Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- # Generated by iptables-save v1.4.21 on Thu Mar 26 14:27:08 2015
- *raw
- :PREROUTING ACCEPT [5322:1067329]
- :OUTPUT ACCEPT [3831:879430]
- -A PREROUTING -i lo -j CT --notrack
- -A OUTPUT -o lo -j CT --notrack
- COMMIT
- # Completed on Thu Mar 26 14:27:08 2015
- # Generated by iptables-save v1.4.21 on Thu Mar 26 14:27:08 2015
- *filter
- :INPUT DROP [0:0]
- :FORWARD DROP [0:0]
- :OUTPUT ACCEPT [947:178177]
- :fail2ban-DCOT - [0:0]
- :fail2ban-PFIX - [0:0]
- :fail2ban-SASL - [0:0]
- :forward_ext - [0:0]
- :input_ext - [0:0]
- :reject_func - [0:0]
- -A INPUT -p tcp -m multiport --dports 25,465,587 -j fail2ban-SASL
- -A INPUT -p tcp -m multiport --dports 110,995,143,993 -j fail2ban-DCOT
- -A INPUT -p tcp -m multiport --dports 25,465,587 -j fail2ban-PFIX
- -A INPUT -i lo -j ACCEPT
- -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
- -A INPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT
- -A INPUT -j input_ext
- -A INPUT -m limit --limit 3/min -j LOG --log-prefix "SFW2-IN-ILL-TARGET " --log-tcp-options --log-ip-options
- -A INPUT -j DROP
- -A FORWARD -m limit --limit 3/min -j LOG --log-prefix "SFW2-FWD-ILL-ROUTING " --log-tcp-options --log-ip-options
- -A OUTPUT -o lo -j ACCEPT
- -A fail2ban-DCOT -j RETURN
- -A fail2ban-PFIX -j RETURN
- -A fail2ban-SASL -j RETURN
- -A input_ext -m pkttype --pkt-type broadcast -j DROP
- -A input_ext -p icmp -m icmp --icmp-type 4 -j ACCEPT
- -A input_ext -p icmp -m icmp --icmp-type 8 -j ACCEPT
- -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 10011 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
- -A input_ext -p tcp -m tcp --dport 10011 -j ACCEPT
- -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 30033 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
- -A input_ext -p tcp -m tcp --dport 30033 -j ACCEPT
- -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
- -A input_ext -p tcp -m tcp --dport 80 -j ACCEPT
- -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
- -A input_ext -p tcp -m tcp --dport 80 -j ACCEPT
- -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
- -A input_ext -p tcp -m tcp --dport 443 -j ACCEPT
- -A input_ext -p udp -m udp --dport 53 -j ACCEPT
- -A input_ext -p udp -m udp --dport 8767 -j ACCEPT
- -A input_ext -p udp -m udp --dport 9987 -j ACCEPT
- -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --rcheck --seconds 36000 --hitcount 2 --name sshd --mask 255.255.255.255 --rsource -j LOG --log-prefix "SFW2-INext-DROPr " --log-tcp-options --log-ip-options
- -A input_ext -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 36000 --hitcount 2 --name sshd --mask 255.255.255.255 --rsource -j DROP
- -A input_ext -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 3/min -j LOG --log-prefix "SFW2-INext-ACC " --log-tcp-options --log-ip-options
- -A input_ext -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name sshd --mask 255.255.255.255 --rsource -j ACCEPT
- -A input_ext -p tcp -m tcp --dport 22 -j ACCEPT
- -A input_ext -m pkttype --pkt-type multicast -j DROP
- -A input_ext -m pkttype --pkt-type broadcast -j DROP
- -A input_ext -p tcp -m limit --limit 3/min -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
- -A input_ext -p icmp -m limit --limit 3/min -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
- -A input_ext -p udp -m limit --limit 3/min -m conntrack --ctstate NEW -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
- -A input_ext -j DROP
- -A reject_func -p tcp -j REJECT --reject-with tcp-reset
- -A reject_func -p udp -j REJECT --reject-with icmp-port-unreachable
- -A reject_func -j REJECT --reject-with icmp-proto-unreachable
- COMMIT
- # Completed on Thu Mar 26 14:27:08 2015
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement