API tools faq
paste
Advertisement
Guest User

Вывод iptables -S

a guest
Apr 20th, 2016
147
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 13.75 KB | None | 0 0
raw download clone embed print report
  1. -P INPUT ACCEPT
  2. -P FORWARD DROP
  3. -P OUTPUT ACCEPT
  4. -N ufw-after-forward
  5. -N ufw-after-input
  6. -N ufw-after-logging-forward
  7. -N ufw-after-logging-input
  8. -N ufw-after-logging-output
  9. -N ufw-after-output
  10. -N ufw-before-forward
  11. -N ufw-before-input
  12. -N ufw-before-logging-forward
  13. -N ufw-before-logging-input
  14. -N ufw-before-logging-output
  15. -N ufw-before-output
  16. -N ufw-logging-allow
  17. -N ufw-logging-deny
  18. -N ufw-not-local
  19. -N ufw-reject-forward
  20. -N ufw-reject-input
  21. -N ufw-reject-output
  22. -N ufw-skip-to-policy-forward
  23. -N ufw-skip-to-policy-input
  24. -N ufw-skip-to-policy-output
  25. -N ufw-track-forward
  26. -N ufw-track-input
  27. -N ufw-track-output
  28. -N ufw-user-forward
  29. -N ufw-user-input
  30. -N ufw-user-limit
  31. -N ufw-user-limit-accept
  32. -N ufw-user-logging-forward
  33. -N ufw-user-logging-input
  34. -N ufw-user-logging-output
  35. -N ufw-user-output
  36. -A INPUT -j ufw-before-logging-input
  37. -A INPUT -j ufw-before-input
  38. -A INPUT -j ufw-after-input
  39. -A INPUT -j ufw-after-logging-input
  40. -A INPUT -j ufw-reject-input
  41. -A INPUT -j ufw-track-input
  42. -A FORWARD -j ufw-before-logging-forward
  43. -A FORWARD -j ufw-before-forward
  44. -A FORWARD -j ufw-after-forward
  45. -A FORWARD -j ufw-after-logging-forward
  46. -A FORWARD -j ufw-reject-forward
  47. -A FORWARD -j ufw-track-forward
  48. -A OUTPUT -j ufw-before-logging-output
  49. -A OUTPUT -j ufw-before-output
  50. -A OUTPUT -j ufw-after-output
  51. -A OUTPUT -j ufw-after-logging-output
  52. -A OUTPUT -j ufw-reject-output
  53. -A OUTPUT -j ufw-track-output
  54. -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
  55. -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
  56. -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
  57. -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
  58. -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
  59. -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
  60. -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
  61. -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  62. -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  63. -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
  64. -A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
  65. -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
  66. -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
  67. -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
  68. -A ufw-before-forward -j ufw-user-forward
  69. -A ufw-before-input -i lo -j ACCEPT
  70. -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  71. -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
  72. -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
  73. -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
  74. -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
  75. -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
  76. -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
  77. -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
  78. -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
  79. -A ufw-before-input -j ufw-not-local
  80. -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
  81. -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
  82. -A ufw-before-input -j ufw-user-input
  83. -A ufw-before-output -o lo -j ACCEPT
  84. -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  85. -A ufw-before-output -j ufw-user-output
  86. -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
  87. -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
  88. -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  89. -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
  90. -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
  91. -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
  92. -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
  93. -A ufw-not-local -j DROP
  94. -A ufw-skip-to-policy-forward -j DROP
  95. -A ufw-skip-to-policy-input -j ACCEPT
  96. -A ufw-skip-to-policy-output -j ACCEPT
  97. -A ufw-track-input -p tcp -m conntrack --ctstate NEW -j ACCEPT
  98. -A ufw-track-input -p udp -m conntrack --ctstate NEW -j ACCEPT
  99. -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
  100. -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
  101. -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
  102. -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
  103. -A ufw-user-limit-accept -j ACCEPT
  104. [user@myarch ~]$ sudo iptables -S
  105. [sudo] пароль для user:
  106. -P INPUT ACCEPT
  107. -P FORWARD DROP
  108. -P OUTPUT ACCEPT
  109. -N ufw-after-forward
  110. -N ufw-after-input
  111. -N ufw-after-logging-forward
  112. -N ufw-after-logging-input
  113. -N ufw-after-logging-output
  114. -N ufw-after-output
  115. -N ufw-before-forward
  116. -N ufw-before-input
  117. -N ufw-before-logging-forward
  118. -N ufw-before-logging-input
  119. -N ufw-before-logging-output
  120. -N ufw-before-output
  121. -N ufw-logging-allow
  122. -N ufw-logging-deny
  123. -N ufw-not-local
  124. -N ufw-reject-forward
  125. -N ufw-reject-input
  126. -N ufw-reject-output
  127. -N ufw-skip-to-policy-forward
  128. -N ufw-skip-to-policy-input
  129. -N ufw-skip-to-policy-output
  130. -N ufw-track-forward
  131. -N ufw-track-input
  132. -N ufw-track-output
  133. -N ufw-user-forward
  134. -N ufw-user-input
  135. -N ufw-user-limit
  136. -N ufw-user-limit-accept
  137. -N ufw-user-logging-forward
  138. -N ufw-user-logging-input
  139. -N ufw-user-logging-output
  140. -N ufw-user-output
  141. -A INPUT -j ufw-before-logging-input
  142. -A INPUT -j ufw-before-input
  143. -A INPUT -j ufw-after-input
  144. -A INPUT -j ufw-after-logging-input
  145. -A INPUT -j ufw-reject-input
  146. -A INPUT -j ufw-track-input
  147. -A FORWARD -j ufw-before-logging-forward
  148. -A FORWARD -j ufw-before-forward
  149. -A FORWARD -j ufw-after-forward
  150. -A FORWARD -j ufw-after-logging-forward
  151. -A FORWARD -j ufw-reject-forward
  152. -A FORWARD -j ufw-track-forward
  153. -A OUTPUT -j ufw-before-logging-output
  154. -A OUTPUT -j ufw-before-output
  155. -A OUTPUT -j ufw-after-output
  156. -A OUTPUT -j ufw-after-logging-output
  157. -A OUTPUT -j ufw-reject-output
  158. -A OUTPUT -j ufw-track-output
  159. -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
  160. -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
  161. -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
  162. -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
  163. -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
  164. -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
  165. -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
  166. -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  167. -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  168. -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
  169. -A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
  170. -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
  171. -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
  172. -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
  173. -A ufw-before-forward -j ufw-user-forward
  174. -A ufw-before-input -i lo -j ACCEPT
  175. -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  176. -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
  177. -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
  178. -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
  179. -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
  180. -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
  181. -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
  182. -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
  183. -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
  184. -A ufw-before-input -j ufw-not-local
  185. -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
  186. -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
  187. -A ufw-before-input -j ufw-user-input
  188. -A ufw-before-output -o lo -j ACCEPT
  189. -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  190. -A ufw-before-output -j ufw-user-output
  191. -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
  192. -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
  193. -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  194. -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
  195. -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
  196. -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
  197. -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
  198. -A ufw-not-local -j DROP
  199. -A ufw-skip-to-policy-forward -j DROP
  200. -A ufw-skip-to-policy-input -j ACCEPT
  201. -A ufw-skip-to-policy-output -j ACCEPT
  202. -A ufw-track-input -p tcp -m conntrack --ctstate NEW -j ACCEPT
  203. -A ufw-track-input -p udp -m conntrack --ctstate NEW -j ACCEPT
  204. -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
  205. -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
  206. -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
  207. -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
  208. -A ufw-user-limit-accept -j ACCEPT
  209. [user@myarch ~]$ clear
  210.  
  211. [user@myarch ~]$ sudo iptables -S
  212. -P INPUT ACCEPT
  213. -P FORWARD DROP
  214. -P OUTPUT ACCEPT
  215. -N ufw-after-forward
  216. -N ufw-after-input
  217. -N ufw-after-logging-forward
  218. -N ufw-after-logging-input
  219. -N ufw-after-logging-output
  220. -N ufw-after-output
  221. -N ufw-before-forward
  222. -N ufw-before-input
  223. -N ufw-before-logging-forward
  224. -N ufw-before-logging-input
  225. -N ufw-before-logging-output
  226. -N ufw-before-output
  227. -N ufw-logging-allow
  228. -N ufw-logging-deny
  229. -N ufw-not-local
  230. -N ufw-reject-forward
  231. -N ufw-reject-input
  232. -N ufw-reject-output
  233. -N ufw-skip-to-policy-forward
  234. -N ufw-skip-to-policy-input
  235. -N ufw-skip-to-policy-output
  236. -N ufw-track-forward
  237. -N ufw-track-input
  238. -N ufw-track-output
  239. -N ufw-user-forward
  240. -N ufw-user-input
  241. -N ufw-user-limit
  242. -N ufw-user-limit-accept
  243. -N ufw-user-logging-forward
  244. -N ufw-user-logging-input
  245. -N ufw-user-logging-output
  246. -N ufw-user-output
  247. -A INPUT -j ufw-before-logging-input
  248. -A INPUT -j ufw-before-input
  249. -A INPUT -j ufw-after-input
  250. -A INPUT -j ufw-after-logging-input
  251. -A INPUT -j ufw-reject-input
  252. -A INPUT -j ufw-track-input
  253. -A FORWARD -j ufw-before-logging-forward
  254. -A FORWARD -j ufw-before-forward
  255. -A FORWARD -j ufw-after-forward
  256. -A FORWARD -j ufw-after-logging-forward
  257. -A FORWARD -j ufw-reject-forward
  258. -A FORWARD -j ufw-track-forward
  259. -A OUTPUT -j ufw-before-logging-output
  260. -A OUTPUT -j ufw-before-output
  261. -A OUTPUT -j ufw-after-output
  262. -A OUTPUT -j ufw-after-logging-output
  263. -A OUTPUT -j ufw-reject-output
  264. -A OUTPUT -j ufw-track-output
  265. -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
  266. -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
  267. -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
  268. -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
  269. -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
  270. -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
  271. -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
  272. -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  273. -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  274. -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
  275. -A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
  276. -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
  277. -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
  278. -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
  279. -A ufw-before-forward -j ufw-user-forward
  280. -A ufw-before-input -i lo -j ACCEPT
  281. -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  282. -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
  283. -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
  284. -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
  285. -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
  286. -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
  287. -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
  288. -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
  289. -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
  290. -A ufw-before-input -j ufw-not-local
  291. -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
  292. -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
  293. -A ufw-before-input -j ufw-user-input
  294. -A ufw-before-output -o lo -j ACCEPT
  295. -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  296. -A ufw-before-output -j ufw-user-output
  297. -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
  298. -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
  299. -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  300. -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
  301. -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
  302. -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
  303. -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
  304. -A ufw-not-local -j DROP
  305. -A ufw-skip-to-policy-forward -j DROP
  306. -A ufw-skip-to-policy-input -j ACCEPT
  307. -A ufw-skip-to-policy-output -j ACCEPT
  308. -A ufw-track-input -p tcp -m conntrack --ctstate NEW -j ACCEPT
  309. -A ufw-track-input -p udp -m conntrack --ctstate NEW -j ACCEPT
  310. -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
  311. -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
  312. -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
  313. -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
  314. -A ufw-user-limit-accept -j ACCEPT
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!