp --dport 443 -j ACCEPT
  136. -A ufw-user-input -p udp -m udp --dport 9987 -j ACCEPT
  137. -A ufw-user-input -p tcp -m tcp --dport 10011 -j ACCEPT
  138. -A ufw-user-input -p tcp -m tcp --dport 30033 -j ACCEPT
  139. -A ufw-user-input -s 192.168.0.198/32 -p tcp -m tcp --dport 22 -j ACCEPT
  140. -A ufw-user-input -s 192.168.0.198/32 -p udp -m udp --dport 22 -j ACCEPT
  141. -A ufw-user-input -p tcp -m tcp --dport 443 -j ACCEPT
  142. -A ufw-user-input -p tcp -m tcp --dport 943 -j ACCEPT
  143. -A ufw-user-input -p udp -m udp --dport 1194 -j ACCEPT
  144. -A ufw-user-input -s 192.168.0.129/32 -p tcp -m tcp --dport 22 -j ACCEPT
  145. -A ufw-user-input -s 192.168.0.129/32 -p udp -m udp --dport 22 -j ACCEPT
  146. -A ufw-user-input -s 192.168.0.130/32 -p tcp -m tcp --dport 22 -j ACCEPT
  147. -A ufw-user-input -s 192.168.0.130/32 -p udp -m udp --dport 22 -j ACCEPT
  148. -A ufw-user-input -s 81.83.13.34/32 -p tcp -m tcp --dport 22 -j ACCEPT
  149. -A ufw-user-input -s 81.83.13.34/32 -p udp -m udp --dport 22 -j ACCEPT
  150. -A ufw-user-input -s 8.8.8.8/32 -p udp -m udp --dport 53 -j ACCEPT
  151. -A ufw-user-input -s 8.8.4.4/32 -p udp -m udp --dport 53 -j ACCEPT
  152. -A ufw-user-input -s 8.8.8.8/32 -p tcp -m tcp --dport 53 -j ACCEPT
  153. -A ufw-user-input -s 8.8.4.4/32 -p tcp -m tcp --dport 53 -j ACCEPT
  154. -A ufw-user-input -s 10.8.0.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
  155. -A ufw-user-input -s 10.8.0.0/24 -p tcp -m tcp --dport 443 -j ACCEPT
  156. -A ufw-user-input -p tcp -m tcp --dport 1194 -j ACCEPT
  157. -A ufw-user-input -p tcp -m tcp --dport 53 -j ACCEPT
  158. -A ufw-user-input -p udp -m udp --dport 53 -j ACCEPT
  159. -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
  160. -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
  161. -A ufw-user-limit-accept -j ACCEPT
  162. -A ufw-user-output -p udp -m udp --dport 1194 -j ACCEPT
  163. -A ufw-user-output -p tcp -m multiport --dports 25,53,80,110,443 -j ACCEPT
  164. -A ufw-user-output -p udp -m multiport --dports 53,67,68 -j ACCEPT
  165. -A ufw-user-output -p tcp -m tcp --dport 51413 -j ACCEPT
  166. -A ufw-user-output -p udp -m udp --dport 51413 -j ACCEPT
  167. -A ufw-user-output -p tcp -m tcp --dport 6969 -j ACCEPT
  168. -A ufw-user-output -p tcp -m tcp --dport 53 -j ACCEPT
  169. -A ufw-user-output -p udp -m udp --dport 53 -j ACCEPT
  170. COMMIT
  171. # Completed on Fri Nov 28 16:27:19 2014
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!