Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- *nat
- :PREROUTING ACCEPT [0:0]
- :POSTROUTING ACCEPT [0:0]
- :OUTPUT ACCEPT [0:0]
- -A PREROUTING -i eth0 -p tcp -m tcp --dport 50000 -j DNAT --to-destination 10.9.8.214:50000
- -A POSTROUTING -o eth0 -j MASQUERADE
- COMMIT
- *filter
- :INPUT ACCEPT [0:0]
- :FORWARD ACCEPT [0:0]
- :OUTPUT ACCEPT [0:0]
- -A INPUT -i lo -j ACCEPT
- -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
- # Allow ICMP
- -A INPUT -s 0.0.0.0/0 -i eth0 -p icmp -m limit --limit 1/s --limit-burst 1 -j ACCEPT
- -A INPUT -s 10.9.8.0/255.255.255.0 -i eth1 -p icmp -j ACCEPT
- -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:
- -A INPUT -p icmp -j DROP
- -A OUTPUT -p icmp -j ACCEPT
- # SSH Delle
- -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
- -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH -j DROP
- -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
- # NTP Delle
- -A INPUT -p tcp -m state --state NEW -i eth0 --dport 123 -j ACCEPT
- # DHCP
- -A INPUT -i eth1 -p tcp --sport 68 --dport 67 -j ACCEPT
- -A INPUT -i eth1 -p udp --sport 68 --dport 67 -j ACCEPT
- -A OUTPUT -o eth1 -p tcp -s 10.9.8.7 --sport 67 -d 255.255.255.255 --dport 68 -j ACCEPT
- -A OUTPUT -o eth1 -p udp -s 10.9.8.7 --sport 67 -d 255.255.255.255 --dport 68 -j ACCEPT
- -A INPUT -i eth0 -j DROP
- # Loopback interface is valid.
- -A OUTPUT -o lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT
- -A FORWARD -i eth0 -p tcp -m tcp --dport 50000 -m state --state NEW -j ACCEPT
- # Logging af nye pakker skal startes
- -A INPUT -m state --state NEW -j LOG --log-prefix -A-LOG --log-level 4
- -A OUTPUT -m state --state NEW -j LOG --log-prefix -A-LOG --log-level 4
- COMMIT
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement