API tools faq
paste
gempir

Untitled

gempir
Oct 3rd, 2018
331
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.65 KB | None | 0 0
raw download clone embed print report
  1. -P INPUT DROP
  2. -P FORWARD DROP
  3. -P OUTPUT ACCEPT
  4. -N DOCKER
  5. -N DOCKER-ISOLATION-STAGE-1
  6. -N DOCKER-ISOLATION-STAGE-2
  7. -N DOCKER-USER
  8. -N ufw-after-forward
  9. -N ufw-after-input
  10. -N ufw-after-logging-forward
  11. -N ufw-after-logging-input
  12. -N ufw-after-logging-output
  13. -N ufw-after-output
  14. -N ufw-before-forward
  15. -N ufw-before-input
  16. -N ufw-before-logging-forward
  17. -N ufw-before-logging-input
  18. -N ufw-before-logging-output
  19. -N ufw-before-output
  20. -N ufw-logging-allow
  21. -N ufw-logging-deny
  22. -N ufw-not-local
  23. -N ufw-reject-forward
  24. -N ufw-reject-input
  25. -N ufw-reject-output
  26. -N ufw-skip-to-policy-forward
  27. -N ufw-skip-to-policy-input
  28. -N ufw-skip-to-policy-output
  29. -N ufw-track-forward
  30. -N ufw-track-input
  31. -N ufw-track-output
  32. -N ufw-user-forward
  33. -N ufw-user-input
  34. -N ufw-user-limit
  35. -N ufw-user-limit-accept
  36. -N ufw-user-logging-forward
  37. -N ufw-user-logging-input
  38. -N ufw-user-logging-output
  39. -N ufw-user-output
  40. -A INPUT -j ufw-before-logging-input
  41. -A INPUT -j ufw-before-input
  42. -A INPUT -j ufw-after-input
  43. -A INPUT -j ufw-after-logging-input
  44. -A INPUT -j ufw-reject-input
  45. -A INPUT -j ufw-track-input
  46. -A FORWARD -j DOCKER-USER
  47. -A FORWARD -j DOCKER-ISOLATION-STAGE-1
  48. -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  49. -A FORWARD -o docker0 -j DOCKER
  50. -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
  51. -A FORWARD -i docker0 -o docker0 -j ACCEPT
  52. -A FORWARD -j ufw-before-logging-forward
  53. -A FORWARD -j ufw-before-forward
  54. -A FORWARD -j ufw-after-forward
  55. -A FORWARD -j ufw-after-logging-forward
  56. -A FORWARD -j ufw-reject-forward
  57. -A FORWARD -j ufw-track-forward
  58. -A OUTPUT -j ufw-before-logging-output
  59. -A OUTPUT -j ufw-before-output
  60. -A OUTPUT -j ufw-after-output
  61. -A OUTPUT -j ufw-after-logging-output
  62. -A OUTPUT -j ufw-reject-output
  63. -A OUTPUT -j ufw-track-output
  64. -A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9000 -j ACCEPT
  65. -A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
  66. -A DOCKER-ISOLATION-STAGE-1 -j RETURN
  67. -A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
  68. -A DOCKER-ISOLATION-STAGE-2 -j RETURN
  69. -A DOCKER-USER -j RETURN
  70. -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
  71. -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
  72. -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
  73. -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
  74. -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
  75. -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
  76. -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
  77. -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  78. -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  79. -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  80. -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
  81. -A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
  82. -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
  83. -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
  84. -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
  85. -A ufw-before-forward -j ufw-user-forward
  86. -A ufw-before-input -i lo -j ACCEPT
  87. -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  88. -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
  89. -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
  90. -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
  91. -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
  92. -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
  93. -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
  94. -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
  95. -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
  96. -A ufw-before-input -j ufw-not-local
  97. -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
  98. -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
  99. -A ufw-before-input -j ufw-user-input
  100. -A ufw-before-output -o lo -j ACCEPT
  101. -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  102. -A ufw-before-output -j ufw-user-output
  103. -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
  104. -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
  105. -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  106. -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
  107. -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
  108. -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
  109. -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
  110. -A ufw-not-local -j DROP
  111. -A ufw-skip-to-policy-forward -j DROP
  112. -A ufw-skip-to-policy-input -j DROP
  113. -A ufw-skip-to-policy-output -j ACCEPT
  114. -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
  115. -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
  116. -A ufw-user-input -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource
  117. -A ufw-user-input -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 --name DEFAULT --mask 255.255.255.255 --rsource -j ufw-user-limit
  118. -A ufw-user-input -p tcp -m tcp --dport 22 -j ufw-user-limit-accept
  119. -A ufw-user-input -p tcp -m tcp --dport 80 -j ACCEPT
  120. -A ufw-user-input -p tcp -m tcp --dport 443 -j ACCEPT
  121. -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
  122. -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
  123. -A ufw-user-limit-accept -j ACCEPT
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!