API tools faq
paste
Guest User

Untitled

a guest
Jun 12th, 2014
305
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.99 KB | None | 0 0
raw download clone embed print report
  1. # Generated by iptables-save v1.4.21 on Thu Jun 12 08:20:04 2014
  2. *nat
  3. :PREROUTING ACCEPT [9:1105]
  4. :INPUT ACCEPT [8:1065]
  5. :OUTPUT ACCEPT [0:0]
  6. :POSTROUTING ACCEPT [0:0]
  7. :AS0_NAT - [0:0]
  8. :AS0_NAT_POST_REL_EST - [0:0]
  9. :AS0_NAT_PRE - [0:0]
  10. :AS0_NAT_PRE_REL_EST - [0:0]
  11. :AS0_NAT_TEST - [0:0]
  12. -A PREROUTING -m state --state RELATED,ESTABLISHED -j AS0_NAT_PRE_REL_EST
  13. -A POSTROUTING -m state --state RELATED,ESTABLISHED -j AS0_NAT_POST_REL_EST
  14. -A POSTROUTING -m mark --mark 0x2000000/0x2000000 -j AS0_NAT_PRE
  15. -A POSTROUTING -j SNAT --to-source 188.226.212.189
  16. -A POSTROUTING -j SNAT --to-source 188.226.212.189
  17. -A POSTROUTING -j SNAT --to-source 188.226.212.189
  18. -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
  19. -A POSTROUTING -o eth0 -j MASQUERADE
  20. -A POSTROUTING -o ppp0 -j MASQUERADE
  21. -A AS0_NAT -o eth0 -j SNAT --to-source 188.226.212.189
  22. -A AS0_NAT -o eth1 -j SNAT --to-source 10.129.189.133
  23. -A AS0_NAT -j ACCEPT
  24. -A AS0_NAT_POST_REL_EST -j ACCEPT
  25. -A AS0_NAT_PRE -m mark --mark 0x8000000/0x8000000 -j AS0_NAT
  26. -A AS0_NAT_PRE -d 192.168.0.0/16 -j AS0_NAT_TEST
  27. -A AS0_NAT_PRE -d 172.16.0.0/12 -j AS0_NAT_TEST
  28. -A AS0_NAT_PRE -d 10.0.0.0/8 -j AS0_NAT_TEST
  29. -A AS0_NAT_PRE -j AS0_NAT
  30. -A AS0_NAT_PRE_REL_EST -j ACCEPT
  31. -A AS0_NAT_TEST -o as0t+ -j ACCEPT
  32. -A AS0_NAT_TEST -m mark --mark 0x4000000/0x4000000 -j ACCEPT
  33. -A AS0_NAT_TEST -d 10.0.0.0/20 -j ACCEPT
  34. -A AS0_NAT_TEST -d 172.27.224.0/20 -j ACCEPT
  35. -A AS0_NAT_TEST -j AS0_NAT
  36. COMMIT
  37. # Completed on Thu Jun 12 08:20:04 2014
  38. # Generated by iptables-save v1.4.21 on Thu Jun 12 08:20:04 2014
  39. *filter
  40. :INPUT DROP [1:40]
  41. :FORWARD DROP [0:0]
  42. :OUTPUT ACCEPT [0:0]
  43. :AS0_ACCEPT - [0:0]
  44. :AS0_IN - [0:0]
  45. :AS0_IN_NAT - [0:0]
  46. :AS0_IN_POST - [0:0]
  47. :AS0_IN_PRE - [0:0]
  48. :AS0_IN_ROUTE - [0:0]
  49. :AS0_OUT - [0:0]
  50. :AS0_OUT_LOCAL - [0:0]
  51. :AS0_OUT_POST - [0:0]
  52. :AS0_OUT_S2C - [0:0]
  53. :AS0_WEBACCEPT - [0:0]
  54. :ufw-after-forward - [0:0]
  55. :ufw-after-input - [0:0]
  56. :ufw-after-logging-forward - [0:0]
  57. :ufw-after-logging-input - [0:0]
  58. :ufw-after-logging-output - [0:0]
  59. :ufw-after-output - [0:0]
  60. :ufw-before-forward - [0:0]
  61. :ufw-before-input - [0:0]
  62. :ufw-before-logging-forward - [0:0]
  63. :ufw-before-logging-input - [0:0]
  64. :ufw-before-logging-output - [0:0]
  65. :ufw-before-output - [0:0]
  66. :ufw-logging-allow - [0:0]
  67. :ufw-logging-deny - [0:0]
  68. :ufw-not-local - [0:0]
  69. :ufw-reject-forward - [0:0]
  70. :ufw-reject-input - [0:0]
  71. :ufw-reject-output - [0:0]
  72. :ufw-skip-to-policy-forward - [0:0]
  73. :ufw-skip-to-policy-input - [0:0]
  74. :ufw-skip-to-policy-output - [0:0]
  75. :ufw-track-forward - [0:0]
  76. :ufw-track-input - [0:0]
  77. :ufw-track-output - [0:0]
  78. :ufw-user-forward - [0:0]
  79. :ufw-user-input - [0:0]
  80. :ufw-user-limit - [0:0]
  81. :ufw-user-limit-accept - [0:0]
  82. :ufw-user-logging-forward - [0:0]
  83. :ufw-user-logging-input - [0:0]
  84. :ufw-user-logging-output - [0:0]
  85. :ufw-user-output - [0:0]
  86. -A INPUT -m state --state RELATED,ESTABLISHED -j AS0_ACCEPT
  87. -A INPUT -i lo -j AS0_ACCEPT
  88. -A INPUT -m mark --mark 0x2000000/0x2000000 -j AS0_IN_PRE
  89. -A INPUT -d 188.226.212.189/32 -p udp -m state --state NEW -m udp --dport 1194 -j AS0_ACCEPT
  90. -A INPUT -d 188.226.212.189/32 -p tcp -m state --state NEW -m tcp --dport 443 -j AS0_ACCEPT
  91. -A INPUT -s 10.0.0.0/8 -i ppp0 -j ACCEPT
  92. -A INPUT -m state --state RELATED,ESTABLISHED -j AS0_WEBACCEPT
  93. -A INPUT -d 188.226.212.189/32 -p tcp -m state --state NEW -m tcp --dport 943 -j AS0_WEBACCEPT
  94. -A INPUT -j ufw-before-logging-input
  95. -A INPUT -j ufw-before-input
  96. -A INPUT -j ufw-after-input
  97. -A INPUT -j ufw-after-logging-input
  98. -A INPUT -j ufw-reject-input
  99. -A INPUT -j ufw-track-input
  100. -A FORWARD -m state --state RELATED,ESTABLISHED -j AS0_ACCEPT
  101. -A FORWARD -m mark --mark 0x2000000/0x2000000 -j AS0_IN_PRE
  102. -A FORWARD -o as0t+ -j AS0_OUT_S2C
  103. -A FORWARD -s 10.8.0.0/24 -j ACCEPT
  104. -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
  105. -A FORWARD -j ufw-before-logging-forward
  106. -A FORWARD -j ufw-before-forward
  107. -A FORWARD -j ufw-after-forward
  108. -A FORWARD -j ufw-after-logging-forward
  109. -A FORWARD -j ufw-reject-forward
  110. -A FORWARD -j ufw-track-forward
  111. -A FORWARD -i eth0 -j ACCEPT
  112. -A OUTPUT -o as0t+ -j AS0_OUT_LOCAL
  113. -A OUTPUT -j ufw-before-logging-output
  114. -A OUTPUT -j ufw-before-output
  115. -A OUTPUT -j ufw-after-output
  116. -A OUTPUT -j ufw-after-logging-output
  117. -A OUTPUT -j ufw-reject-output
  118. -A OUTPUT -j ufw-track-output
  119. -A AS0_ACCEPT -j ACCEPT
  120. -A AS0_IN -d 172.27.224.1/32 -j ACCEPT
  121. -A AS0_IN -j AS0_IN_POST
  122. -A AS0_IN_NAT -j MARK --set-xmark 0x8000000/0x8000000
  123. -A AS0_IN_NAT -j ACCEPT
  124. -A AS0_IN_POST -d 10.129.0.0/16 -j ACCEPT
  125. -A AS0_IN_POST -o as0t+ -j AS0_OUT
  126. -A AS0_IN_POST -j DROP
  127. -A AS0_IN_PRE -d 192.168.0.0/16 -j AS0_IN
  128. -A AS0_IN_PRE -d 172.16.0.0/12 -j AS0_IN
  129. -A AS0_IN_PRE -d 10.0.0.0/8 -j AS0_IN
  130. -A AS0_IN_PRE -j ACCEPT
  131. -A AS0_IN_ROUTE -j MARK --set-xmark 0x4000000/0x4000000
  132. -A AS0_IN_ROUTE -j ACCEPT
  133. -A AS0_OUT -j AS0_OUT_POST
  134. -A AS0_OUT_LOCAL -p icmp -m icmp --icmp-type 5 -j DROP
  135. -A AS0_OUT_LOCAL -j ACCEPT
  136. -A AS0_OUT_POST -m mark --mark 0x2000000/0x2000000 -j ACCEPT
  137. -A AS0_OUT_POST -j DROP
  138. -A AS0_OUT_S2C -j AS0_OUT
  139. -A AS0_WEBACCEPT -j ACCEPT
  140. -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
  141. -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
  142. -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
  143. -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
  144. -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
  145. -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
  146. -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
  147. -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  148. -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  149. -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  150. -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
  151. -A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
  152. -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
  153. -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
  154. -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
  155. -A ufw-before-forward -j ufw-user-forward
  156. -A ufw-before-input -i lo -j ACCEPT
  157. -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  158. -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
  159. -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
  160. -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
  161. -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
  162. -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
  163. -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
  164. -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
  165. -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
  166. -A ufw-before-input -j ufw-not-local
  167. -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
  168. -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
  169. -A ufw-before-input -j ufw-user-input
  170. -A ufw-before-output -o lo -j ACCEPT
  171. -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  172. -A ufw-before-output -j ufw-user-output
  173. -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
  174. -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
  175. -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  176. -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
  177. -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
  178. -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
  179. -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
  180. -A ufw-not-local -j DROP
  181. -A ufw-skip-to-policy-forward -j DROP
  182. -A ufw-skip-to-policy-input -j DROP
  183. -A ufw-skip-to-policy-output -j ACCEPT
  184. -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
  185. -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
  186. -A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
  187. -A ufw-user-input -p udp -m udp --dport 22 -j ACCEPT
  188. -A ufw-user-input -p tcp -m tcp --dport 1194 -j ACCEPT
  189. -A ufw-user-input -p udp -m udp --dport 1194 -j ACCEPT
  190. -A ufw-user-input -p tcp -m tcp --dport 80 -j ACCEPT
  191. -A ufw-user-input -p udp -m udp --dport 80 -j ACCEPT
  192. -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
  193. -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
  194. -A ufw-user-limit-accept -j ACCEPT
  195. COMMIT
  196. # Completed on Thu Jun 12 08:20:04 2014
  197. # Generated by iptables-save v1.4.21 on Thu Jun 12 08:20:04 2014
  198. *mangle
  199. :PREROUTING ACCEPT [11:1209]
  200. :INPUT ACCEPT [139:14865]
  201. :FORWARD ACCEPT [0:0]
  202. :OUTPUT ACCEPT [115:111181]
  203. :POSTROUTING ACCEPT [115:111181]
  204. :AS0_MANGLE_PRE_REL_EST - [0:0]
  205. :AS0_MANGLE_TUN - [0:0]
  206. -A PREROUTING -m state --state RELATED,ESTABLISHED -j AS0_MANGLE_PRE_REL_EST
  207. -A PREROUTING -i as0t+ -j AS0_MANGLE_TUN
  208. -A AS0_MANGLE_PRE_REL_EST -j ACCEPT
  209. -A AS0_MANGLE_TUN -j MARK --set-xmark 0x2000000/0xffffffff
  210. -A AS0_MANGLE_TUN -j ACCEPT
  211. COMMIT
  212. # Completed on Thu Jun 12 08:20:04 2014
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!