API tools faq
paste
Advertisement
Guest User

ubuntu

a guest
Apr 18th, 2022
147
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.84 KB | None | 0 0
raw download clone embed print report
  1. root@box-688896:~# iptables-save
  2. # Generated by iptables-save v1.8.4 on Tue Apr 19 00:42:31 2022
  3. *filter
  4. :INPUT DROP [33:1652]
  5. :FORWARD DROP [0:0]
  6. :OUTPUT ACCEPT [0:0]
  7. :f2b-sshd - [0:0]
  8. :ufw-after-forward - [0:0]
  9. :ufw-after-input - [0:0]
  10. :ufw-after-logging-forward - [0:0]
  11. :ufw-after-logging-input - [0:0]
  12. :ufw-after-logging-output - [0:0]
  13. :ufw-after-output - [0:0]
  14. :ufw-before-forward - [0:0]
  15. :ufw-before-input - [0:0]
  16. :ufw-before-logging-forward - [0:0]
  17. :ufw-before-logging-input - [0:0]
  18. :ufw-before-logging-output - [0:0]
  19. :ufw-before-output - [0:0]
  20. :ufw-logging-allow - [0:0]
  21. :ufw-logging-deny - [0:0]
  22. :ufw-not-local - [0:0]
  23. :ufw-reject-forward - [0:0]
  24. :ufw-reject-input - [0:0]
  25. :ufw-reject-output - [0:0]
  26. :ufw-skip-to-policy-forward - [0:0]
  27. :ufw-skip-to-policy-input - [0:0]
  28. :ufw-skip-to-policy-output - [0:0]
  29. :ufw-track-forward - [0:0]
  30. :ufw-track-input - [0:0]
  31. :ufw-track-output - [0:0]
  32. :ufw-user-forward - [0:0]
  33. :ufw-user-input - [0:0]
  34. :ufw-user-limit - [0:0]
  35. :ufw-user-limit-accept - [0:0]
  36. :ufw-user-logging-forward - [0:0]
  37. :ufw-user-logging-input - [0:0]
  38. :ufw-user-logging-output - [0:0]
  39. :ufw-user-output - [0:0]
  40. -A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
  41. -A INPUT -p udp -m udp --dport 1194 -j ACCEPT
  42. -A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol none -j DROP
  43. -A INPUT -m conntrack --ctstate INVALID -j DROP
  44. -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  45. -A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
  46. -A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
  47. -A INPUT -p udp -m udp --dport 1701 -j DROP
  48. -A INPUT -j ufw-before-logging-input
  49. -A INPUT -j ufw-before-input
  50. -A INPUT -j ufw-after-input
  51. -A INPUT -j ufw-after-logging-input
  52. -A INPUT -j ufw-reject-input
  53. -A INPUT -j ufw-track-input
  54. -A FORWARD -s 10.8.0.0/24 -j ACCEPT
  55. -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
  56. -A FORWARD -m conntrack --ctstate INVALID -j DROP
  57. -A FORWARD -i ens3 -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  58. -A FORWARD -i ppp+ -o ens3 -j ACCEPT
  59. -A FORWARD -i ppp+ -o ppp+ -j ACCEPT
  60. -A FORWARD -d 192.168.43.0/24 -i ens3 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  61. -A FORWARD -s 192.168.43.0/24 -o ens3 -j ACCEPT
  62. -A FORWARD -s 192.168.43.0/24 -o ppp+ -j ACCEPT
  63. -A FORWARD -j ufw-before-logging-forward
  64. -A FORWARD -j ufw-before-forward
  65. -A FORWARD -j ufw-after-forward
  66. -A FORWARD -j ufw-after-logging-forward
  67. -A FORWARD -j ufw-reject-forward
  68. -A FORWARD -j ufw-track-forward
  69. -A FORWARD -j DROP
  70. -A OUTPUT -j ufw-before-logging-output
  71. -A OUTPUT -j ufw-before-output
  72. -A OUTPUT -j ufw-after-output
  73. -A OUTPUT -j ufw-after-logging-output
  74. -A OUTPUT -j ufw-reject-output
  75. -A OUTPUT -j ufw-track-output
  76. -A f2b-sshd -s 157.230.245.64/32 -j REJECT --reject-with icmp-port-unreachable
  77. -A f2b-sshd -s 49.234.30.113/32 -j REJECT --reject-with icmp-port-unreachable
  78. -A f2b-sshd -s 124.205.198.21/32 -j REJECT --reject-with icmp-port-unreachable
  79. -A f2b-sshd -s 113.200.60.74/32 -j REJECT --reject-with icmp-port-unreachable
  80. -A f2b-sshd -s 101.255.81.91/32 -j REJECT --reject-with icmp-port-unreachable
  81. -A f2b-sshd -j RETURN
  82. -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
  83. -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
  84. -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
  85. -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
  86. -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
  87. -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
  88. -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
  89. -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  90. -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  91. -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  92. -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
  93. -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
  94. -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
  95. -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
  96. -A ufw-before-forward -j ufw-user-forward
  97. -A ufw-before-input -i lo -j ACCEPT
  98. -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  99. -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
  100. -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
  101. -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
  102. -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
  103. -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
  104. -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
  105. -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
  106. -A ufw-before-input -j ufw-not-local
  107. -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
  108. -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
  109. -A ufw-before-input -j ufw-user-input
  110. -A ufw-before-output -o lo -j ACCEPT
  111. -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  112. -A ufw-before-output -j ufw-user-output
  113. -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
  114. -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
  115. -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  116. -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
  117. -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
  118. -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
  119. -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
  120. -A ufw-not-local -j DROP
  121. -A ufw-skip-to-policy-forward -j DROP
  122. -A ufw-skip-to-policy-input -j DROP
  123. -A ufw-skip-to-policy-output -j ACCEPT
  124. -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
  125. -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
  126. -A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
  127. -A ufw-user-input -p udp -m udp --dport 22 -j ACCEPT
  128. -A ufw-user-input -p tcp -m tcp --dport 51820 -j ACCEPT
  129. -A ufw-user-input -p udp -m udp --dport 51820 -j ACCEPT
  130. -A ufw-user-input -i wg0 -j ACCEPT
  131. -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
  132. -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
  133. -A ufw-user-limit-accept -j ACCEPT
  134. -A ufw-user-output -o wg0 -j ACCEPT
  135. COMMIT
  136. # Completed on Tue Apr 19 00:42:31 2022
  137. # Generated by iptables-save v1.8.4 on Tue Apr 19 00:42:31 2022
  138. *nat
  139. :PREROUTING ACCEPT [2196:362901]
  140. :INPUT ACCEPT [29:2108]
  141. :OUTPUT ACCEPT [13:845]
  142. :POSTROUTING ACCEPT [31:1709]
  143. -A POSTROUTING -s 192.168.42.0/24 -o ens3 -j MASQUERADE
  144. -A POSTROUTING -s 192.168.43.0/24 -o ens3 -m policy --dir out --pol none -j MASQUERADE
  145. -A POSTROUTING -s 10.8.0.0/24 -o ens3 -j MASQUERADE
  146. COMMIT
  147. # Completed on Tue Apr 19 00:42:31 2022
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!