API tools faq
paste
NotCry

iptables

NotCry
Nov 8th, 2011
138
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 13.04 KB | None | 0 0
raw download clone embed print report
  1. # Generated by iptables-save v1.3.5 on Thu Mar 12 12:40:37 2009
  2. *nat
  3. :PREROUTING ACCEPT [206:24717]
  4. :POSTROUTING ACCEPT [1:70]
  5. :OUTPUT ACCEPT [35:2703]
  6. #-A POSTROUTING -o eth0 -p tcp -s 192.168.1.133 -j SNAT --to-source *внешний ip*
  7. -A POSTROUTING -o eth0 -j MASQUERADE
  8. # .............. .......... .. .................... .... .... .................. .......... ........
  9. #-A POSTROUTING -p tcp -s 192.168.1.0/24 -d 192.168.1.170 --dport 8082 -j SNAT --to-source 192.168.1.33
  10. -A POSTROUTING -p tcp -s 192.168.1.0/24 -d 192.168.1.53 --dport 8000 -j SNAT --to-source 192.168.1.33
  11. #
  12. # buhgalter
  13. #
  14. # -A PREROUTING -p tcp -m tcp --dport 3389 -i eth0 -j DNAT --to 192.168.3.3
  15. # torrent for 192.168.1.133
  16. -A PREROUTING -p tcp -m tcp --dport 49555 -i eth0 -j DNAT --to 192.168.1.133
  17. -A PREROUTING -p udp -m udp --dport 49555 -i eth0 -j DNAT --to 192.168.1.133
  18. -A PREROUTING -p udp -m udp --dport 57555 -i eth0 -j DNAT --to 192.168.1.133
  19. -A PREROUTING -p tcp --dport 52295 -i eth0 -j DNAT --to 192.168.1.202
  20. -A PREROUTING -p udp --dport 52295 -i eth0 -j DNAT --to 192.168.1.202
  21. #mstsc
  22. -A PREROUTING -p tcp -d *внешний ip* --dport 3389 -i eth0 -j DNAT --to 192.168.1.47:3389
  23. -A PREROUTING -p tcp -d *внешний ip* --dport 445 -i eth0 -j DNAT --to 192.168.1.47:445
  24. -A PREROUTING -p udp -d *внешний ip* --dport 135 -i eth0 -j DNAT --to 192.168.1.47:135
  25. -A PREROUTING -p udp -d *внешний ip* --dport 136 -i eth0 -j DNAT --to 192.168.1.47:136
  26. -A PREROUTING -p udp -d *внешний ip* --dport 137 -i eth0 -j DNAT --to 192.168.1.47:137
  27. -A PREROUTING -p udp -d *внешний ip* --dport 138 -i eth0 -j DNAT --to 192.168.1.47:138
  28. -A PREROUTING -p udp -d *внешний ip* --dport 139 -i eth0 -j DNAT --to 192.168.1.47:139
  29. #tcp
  30. -A PREROUTING -p tcp -d *внешний ip* --dport 135 -i eth0 -j DNAT --to 192.168.1.47:135
  31. -A PREROUTING -p tcp -d *внешний ip* --dport 136 -i eth0 -j DNAT --to 192.168.1.47:136
  32. -A PREROUTING -p tcp -d *внешний ip* --dport 137 -i eth0 -j DNAT --to 192.168.1.47:137
  33. -A PREROUTING -p tcp -d *внешний ip* --dport 138 -i eth0 -j DNAT --to 192.168.1.47:138
  34. -A PREROUTING -p tcp -d *внешний ip* --dport 139 -i eth0 -j DNAT --to 192.168.1.47:139
  35. # Emule
  36. -A PREROUTING -p tcp --dport 29120 -i eth0 -j DNAT --to 192.168.1.133
  37. -A PREROUTING -p udp --dport 12148 -i eth0 -j DNAT --to 192.168.1.133
  38. #-A PREROUTING -i eth0 -j DNAT --to 192.168.1.133
  39. #-A PREROUTING -i eth0 -j DNAT --to 192.168.1.172
  40. #
  41. # server ART ssh
  42. #
  43. -A PREROUTING -p tcp --dport 2320 -i eth0 -j DNAT --to 192.168.1.69:2320
  44. #
  45. # server UBUNTU
  46. -A PREROUTING -p tcp --dport 2121 -i eth0 -j DNAT --to 192.168.1.52:21
  47. -A PREROUTING -p udp --dport 2121 -i eth0 -j DNAT --to 192.168.1.52:21
  48. -A PREROUTING -p tcp --dport 3307 -i eth0 -j DNAT --to 192.168.1.52:3306
  49. #-A PREROUTING -p tcp --dport 8080 -i eth0 -j DNAT --to 192.168.1.52:8080
  50. #-A PREROUTING -p tcp --dport 2325 -i eth0 -j DNAT --to 192.168.1.52:22
  51. #-A PREROUTING -p tcp --dport 3307 -i eth0 -j DNAT --to 192.168.1.52:3306
  52. #-A PREROUTING -p tcp --dport 3000 -i eth0 -j DNAT --to 192.168.1.52:3000
  53. #-A PREROUTING -p tcp --dport 80 -d *внешний ip* -i eth0 -j ACCEPT
  54.  
  55. #-A PREROUTING -p tcp --dport 80 -i eth0 -j DNAT --to-destination 192.168.1.52:80
  56.  
  57. #
  58. # ANOTHER one server
  59. -A PREROUTING -p tcp --dport 8000 -j DNAT --to 192.168.1.53:8000
  60. #-A PREROUTING -p tcp --dport 8001 -j DNAT --to 192.168.1.53:8001
  61. #-A PREROUTING -p tcp --dport 2323 -j DNAT --to 192.168.1.53:22
  62. #-A PREROUTING -p tcp --dport 2324 -j DNAT --to 192.168.1.170:22
  63. #
  64. #
  65. -A PREROUTING -p udp -m udp --dport 4262 -i eth0 -j DNAT --to 192.168.1.133
  66. -A PREROUTING -p udp -m udp --dport 4272 -i eth0 -j DNAT --to 192.168.1.133
  67. -A PREROUTING -p udp -m udp --dport 4662 -i eth0 -j DNAT --to 192.168.1.133
  68. -A PREROUTING -p udp -m udp --dport 4672 -i eth0 -j DNAT --to 192.168.1.133
  69. -A PREROUTING -p tcp -m tcp --dport 4262 -i eth0 -j DNAT --to 192.168.1.133
  70. -A PREROUTING -p tcp -m tcp --dport 4272 -i eth0 -j DNAT --to 192.168.1.133
  71. -A PREROUTING -p tcp -m tcp --dport 4662 -i eth0 -j DNAT --to 192.168.1.133
  72. -A PREROUTING -p tcp -m tcp --dport 4672 -i eth0 -j DNAT --to 192.168.1.133
  73. #
  74. #
  75. COMMIT
  76. # Completed on Thu Mar 12 12:40:37 2009
  77. # Generated by iptables-save v1.3.5 on Thu Mar 12 12:40:37 2009
  78. *filter
  79. :INPUT DROP [0:0]
  80. :FORWARD DROP [0:0]
  81. :OUTPUT ACCEPT [30476:21384262]
  82. :RH-Firewall-1-INPUT - [0:0]
  83. #
  84. -A INPUT -i lo -j ACCEPT
  85. -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 3/s -j ACCEPT
  86. -A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
  87. -A INPUT -p icmp -j ACCEPT
  88. #
  89. -A INPUT -i tun0 -j ACCEPT
  90. -A INPUT -i tun1 -j ACCEPT
  91. -A INPUT -i tun2 -j ACCEPT
  92. -A INPUT -i tun3 -j ACCEPT
  93. -A INPUT -i tun4 -j ACCEPT
  94. #
  95. #####
  96. -A INPUT -s 192.168.1.115 -j DROP
  97. #####
  98. #
  99. -A INPUT -s 192.168.1.0/24 -j ACCEPT
  100. -A INPUT -s 192.168.3.0/24 -j ACCEPT
  101. -A INPUT -s 172.16.0.0/24 -j ACCEPT
  102. -A INPUT -s 192.168.12.0/24 -j ACCEPT
  103. ##### SPAM from
  104. -A INPUT -s 202.102.72.59 -j DROP
  105. -A INPUT -s 217.219.167.200 -j DROP
  106. -A INPUT -s 209.238.128.205 -j DROP
  107. # SMTP
  108. -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
  109. #-A INPUT -p udp -m udp --dport 25 -j ACCEPT
  110. #-A INPUT -p tcp -m tcp --sport 25 -j ACCEPT
  111. #-A INPUT -p udp -m udp --sport 25 -j ACCEPT
  112. # SSH
  113. -A INPUT -p tcp -m tcp --dport 2310 -j ACCEPT
  114. -A INPUT -p udp -m udp --dport 2310 -j ACCEPT
  115. -A INPUT -p tcp -m tcp --sport 2310 -j ACCEPT
  116. -A INPUT -p udp -m udp --sport 2310 -j ACCEPT
  117. #
  118. # DNS
  119. -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
  120. -A INPUT -p udp -m udp --dport 53 -j ACCEPT
  121. -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
  122. -A INPUT -p udp -m udp --sport 53 -j ACCEPT
  123. #
  124. #
  125. # PPTP
  126. -A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT
  127. -A INPUT -p tcp -m tcp --sport 1723 -j ACCEPT
  128. -A INPUT -p 47 -j ACCEPT
  129. -A INPUT -i ppp0 -j ACCEPT
  130. -A INPUT -i ppp1 -j ACCEPT
  131. -A INPUT -i ppp2 -j ACCEPT
  132. -A INPUT -i ppp3 -j ACCEPT
  133. -A INPUT -i ppp4 -j ACCEPT
  134. -A INPUT -i ppp5 -j ACCEPT
  135. #
  136. #
  137. # pop3 denied from world
  138. #
  139. -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
  140. #-A INPUT -p tcp -m tcp --sport 110 -j ACCEPT
  141. #
  142. -A INPUT -j RH-Firewall-1-INPUT
  143. #
  144. #-A FORWARD -p 47 -j ACCEPT
  145. -A FORWARD -p tcp -m tcp --dport 1723 -j ACCEPT
  146. -A FORWARD -i tun0 -j ACCEPT
  147. -A FORWARD -i tun1 -j ACCEPT
  148. -A FORWARD -i tun2 -j ACCEPT
  149. -A FORWARD -i tun3 -j ACCEPT
  150. -A FORWARD -s 10.10.10.0/24 -j ACCEPT
  151. -A FORWARD -d 10.10.10.0/24 -j ACCEPT
  152. -A FORWARD -i ppp0 -j ACCEPT
  153. -A FORWARD -i ppp1 -j ACCEPT
  154. -A FORWARD -i ppp2 -j ACCEPT
  155. -A FORWARD -i ppp3 -j ACCEPT
  156. -A FORWARD -i ppp4 -j ACCEPT
  157. -A FORWARD -i ppp5 -j ACCEPT
  158. #mstsc eth0
  159. -A FORWARD -i eth0 -s *старый ip* -d 192.168.1.47 -p tcp --dport 3389 -j ACCEPT
  160. -A FORWARD -i eth0 -s *старый ip* -d 192.168.1.47 -p tcp -j ACCEPT
  161. -A FORWARD -i eth0 -s *старый ip* -d 192.168.1.47 -p udp -j ACCEPT
  162. ############ ТУТ я сам дописывал, но не пускает #########################
  163. -A FORWARD -i eth0 -s *новый ip* -d 192.168.1.47 -p tcp -j ACCEPT
  164. -A FORWARD -i eth0 -s *новый ip* -d 192.168.1.47 -p udp -j ACCEPT
  165. -A FORWARD -i eth0 -s *новый ip* -d 192.168.1.47 -p tcp --dport 3389 -j ACCEPT
  166. -A FORWARD -i eth0 -s *новый ip* -d 192.168.1.47 -p tcp --dport 445 -j ACCEPT
  167. -A FORWARD -i eth0 -s *новый ip* -d 192.168.1.47 -p tcp --dport 139 -j ACCEPT
  168. ####################################################
  169. -A FORWARD -i eth0 -s 0/0 -d 192.168.1.47 -p tcp -j REJECT
  170. -A FORWARD -i eth0 -s 0/0 -d 192.168.1.47 -p udp -j REJECT
  171. #
  172. # BLACK LIST
  173. #-A INPUT -s 82.207.94.174 -j REJECT
  174. -A INPUT -d 77.242.193.231 -j REJECT
  175. -A INPUT -d 209.238.128.205 -j REJECT
  176. -A INPUT -d 77.242.193.0/24 -j REJECT
  177. -A INPUT -d std.hamachi.logmein.com -j REJECT
  178. -A INPUT -s 82.98.86.173 -j REJECT
  179. -A INPUT -d 82.98.86.173 -j REJECT
  180. -A INPUT -d 192.168.1.13 -j REJECT
  181. #-A INPUT -d 192.168.1.115 -j DROP
  182. #-A INPUT -d 192.168.1.109 -j REJECT
  183. #
  184. #
  185. # Close HAMACHI
  186. #-A FORWARD -d 77.242.193.0/24 -j DROP
  187. # ........................ ......
  188. #
  189. #-A FORWARD -p tcp -m tcp --dport 25 -j LOG
  190. -A FORWARD -s 192.168.1.133 -j ACCEPT
  191. #
  192. # server dionis
  193. -A FORWARD -s 192.168.1.5 -j ACCEPT
  194. # server gelios
  195. -A FORWARD -s 192.168.1.6 -j ACCEPT
  196. #mstsc
  197. -A FORWARD -s 192.168.1.47 -m state --state RELATED,ESTABLISHED -j ACCEPT
  198. # server AD
  199. -A FORWARD -s 192.168.1.34 -j ACCEPT
  200. -A FORWARD -s 192.168.1.35 -j ACCEPT
  201. -A FORWARD -s 192.168.1.53 -j ACCEPT
  202. # user
  203. -A FORWARD -s 192.168.1.172 -p tcp -m tcp --dport 80 -j ACCEPT
  204. #
  205. -A FORWARD -s 192.168.1.173 -p tcp -m tcp --dport 80 -j ACCEPT
  206. # Valentin
  207. -A FORWARD -s 192.168.1.174 -j ACCEPT
  208. # slaviya-invest
  209. #-A FORWARD -s 192.168.1.140 -j ACCEPT
  210. #
  211. # server buhgalter
  212. -A FORWARD -s 192.168.3.3 -d 192.168.1.133 -p tcp -j ACCEPT
  213. -A FORWARD -s 192.168.3.3 -d 192.168.1.40 -p tcp -j ACCEPT
  214. -A FORWARD -s 192.168.3.3 -d 192.168.1.0/24 -j DROP
  215. #
  216. # ICQ ALLOW
  217. -A FORWARD -s 192.168.1.2 -p tcp -m tcp --dport 5190 -j ACCEPT
  218. -A FORWARD -s 192.168.1.4 -p tcp -m tcp --dport 5190 -j ACCEPT
  219. ##################
  220. # NAT web for Access point
  221. -A FORWARD -s 192.168.1.40 -p tcp -m tcp --dport 80 -j ACCEPT
  222. -A FORWARD -s 192.168.1.41 -p tcp -m tcp --dport 80 -j ACCEPT
  223. -A FORWARD -s 192.168.1.42 -p tcp -m tcp --dport 80 -j ACCEPT
  224. -A FORWARD -s 192.168.1.43 -p tcp -m tcp --dport 80 -j ACCEPT
  225. -A FORWARD -s 192.168.1.44 -p tcp -m tcp --dport 80 -j ACCEPT
  226. -A FORWARD -s 192.168.1.45 -p tcp -m tcp --dport 80 -j ACCEPT
  227. -A FORWARD -s 192.168.1.46 -p tcp -m tcp --dport 80 -j ACCEPT
  228. -A FORWARD -s 192.168.1.47 -p tcp -m tcp --dport 80 -j ACCEPT
  229. -A FORWARD -s 192.168.1.48 -p tcp -m tcp --dport 80 -j ACCEPT
  230. -A FORWARD -s 192.168.1.49 -p tcp -m tcp --dport 80 -j ACCEPT
  231. #
  232. # WEB allow
  233. #
  234. -A FORWARD -s 192.168.1.34 -p tcp -m tcp --dport 80 -j ACCEPT
  235. -A FORWARD -s 192.168.1.52 -p tcp -m tcp --dport 80 -j ACCEPT
  236. -A FORWARD -s 192.168.1.53 -p tcp -m multiport --dport 80,8000 -j ACCEPT
  237. -A FORWARD -s 192.168.1.54 -p tcp -m tcp --dport 80 -j ACCEPT
  238. -A FORWARD -s 192.168.1.69 -p tcp -m tcp --dport 80 -j ACCEPT
  239. -A FORWARD -s 192.168.1.115 -p tcp -m tcp --dport 80 -j ACCEPT
  240. -A FORWARD -s 192.168.1.117 -p tcp -m tcp --dport 80 -j ACCEPT
  241. -A FORWARD -s 192.168.1.160 -p tcp -m tcp --dport 443 -j ACCEPT
  242. -A FORWARD -s 192.168.1.176 -p tcp -m tcp --dport 80 -j ACCEPT
  243. -A FORWARD -s 192.168.1.170 -p tcp -m multiport --dport 80,8082 -j ACCEPT
  244. -A FORWARD -s 192.168.1.188 -p tcp -m tcp --dport 80 -j ACCEPT
  245. -A FORWARD -s 192.168.1.101 -p tcp -m tcp --dport 80 -j ACCEPT
  246. -A FORWARD -s 192.168.1.120 -p tcp -m tcp --dport 80 -j ACCEPT
  247. -A FORWARD -s 192.168.1.202 -p tcp -m tcp --dport 80 -j ACCEPT
  248. -A FORWARD -s 192.168.12.61 -p tcp -m tcp --dport 80 -j ACCEPT
  249. -A FORWARD -s 192.168.1.233 -p tcp -m tcp --dport 80 -j ACCEPT
  250. -A FORWARD -s 192.168.3.3 -p tcp -m multiport --dport 80,443 -j ACCEPT
  251. #
  252. #test
  253. -A FORWARD -s 192.168.1.233 -p tcp -m tcp --dport 8000 -j ACCEPT
  254. #
  255. # ART ssh
  256. -A FORWARD -s 192.168.1.69 -p tcp -m tcp --dport 2320 -j ACCEPT
  257. -A FORWARD -s 192.168.1.69 -p udp -m udp --dport 2320 -j ACCEPT
  258. # DNS
  259. #-A FORWARD -s 192.168.1.0/24 -p tcp -m tcp --dport 53 -j ACCEPT
  260. #-A FORWARD -s 192.168.1.0/24 -p udp -m udp --dport 53 -j ACCEPT
  261. #-A FORWARD -s 192.168.12.0/24 -p tcp -m tcp --dport 53 -j ACCEPT
  262. #-A FORWARD -s 192.168.12.0/24 -p udp -m udp --dport 53 -j ACCEPT
  263. # ICQ DENIED
  264. #
  265. #-A FORWARD -p tcp --dport 5190 -j DROP
  266. -A FORWARD -d bucp-m1-vip.blue.aol.com -j DROP
  267. -A FORWARD -d bos-d042b-rdr1.blue.aol.com -j DROP
  268. #-A FORWARD -d bos-m006c-sdr3.blue.aol.com -j DROP
  269. #-A FORWARD -d login.icq.com -j DROP
  270. -A FORWARD -d login.oscar.aol.com -j DROP
  271. -A FORWARD -d 205.188.0.0/16 -j DROP
  272. #-A FORWARD -d 64.12.0.0/16 -j DROP
  273. #-A FORWARD -p tcp --dport 443 -j ACCEPT
  274. #
  275. # FTP
  276. -A FORWARD -s 192.168.1.0/24 -p tcp -m multiport --dport 20,21 -j ACCEPT
  277. -A FORWARD -s 192.168.12.0/24 -p tcp -m multiport --dport 20,21 -j ACCEPT
  278. #
  279. #
  280. -A FORWARD -p tcp -m tcp --dport 21 -j ACCEPT
  281. # Close port 80
  282. -A FORWARD -p tcp -m tcp --dport 80 -j REJECT
  283. #
  284. # Close port 25
  285. -A FORWARD -p tcp -m tcp --dport 25 -j DROP
  286. #
  287. -A FORWARD -s 192.168.0.0/16 -d 0.0.0.0 -p tcp -j DROP
  288. #-A FORWARD -p udp -j DROP
  289. #
  290. #
  291. -A OUTPUT -p 47 -j ACCEPT
  292. -A OUTPUT -s 192.168.1.0/24 -j ACCEPT
  293. -A OUTPUT -s 192.168.3.0/24 -j ACCEPT
  294. -A OUTPUT -s 192.168.12.0/24 -j ACCEPT
  295. -A INPUT -s 172.16.0.0/24 -j ACCEPT
  296. #
  297. -A FORWARD -j RH-Firewall-1-INPUT
  298. -A RH-Firewall-1-INPUT -i lo -j ACCEPT
  299. -A RH-Firewall-1-INPUT -i eth1 -j ACCEPT
  300. -A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
  301. -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
  302. -A RH-Firewall-1-INPUT -p esp -j ACCEPT
  303. -A RH-Firewall-1-INPUT -p ah -j ACCEPT
  304. -A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
  305. -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
  306. -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
  307. -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  308. -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
  309. -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
  310. -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
  311. -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
  312. -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
  313. COMMIT
  314. # Completed on Thu Mar 12 12:40:37 2009
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!