Advertisement
Guest User

Untitled

a guest
Mar 26th, 2015
254
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # Generated by iptables-save v1.4.21 on Thu Mar 26 14:27:08 2015
  2. *raw
  3. :PREROUTING ACCEPT [5322:1067329]
  4. :OUTPUT ACCEPT [3831:879430]
  5. -A PREROUTING -i lo -j CT --notrack
  6. -A OUTPUT -o lo -j CT --notrack
  7. COMMIT
  8. # Completed on Thu Mar 26 14:27:08 2015
  9. # Generated by iptables-save v1.4.21 on Thu Mar 26 14:27:08 2015
  10. *filter
  11. :INPUT DROP [0:0]
  12. :FORWARD DROP [0:0]
  13. :OUTPUT ACCEPT [947:178177]
  14. :fail2ban-DCOT - [0:0]
  15. :fail2ban-PFIX - [0:0]
  16. :fail2ban-SASL - [0:0]
  17. :forward_ext - [0:0]
  18. :input_ext - [0:0]
  19. :reject_func - [0:0]
  20. -A INPUT -p tcp -m multiport --dports 25,465,587 -j fail2ban-SASL
  21. -A INPUT -p tcp -m multiport --dports 110,995,143,993 -j fail2ban-DCOT
  22. -A INPUT -p tcp -m multiport --dports 25,465,587 -j fail2ban-PFIX
  23. -A INPUT -i lo -j ACCEPT
  24. -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
  25. -A INPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT
  26. -A INPUT -j input_ext
  27. -A INPUT -m limit --limit 3/min -j LOG --log-prefix "SFW2-IN-ILL-TARGET " --log-tcp-options --log-ip-options
  28. -A INPUT -j DROP
  29. -A FORWARD -m limit --limit 3/min -j LOG --log-prefix "SFW2-FWD-ILL-ROUTING " --log-tcp-options --log-ip-options
  30. -A OUTPUT -o lo -j ACCEPT
  31. -A fail2ban-DCOT -j RETURN
  32. -A fail2ban-PFIX -j RETURN
  33. -A fail2ban-SASL -j RETURN
  34. -A input_ext -m pkttype --pkt-type broadcast -j DROP
  35. -A input_ext -p icmp -m icmp --icmp-type 4 -j ACCEPT
  36. -A input_ext -p icmp -m icmp --icmp-type 8 -j ACCEPT
  37. -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 10011 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
  38. -A input_ext -p tcp -m tcp --dport 10011 -j ACCEPT
  39. -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 30033 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
  40. -A input_ext -p tcp -m tcp --dport 30033 -j ACCEPT
  41. -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
  42. -A input_ext -p tcp -m tcp --dport 80 -j ACCEPT
  43. -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
  44. -A input_ext -p tcp -m tcp --dport 80 -j ACCEPT
  45. -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
  46. -A input_ext -p tcp -m tcp --dport 443 -j ACCEPT
  47. -A input_ext -p udp -m udp --dport 53 -j ACCEPT
  48. -A input_ext -p udp -m udp --dport 8767 -j ACCEPT
  49. -A input_ext -p udp -m udp --dport 9987 -j ACCEPT
  50. -A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --rcheck --seconds 36000 --hitcount 2 --name sshd --mask 255.255.255.255 --rsource -j LOG --log-prefix "SFW2-INext-DROPr " --log-tcp-options --log-ip-options
  51. -A input_ext -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 36000 --hitcount 2 --name sshd --mask 255.255.255.255 --rsource -j DROP
  52. -A input_ext -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 3/min -j LOG --log-prefix "SFW2-INext-ACC " --log-tcp-options --log-ip-options
  53. -A input_ext -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name sshd --mask 255.255.255.255 --rsource -j ACCEPT
  54. -A input_ext -p tcp -m tcp --dport 22 -j ACCEPT
  55. -A input_ext -m pkttype --pkt-type multicast -j DROP
  56. -A input_ext -m pkttype --pkt-type broadcast -j DROP
  57. -A input_ext -p tcp -m limit --limit 3/min -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
  58. -A input_ext -p icmp -m limit --limit 3/min -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
  59. -A input_ext -p udp -m limit --limit 3/min -m conntrack --ctstate NEW -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
  60. -A input_ext -j DROP
  61. -A reject_func -p tcp -j REJECT --reject-with tcp-reset
  62. -A reject_func -p udp -j REJECT --reject-with icmp-port-unreachable
  63. -A reject_func -j REJECT --reject-with icmp-proto-unreachable
  64. COMMIT
  65. # Completed on Thu Mar 26 14:27:08 2015
Advertisement
RAW Paste Data Copied
Advertisement