Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- -P INPUT DROP
- -P FORWARD DROP
- -P OUTPUT DROP
- -N BASE_FORWARD_CHAIN
- -N BASE_INPUT_CHAIN
- -N BASE_OUTPUT_CHAIN
- -N BRIDGED_TRAFFIC_CHAIN
- -N DMZ_FORWARD_IN_CHAIN
- -N DMZ_FORWARD_OUT_CHAIN
- -N DMZ_INET_FORWARD_CHAIN
- -N DMZ_INPUT_CHAIN
- -N DMZ_LAN_FORWARD_CHAIN
- -N DMZ_OUTPUT_CHAIN
- -N EXT_BROADCAST_CHAIN
- -N EXT_FORWARD_IN_CHAIN
- -N EXT_FORWARD_OUT_CHAIN
- -N EXT_ICMP_FLOOD_CHAIN
- -N EXT_INPUT_CHAIN
- -N EXT_MULTICAST_CHAIN
- -N EXT_OUTPUT_CHAIN
- -N FORWARD_CHAIN
- -N HOST_BLOCK_DROP
- -N HOST_BLOCK_DST
- -N HOST_BLOCK_SRC
- -N INET_DMZ_FORWARD_CHAIN
- -N INPUT_CHAIN
- -N INT_FORWARD_IN_CHAIN
- -N INT_FORWARD_OUT_CHAIN
- -N INT_INPUT_CHAIN
- -N INT_OUTPUT_CHAIN
- -N LAN_INET_FORWARD_CHAIN
- -N LOGGING
- -N OUTPUT_CHAIN
- -N PARCON
- -N POST_FORWARD_CHAIN
- -N POST_INPUT_CHAIN
- -N POST_INPUT_DROP_CHAIN
- -N POST_OUTPUT_CHAIN
- -N RESERVED_NET_CHK
- -N SPOOF_CHK
- -N VALID_CHK
- -N VPN_CHAIN
- -A INPUT -d 10.4.96.30/32 -i rndbr1 -j DROP
- -A INPUT -i erouter0 -p icmp -j ACCEPT
- -A INPUT -j BASE_INPUT_CHAIN
- -A INPUT -j INPUT_CHAIN
- -A INPUT -j HOST_BLOCK_SRC
- -A INPUT -j SPOOF_CHK
- -A INPUT -i erouter0 -j VALID_CHK
- -A INPUT -d 224.0.0.0/4 -i erouter0 -j EXT_MULTICAST_CHAIN
- -A INPUT -i erouter0 ! -p icmp -m state --state NEW -j EXT_INPUT_CHAIN
- -A INPUT -i erouter0 -p icmp -m state --state NEW -m limit --limit 60/sec --limit-burst 100 -j EXT_INPUT_CHAIN
- -A INPUT -i erouter0 -p icmp -m state --state NEW -j EXT_ICMP_FLOOD_CHAIN
- -A INPUT -i rndbr1 -j INT_INPUT_CHAIN
- -A INPUT -i wan0 -j ACCEPT
- -A INPUT -i mta0 -j ACCEPT
- -A INPUT -i ip6tnl1 -j ACCEPT
- -A INPUT -j POST_INPUT_CHAIN
- -A INPUT -m limit --limit 1/sec -j LOG --log-prefix "AIF:Dropped INPUT packet: " --log-level 6
- -A INPUT -j DROP
- -A FORWARD -j BRIDGED_TRAFFIC_CHAIN
- -A FORWARD -o erouter0 -j VPN_CHAIN
- -A FORWARD -j BASE_FORWARD_CHAIN
- -A FORWARD -o erouter0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- -A FORWARD -j FORWARD_CHAIN
- -A FORWARD -j HOST_BLOCK_SRC
- -A FORWARD -j HOST_BLOCK_DST
- -A FORWARD -i wan0 -j ACCEPT
- -A FORWARD -o wan0 -j ACCEPT
- -A FORWARD -i mta0 -j ACCEPT
- -A FORWARD -o mta0 -j ACCEPT
- -A FORWARD -i ip6tnl1 -j ACCEPT
- -A FORWARD -o ip6tnl1 -j ACCEPT
- -A FORWARD -i erouter0 -j EXT_FORWARD_IN_CHAIN
- -A FORWARD -o erouter0 -j EXT_FORWARD_OUT_CHAIN
- -A FORWARD -i rndbr1 -j INT_FORWARD_IN_CHAIN
- -A FORWARD -o rndbr1 -j INT_FORWARD_OUT_CHAIN
- -A FORWARD -j SPOOF_CHK
- -A FORWARD -i rndbr1 -o rndbr1 -j ACCEPT
- -A FORWARD -i rndbr1 -o erouter0 -j LAN_INET_FORWARD_CHAIN
- -A FORWARD -j POST_FORWARD_CHAIN
- -A FORWARD -m limit --limit 1/min --limit-burst 3 -j LOG --log-prefix "AIF:Dropped FORWARD packet: " --log-level 6
- -A FORWARD -j DROP
- -A OUTPUT -j BASE_OUTPUT_CHAIN
- -A OUTPUT -o erouter0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- -A OUTPUT -j OUTPUT_CHAIN
- -A OUTPUT -j HOST_BLOCK_DST
- -A OUTPUT -f -m limit --limit 3/min -j LOG --log-prefix "AIF:Fragment packet: " --log-level 6
- -A OUTPUT -f -j DROP
- -A OUTPUT -o erouter0 -j EXT_OUTPUT_CHAIN
- -A OUTPUT -o rndbr1 -j INT_OUTPUT_CHAIN
- -A OUTPUT -j POST_OUTPUT_CHAIN
- -A OUTPUT -j ACCEPT
- -A BASE_FORWARD_CHAIN -m state --state ESTABLISHED -j ACCEPT
- -A BASE_FORWARD_CHAIN -p tcp -m state --state RELATED -m tcp --dport 1024:65535 -j ACCEPT
- -A BASE_FORWARD_CHAIN -p udp -m state --state RELATED -m udp --dport 1024:65535 -j ACCEPT
- -A BASE_FORWARD_CHAIN -p icmp -m state --state RELATED -j ACCEPT
- -A BASE_FORWARD_CHAIN -p gre -m state --state RELATED -j ACCEPT
- -A BASE_FORWARD_CHAIN -i lo -j ACCEPT
- -A BASE_INPUT_CHAIN -m state --state ESTABLISHED -j ACCEPT
- -A BASE_INPUT_CHAIN -p tcp -m state --state RELATED -m tcp --dport 1024:65535 -j ACCEPT
- -A BASE_INPUT_CHAIN -p udp -m state --state RELATED -m udp --dport 1024:65535 -j ACCEPT
- -A BASE_INPUT_CHAIN -p icmp -m state --state RELATED -j ACCEPT
- -A BASE_INPUT_CHAIN -i lo -j ACCEPT
- -A BASE_OUTPUT_CHAIN -m state --state ESTABLISHED -j ACCEPT
- -A BASE_OUTPUT_CHAIN -o lo -j ACCEPT
- -A BRIDGED_TRAFFIC_CHAIN -m physdev --physdev-is-bridged -j ACCEPT
- -A BRIDGED_TRAFFIC_CHAIN -m physdev --physdev-is-bridged -j ACCEPT
- -A EXT_BROADCAST_CHAIN -p tcp -m tcp --dport 0:1023 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:PRIV TCP broadcast: " --log-level 6
- -A EXT_BROADCAST_CHAIN -p udp -m udp --dport 0:1023 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:PRIV UDP broadcast: " --log-level 6
- -A EXT_BROADCAST_CHAIN -p tcp -m tcp --dport 1024:65535 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:UNPRIV TCP broadcast: " --log-level 6
- -A EXT_BROADCAST_CHAIN -p udp -m udp --dport 1024 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:UNPRIV UDP broadcast: " --log-level 6
- -A EXT_BROADCAST_CHAIN -j DROP
- -A EXT_FORWARD_IN_CHAIN -d 224.0.0.0/4 -i erouter0 -j ACCEPT
- -A EXT_FORWARD_IN_CHAIN -d 192.168.0.24/32 -i erouter0 ! -o erouter0 -p tcp -j ACCEPT
- -A EXT_FORWARD_IN_CHAIN -d 192.168.0.24/32 -i erouter0 ! -o erouter0 -p udp -j ACCEPT
- -A EXT_FORWARD_IN_CHAIN -j VALID_CHK
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 3 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-unreachable flood: " --log-level 6
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 3 -j POST_INPUT_DROP_CHAIN
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 11 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-time-exceeded fld: " --log-level 6
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 11 -j POST_INPUT_DROP_CHAIN
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 12 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-param-problem fld: " --log-level 6
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 12 -j POST_INPUT_DROP_CHAIN
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-request(ping) fld: " --log-level 6
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 8 -j POST_INPUT_DROP_CHAIN
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 0 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-reply(pong) flood: " --log-level 6
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 0 -j POST_INPUT_DROP_CHAIN
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 4 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-source-quench fld: " --log-level 6
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 4 -j POST_INPUT_DROP_CHAIN
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "AIF:ICMP(other) flood: " --log-level 6
- -A EXT_ICMP_FLOOD_CHAIN -p icmp -j POST_INPUT_DROP_CHAIN
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 0 -m limit --limit 6/hour --limit-burst 1 -j LOG --log-prefix "AIF:Port 0 OS fingerprint: " --log-level 6
- -A EXT_INPUT_CHAIN -p udp -m udp --dport 0 -m limit --limit 6/hour --limit-burst 1 -j LOG --log-prefix "AIF:Port 0 OS fingerprint: " --log-level 6
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 0 -j POST_INPUT_DROP_CHAIN
- -A EXT_INPUT_CHAIN -p udp -m udp --dport 0 -j POST_INPUT_DROP_CHAIN
- -A EXT_INPUT_CHAIN -p tcp -m tcp --sport 0 -m limit --limit 6/hour -j LOG --log-prefix "AIF:TCP source port 0: " --log-level 6
- -A EXT_INPUT_CHAIN -p udp -m udp --sport 0 -m limit --limit 6/hour -j LOG --log-prefix "AIF:UDP source port 0: " --log-level 6
- -A EXT_INPUT_CHAIN -p tcp -m tcp --sport 0 -j POST_INPUT_DROP_CHAIN
- -A EXT_INPUT_CHAIN -p udp -m udp --sport 0 -j POST_INPUT_DROP_CHAIN
- -A EXT_INPUT_CHAIN -p udp -m udp --sport 67 --dport 68 -j ACCEPT
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 22 -j ACCEPT
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 80 -j ACCEPT
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 8080 -j ACCEPT
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 8081 -j ACCEPT
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 8082 -j ACCEPT
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 8084 -j ACCEPT
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 8096 -j ACCEPT
- -A EXT_INPUT_CHAIN -p udp -m udp --dport 161 -j ACCEPT
- -A EXT_INPUT_CHAIN -p udp -m udp --dport 8088 -j ACCEPT
- -A EXT_INPUT_CHAIN -p udp -m udp --dport 16000 -j ACCEPT
- -A EXT_INPUT_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 20/sec --limit-burst 100 -j ACCEPT
- -A EXT_INPUT_CHAIN -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j POST_INPUT_DROP_CHAIN
- -A EXT_INPUT_CHAIN -d 255.255.255.255/32 -j EXT_BROADCAST_CHAIN
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 0:1023 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:PRIV TCP packet: " --log-level 6
- -A EXT_INPUT_CHAIN -p udp -m udp --dport 0:1023 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:PRIV UDP packet: " --log-level 6
- -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 1024:65535 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:UNPRIV TCP packet: " --log-level 6
- -A EXT_INPUT_CHAIN -p udp -m udp --dport 1024:65535 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:UNPRIV UDP packet: " --log-level 6
- -A EXT_INPUT_CHAIN -p igmp -m limit --limit 1/min -j LOG --log-prefix "AIF:IGMP packet: " --log-level 6
- -A EXT_INPUT_CHAIN -j POST_INPUT_CHAIN
- -A EXT_INPUT_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-request: " --log-level 6
- -A EXT_INPUT_CHAIN -p icmp -m icmp ! --icmp-type 8 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-other: " --log-level 6
- -A EXT_INPUT_CHAIN -p tcp -j POST_INPUT_DROP_CHAIN
- -A EXT_INPUT_CHAIN -p udp -j POST_INPUT_DROP_CHAIN
- -A EXT_INPUT_CHAIN -p igmp -j POST_INPUT_DROP_CHAIN
- -A EXT_INPUT_CHAIN -p icmp -j POST_INPUT_DROP_CHAIN
- -A EXT_INPUT_CHAIN -m limit --limit 1/min -j LOG --log-prefix "AIF:Other connect: " --log-level 6
- -A EXT_INPUT_CHAIN -j POST_INPUT_DROP_CHAIN
- -A EXT_MULTICAST_CHAIN -d 224.0.0.0/24 -i erouter0 -j ACCEPT
- -A EXT_MULTICAST_CHAIN -p tcp -m tcp --dport 0:1023 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:PRIV TCP multicast: " --log-level 6
- -A EXT_MULTICAST_CHAIN -p udp -m udp --dport 0:1023 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:PRIV UDP multicast: " --log-level 6
- -A EXT_MULTICAST_CHAIN -p tcp -m tcp --dport 1024:65535 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:UNPRIV TCP multicast: " --log-level 6
- -A EXT_MULTICAST_CHAIN -p udp -m udp --dport 1024 -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "AIF:UNPRIV UDP multicast: " --log-level 6
- -A EXT_MULTICAST_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-multicast-request: " --log-level 6
- -A EXT_MULTICAST_CHAIN -p icmp -m icmp ! --icmp-type 8 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-multicast-other: " --log-level 6
- -A EXT_MULTICAST_CHAIN -j DROP
- -A HOST_BLOCK_DROP -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "AIF:Blocked host(s): " --log-level 6
- -A HOST_BLOCK_DROP -j DROP
- -A INT_INPUT_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 20/sec --limit-burst 100 -j ACCEPT
- -A INT_INPUT_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-request: " --log-level 6
- -A INT_INPUT_CHAIN -p icmp -m icmp --icmp-type 8 -j DROP
- -A INT_INPUT_CHAIN -j ACCEPT
- -A LAN_INET_FORWARD_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 20/sec --limit-burst 100 -j ACCEPT
- -A LAN_INET_FORWARD_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "AIF:ICMP-request: " --log-level 6
- -A LAN_INET_FORWARD_CHAIN -p icmp -m icmp --icmp-type 8 -j DROP
- -A LAN_INET_FORWARD_CHAIN -p tcp -j ACCEPT
- -A LAN_INET_FORWARD_CHAIN -p udp -j ACCEPT
- -A LAN_INET_FORWARD_CHAIN -j ACCEPT
- -A LOGGING -j DROP
- -A POST_FORWARD_CHAIN -d 192.168.0.24/32 -p tcp -m tcp --dport 80 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.8/32 -p tcp -m tcp --dport 0 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.24/32 -p tcp -m tcp --dport 1701 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.24/32 -p udp -m udp --dport 4500 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.24/32 -p udp -m udp --dport 500 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.8/32 -p udp -m udp --dport 5353 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.8/32 -p udp -m udp --dport 4500 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.5/32 -p udp -m udp --dport 23639 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.5/32 -p tcp -m tcp --dport 23639 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.5/32 -p udp -m udp --dport 16402 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.8/32 -p udp -m udp --dport 1383 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.8/32 -p tcp -m tcp --dport 1383 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.10/32 -p tcp -m tcp --dport 62734 -j ACCEPT
- -A POST_FORWARD_CHAIN -d 192.168.0.10/32 -p udp -m udp --dport 62734 -j ACCEPT
- -A POST_INPUT_DROP_CHAIN -j DROP
- -A SPOOF_CHK -s 192.168.0.0/24 -i rndbr1 -j RETURN
- -A SPOOF_CHK -s 192.168.0.0/24 -m limit --limit 3/min -j LOG --log-prefix "AIF:Spoofed packet: " --log-level 6
- -A SPOOF_CHK -s 192.168.0.0/24 -j POST_INPUT_DROP_CHAIN
- -A SPOOF_CHK -j RETURN
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -m limit --limit 3/min -j LOG --log-prefix "AIF:Stealth XMAS scan: " --log-level 6
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -m limit --limit 3/min -j LOG --log-prefix "AIF:Stealth XMAS-PSH scan: " --log-level 6
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -m limit --limit 3/min -j LOG --log-prefix "AIF:Stealth XMAS-ALL scan: " --log-level 6
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -m limit --limit 3/min -j LOG --log-prefix "AIF:Stealth FIN scan: " --log-level 6
- -A VALID_CHK -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 3/min -j LOG --log-prefix "AIF:Stealth SYN/RST scan: " --log-level 6
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 3/min -j LOG --log-prefix "AIF:Stealth SYN/FIN scan?: " --log-level 6
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 3/min -j LOG --log-prefix "AIF:Stealth Null scan: " --log-level 6
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j POST_INPUT_DROP_CHAIN
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j POST_INPUT_DROP_CHAIN
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j POST_INPUT_DROP_CHAIN
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j POST_INPUT_DROP_CHAIN
- -A VALID_CHK -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j POST_INPUT_DROP_CHAIN
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j POST_INPUT_DROP_CHAIN
- -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j POST_INPUT_DROP_CHAIN
- -A VALID_CHK -p tcp -m tcp --tcp-option 64 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "AIF:Bad TCP flag(64): " --log-level 6
- -A VALID_CHK -p tcp -m tcp --tcp-option 128 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "AIF:Bad TCP flag(128): " --log-level 6
- -A VALID_CHK -p tcp -m tcp --tcp-option 64 -j POST_INPUT_DROP_CHAIN
- -A VALID_CHK -p tcp -m tcp --tcp-option 128 -j POST_INPUT_DROP_CHAIN
- -A VALID_CHK -m state --state INVALID -j POST_INPUT_DROP_CHAIN
- -A VALID_CHK -f -j DROP
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement