# Generated by iptables-save v1.4.21 on Thu Mar 26 14:27:08 2015
*raw
:PREROUTING ACCEPT [5322:1067329]
:OUTPUT ACCEPT [3831:879430]
-A PREROUTING -i lo -j CT --notrack
-A OUTPUT -o lo -j CT --notrack
COMMIT
# Completed on Thu Mar 26 14:27:08 2015
# Generated by iptables-save v1.4.21 on Thu Mar 26 14:27:08 2015
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [947:178177]
:fail2ban-DCOT - [0:0]
:fail2ban-PFIX - [0:0]
:fail2ban-SASL - [0:0]
:forward_ext - [0:0]
:input_ext - [0:0]
:reject_func - [0:0]
-A INPUT -p tcp -m multiport --dports 25,465,587 -j fail2ban-SASL
-A INPUT -p tcp -m multiport --dports 110,995,143,993 -j fail2ban-DCOT
-A INPUT -p tcp -m multiport --dports 25,465,587 -j fail2ban-PFIX
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT
-A INPUT -j input_ext
-A INPUT -m limit --limit 3/min -j LOG --log-prefix "SFW2-IN-ILL-TARGET " --log-tcp-options --log-ip-options
-A INPUT -j DROP
-A FORWARD -m limit --limit 3/min -j LOG --log-prefix "SFW2-FWD-ILL-ROUTING " --log-tcp-options --log-ip-options
-A OUTPUT -o lo -j ACCEPT
-A fail2ban-DCOT -j RETURN
-A fail2ban-PFIX -j RETURN
-A fail2ban-SASL -j RETURN
-A input_ext -m pkttype --pkt-type broadcast -j DROP
-A input_ext -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A input_ext -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 10011 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 10011 -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 30033 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 30033 -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 80 -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 80 -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 443 -j ACCEPT
-A input_ext -p udp -m udp --dport 53 -j ACCEPT
-A input_ext -p udp -m udp --dport 8767 -j ACCEPT
-A input_ext -p udp -m udp --dport 9987 -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --rcheck --seconds 36000 --hitcount 2 --name sshd --mask 255.255.255.255 --rsource -j LOG --log-prefix "SFW2-INext-DROPr " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 36000 --hitcount 2 --name sshd --mask 255.255.255.255 --rsource -j DROP
-A input_ext -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 3/min -j LOG --log-prefix "SFW2-INext-ACC " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name sshd --mask 255.255.255.255 --rsource -j ACCEPT
-A input_ext -p tcp -m tcp --dport 22 -j ACCEPT
-A input_ext -m pkttype --pkt-type multicast -j DROP
-A input_ext -m pkttype --pkt-type broadcast -j DROP
-A input_ext -p tcp -m limit --limit 3/min -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m limit --limit 3/min -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -p udp -m limit --limit 3/min -m conntrack --ctstate NEW -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -j DROP
-A reject_func -p tcp -j REJECT --reject-with tcp-reset
-A reject_func -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject_func -j REJECT --reject-with icmp-proto-unreachable
COMMIT
# Completed on Thu Mar 26 14:27:08 2015