Guest User

Untitled

a guest
Jul 24th, 2016
819
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. -P INPUT DROP
  2. -P FORWARD ACCEPT
  3. -P OUTPUT ACCEPT
  4. -N ufw-after-forward
  5. -N ufw-after-input
  6. -N ufw-after-logging-forward
  7. -N ufw-after-logging-input
  8. -N ufw-after-logging-output
  9. -N ufw-after-output
  10. -N ufw-before-forward
  11. -N ufw-before-input
  12. -N ufw-before-logging-forward
  13. -N ufw-before-logging-input
  14. -N ufw-before-logging-output
  15. -N ufw-before-output
  16. -N ufw-logging-allow
  17. -N ufw-logging-deny
  18. -N ufw-not-local
  19. -N ufw-reject-forward
  20. -N ufw-reject-input
  21. -N ufw-reject-output
  22. -N ufw-skip-to-policy-forward
  23. -N ufw-skip-to-policy-input
  24. -N ufw-skip-to-policy-output
  25. -N ufw-track-forward
  26. -N ufw-track-input
  27. -N ufw-track-output
  28. -N ufw-user-forward
  29. -N ufw-user-input
  30. -N ufw-user-limit
  31. -N ufw-user-limit-accept
  32. -N ufw-user-logging-forward
  33. -N ufw-user-logging-input
  34. -N ufw-user-logging-output
  35. -N ufw-user-output
  36. -A INPUT -j ufw-before-logging-input
  37. -A INPUT -j ufw-before-input
  38. -A INPUT -j ufw-after-input
  39. -A INPUT -j ufw-after-logging-input
  40. -A INPUT -j ufw-reject-input
  41. -A INPUT -j ufw-track-input
  42. -A FORWARD -j ufw-before-logging-forward
  43. -A FORWARD -j ufw-before-forward
  44. -A FORWARD -j ufw-after-forward
  45. -A FORWARD -j ufw-after-logging-forward
  46. -A FORWARD -j ufw-reject-forward
  47. -A FORWARD -j ufw-track-forward
  48. -A OUTPUT -j ufw-before-logging-output
  49. -A OUTPUT -j ufw-before-output
  50. -A OUTPUT -j ufw-after-output
  51. -A OUTPUT -j ufw-after-logging-output
  52. -A OUTPUT -j ufw-reject-output
  53. -A OUTPUT -j ufw-track-output
  54. -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
  55. -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
  56. -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
  57. -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
  58. -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
  59. -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
  60. -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
  61. -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  62. -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  63. -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
  64. -A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
  65. -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
  66. -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
  67. -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
  68. -A ufw-before-forward -j ufw-user-forward
  69. -A ufw-before-input -i lo -j ACCEPT
  70. -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  71. -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
  72. -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
  73. -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
  74. -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
  75. -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
  76. -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
  77. -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
  78. -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
  79. -A ufw-before-input -j ufw-not-local
  80. -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
  81. -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
  82. -A ufw-before-input -j ufw-user-input
  83. -A ufw-before-output -o lo -j ACCEPT
  84. -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  85. -A ufw-before-output -j ufw-user-output
  86. -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
  87. -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
  88. -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  89. -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
  90. -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
  91. -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
  92. -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
  93. -A ufw-not-local -j DROP
  94. -A ufw-skip-to-policy-forward -j ACCEPT
  95. -A ufw-skip-to-policy-input -j DROP
  96. -A ufw-skip-to-policy-output -j ACCEPT
  97. -A ufw-track-forward -p tcp -m conntrack --ctstate NEW -j ACCEPT
  98. -A ufw-track-forward -p udp -m conntrack --ctstate NEW -j ACCEPT
  99. -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
  100. -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
  101. -A ufw-user-input -p udp -m udp --dport 1194 -j ACCEPT
  102. -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
  103. -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
  104. -A ufw-user-limit-accept -j ACCEPT
RAW Paste Data