API tools faq
paste
Rallias

Untitled

Rallias
Jul 30th, 2013
72
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.22 KB | None | 0 0
raw download clone embed print report
  1. *filter
  2. :INPUT DROP [0:0]
  3. :FORWARD DROP [0:0]
  4. :OUTPUT DROP [0:0]
  5.  
  6. ###################################################
  7. # INPUT: Incoming traffic from various interfaces #
  8. ###################################################
  9.  
  10. # Loopback interface is valid
  11. -A INPUT -i lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT
  12.  
  13. # Local interface, local machines, going anywhere is valid
  14. -A INPUT -i br2 -s 10.0.2.0/24 -d 0.0.0.0/0 -j ACCEPT
  15. -A INPUT -i br1 -s 10.0.1.0/24 -d 0.0.0.0/0 -j ACCEPT
  16.  
  17. # Prevent unallocated untrust-net from gaining external network access
  18. -A INPUT -i br2 -s 10.0.2.8/29 -d 0.0.0.0/0 -j REJECT
  19. -A INPUT -i br2 -s 10.0.2.16/28 -d 0.0.0.0/0 -j REJECT
  20. -A INPUT -i br2 -s 10.0.2.32/27 -d 0.0.0.0/0 -j REJECT
  21. -A INPUT -i br2 -s 10.0.2.64/26 -d 0.0.0.0/0 -j REJECT
  22. -A INPUT -i br2 -s 10.0.2.128/25 -d 0.0.0.0/0 -j REJECT
  23.  
  24. # Printer doesn't get external network access
  25. #-A INPUT -i br2 -s 10.0.2.5 -d 0.0.0.0/5 -j REJECT
  26. #-A INPUT -i br2 -s 10.0.2.5 -d 8.0.0.0/7 -j REJECT
  27. #-A INPUT -i br2 -s 10.0.2.5 -d 11.0.0.0/8 -j REJECT
  28. #-A INPUT -i br2 -s 10.0.2.5 -d 12.0.0.0/6 -j REJECT
  29. #-A INPUT -i br2 -s 10.0.2.5 -d 16.0.0.0/4 -j REJECT
  30. #-A INPUT -i br2 -s 10.0.2.5 -d 32.0.0.0/3 -j REJECT
  31. #-A INPUT -i br2 -s 10.0.2.5 -d 64.0.0.0/2 -j REJECT
  32. #-A INPUT -i br2 -s 10.0.2.5 -d 128.0.0.0/1 -j REJECT
  33.  
  34. # IP spoofing, get lost
  35. -A INPUT -i eth0 -s 10.0.0.0/8 -d 0.0.0.0/0 -j REJECT
  36. -A INPUT -i eth0 -s 172.16.0.0/12 -d 0.0.0.0/0 -j REJECT
  37. -A INPUT -i eth0 -s 192.168.0.0/18 -d 0.0.0.0/0 -j REJECT
  38. -A INPUT -i eth0 -s 192.168.64.0/19 -d 0.0.0.0/0 -j REJECT
  39. -A INPUT -i eth0 -s 192.168.96.0/22 -d 0.0.0.0/0 -j REJECT
  40. -A INPUT -i eth0 -s 192.168.101.0/24 -d 0.0.0.0/0 -j REJECT
  41. -A INPUT -i eth0 -s 192.168.102.0/23 -d 0.0.0.0/0 -j REJECT
  42. -A INPUT -i eth0 -s 192.168.104.0/21 -d 0.0.0.0/0 -j REJECT
  43. -A INPUT -i eth0 -s 192.168.112.0/20 -d 0.0.0.0/0 -j REJECT
  44. -A INPUT -i eth0 -s 192.168.128.0/17 -d 0.0.0.0/0 -j REJECT
  45.  
  46. # External interface, from any source, for ICMP traffic is valid
  47. -A INPUT -i eth0 -p ICMP -s 0.0.0.0/0 -j ACCEPT
  48.  
  49. # Allow any related traffic coming back to the MASQ server in.
  50. -A INPUT -i eth0 -s 0.0.0.0/0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  51.  
  52. # Internal interface, DHCP traffic accepted
  53. -A INPUT -i br2 -p tcp --sport 68 --dport 67 -j ACCEPT
  54. -A INPUT -i br2 -p udp --sport 68 --dport 67 -j ACCEPT
  55.  
  56. # External interface, SSH traffic allowed
  57. -A INPUT -i eth0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s 0.0.0.0/0 --dport 2222 -j ACCEPT
  58.  
  59. -A INPUT -i eth0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p udp -s 0.0.0.0/0 --dport 655 -j ACCEPT
  60.  
  61. # Accept port 1234 to be forwarded (this rule needs to correspond with PREROUTING rules in NAT table)
  62. #-A FORWARD -i eth0 -o br2 -p tcp --dport 1234 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
  63.  
  64. # Catch-all rule, reject anything else
  65. -A INPUT -s 0.0.0.0/0 -d 0.0.0.0/0 -j REJECT
  66.  
  67. ####################################################
  68. # OUTPUT: Outgoing traffic from various interfaces #
  69. ####################################################
  70.  
  71. # Workaround bug in netfilter
  72. -A OUTPUT -m conntrack -p icmp --ctstate INVALID -j DROP
  73.  
  74. # Loopback interface is valid.
  75. -A OUTPUT -o lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT
  76.  
  77. # Local interfaces, any source going to local net is valid
  78. -A OUTPUT -o eth0 -d 10.0.2.0/24 -j ACCEPT
  79. -A OUTPUT -o eth0 -d 10.0.1.0/24 -j ACCEPT
  80.  
  81. # local interface, MASQ server source going to the local net is valid
  82. -A OUTPUT -o br2 -s 10.0.2.0 -d 10.0.2.0/24 -j ACCEPT
  83. -A OUTPUT -o br1 -s 10.0.1.0 -d 10.0.1.0/24 -j ACCEPT
  84.  
  85. # outgoing to local net on remote interface, stuffed routing, deny
  86. -A OUTPUT -o eth0 -s 0.0.0.0/0 -d 10.0.0.0/16 -j REJECT
  87.  
  88. # anything else outgoing on remote interface is valid
  89. -A OUTPUT -o eth0 -d 0.0.0.0/0 -j ACCEPT
  90.  
  91. # Internal interface, DHCP traffic accepted
  92. -A OUTPUT -o br2 -p tcp -s 10.0.2.0 --sport 67 -d 255.255.255.255 --dport 68 -j ACCEPT
  93. -A OUTPUT -o br2 -p udp -s 10.0.2.0 --sport 67 -d 255.255.255.255 --dport 68 -j ACCEPT
  94.  
  95. # Catch all rule, all other outgoing is denied and logged.
  96. -A OUTPUT -s 0.0.0.0/0 -d 0.0.0.0/0 -j REJECT
  97.  
  98. # Accept solicited tcp packets
  99. -A FORWARD -i eth0 -o br2 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  100. -A FORWARD -i eth0 -o br1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  101.  
  102. # Allow packets across the internal interface
  103. -A FORWARD -i br2 -o br2 -j ACCEPT
  104. -A FORWARD -i br1 -o br1 -j ACCEPT
  105. -A FORWARD -i br1 -o br2 -j ACCEPT
  106. -A FORWARD -i br2 -o br1 -j ACCEPT
  107.  
  108. # Forward packets from the internal network to the Internet
  109. -A FORWARD -i br2 -o eth0 -j ACCEPT
  110. -A FORWARD -i br1 -o eth0 -j ACCEPT
  111.  
  112. # Catch-all REJECT rule
  113. -A FORWARD -j REJECT
  114.  
  115. COMMIT
  116.  
  117. ###########################
  118. # Address translations (only; there is no actual forwarding done here)
  119. ###########################
  120. *nat
  121. :PREROUTING ACCEPT [0:0]
  122. :POSTROUTING ACCEPT [0:0]
  123. :OUTPUT ACCEPT [0:0]
  124.  
  125. # ----- Begin OPTIONAL FORWARD Section -----
  126.  
  127. #Optionally forward incoming tcp connections on port 1234 to 192.168.0.100
  128. #-A PREROUTING -p tcp -d $EXTIP --dport 1234 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j DNAT --to 192.168.0.100:1234
  129.  
  130. # ----- End OPTIONAL FORWARD Section -----
  131.  
  132. # IP-Masquerade
  133. -A POSTROUTING -o eth0 -j MASQUERADE
  134.  
  135. COMMIT
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!