Public Pastes
daily pastebin goal
11%
SHARE
TWEET

Untitled

a guest Jan 18th, 2016 45 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # Completed on Mon Jan 18 15:43:49 2016
  2. # Generated by iptables-save v1.4.21 on Mon Jan 18 15:43:49 2016
  3. *filter
  4. :INPUT DROP [149:19844]
  5. :FORWARD DROP [0:0]
  6. :OUTPUT ACCEPT [0:0]
  7. :DOCKER - [0:0]
  8. :monitorix_IN_0 - [0:0]
  9. :monitorix_IN_1 - [0:0]
  10. :monitorix_IN_2 - [0:0]
  11. :monitorix_IN_3 - [0:0]
  12. :monitorix_IN_4 - [0:0]
  13. :monitorix_IN_5 - [0:0]
  14. :monitorix_IN_6 - [0:0]
  15. :monitorix_IN_7 - [0:0]
  16. :monitorix_IN_8 - [0:0]
  17. :monitorix_nginx_IN - [0:0]
  18. :ufw-after-forward - [0:0]
  19. :ufw-after-input - [0:0]
  20. :ufw-after-logging-forward - [0:0]
  21. :ufw-after-logging-input - [0:0]
  22. :ufw-after-logging-output - [0:0]
  23. :ufw-after-output - [0:0]
  24. :ufw-before-forward - [0:0]
  25. :ufw-before-input - [0:0]
  26. :ufw-before-logging-forward - [0:0]
  27. :ufw-before-logging-input - [0:0]
  28. :ufw-before-logging-output - [0:0]
  29. :ufw-before-output - [0:0]
  30. :ufw-logging-allow - [0:0]
  31. :ufw-logging-deny - [0:0]
  32. :ufw-not-local - [0:0]
  33. :ufw-reject-forward - [0:0]
  34. :ufw-reject-input - [0:0]
  35. :ufw-reject-output - [0:0]
  36. :ufw-skip-to-policy-forward - [0:0]
  37. :ufw-skip-to-policy-input - [0:0]
  38. :ufw-skip-to-policy-output - [0:0]
  39. :ufw-track-forward - [0:0]
  40. :ufw-track-input - [0:0]
  41. :ufw-track-output - [0:0]
  42. :ufw-user-forward - [0:0]
  43. :ufw-user-input - [0:0]
  44. :ufw-user-limit - [0:0]
  45. :ufw-user-limit-accept - [0:0]
  46. :ufw-user-logging-forward - [0:0]
  47. :ufw-user-logging-input - [0:0]
  48. :ufw-user-logging-output - [0:0]
  49. :ufw-user-output - [0:0]
  50. -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j monitorix_nginx_IN
  51. -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 143 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j monitorix_IN_8
  52. -A INPUT -p udp -m udp --sport 1024:65535 --dport 53 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j monitorix_IN_7
  53. -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 3306 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j monitorix_IN_6
  54. -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 139 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j monitorix_IN_5
  55. -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 110 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j monitorix_IN_4
  56. -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 22 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j monitorix_IN_3
  57. -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j monitorix_IN_2
  58. -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 21 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j monitorix_IN_1
  59. -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 25 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j monitorix_IN_0
  60. -A INPUT -j ufw-before-logging-input
  61. -A INPUT -j ufw-before-input
  62. -A INPUT -j ufw-after-input
  63. -A INPUT -j ufw-after-logging-input
  64. -A INPUT -j ufw-reject-input
  65. -A INPUT -j ufw-track-input
  66. -A FORWARD -o docker0 -j DOCKER
  67. -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  68. -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
  69. -A FORWARD -i docker0 -o docker0 -j ACCEPT
  70. -A FORWARD -j ufw-before-logging-forward
  71. -A FORWARD -j ufw-before-forward
  72. -A FORWARD -j ufw-after-forward
  73. -A FORWARD -j ufw-after-logging-forward
  74. -A FORWARD -j ufw-reject-forward
  75. -A FORWARD -j ufw-track-forward
  76. -A OUTPUT -p tcp -m tcp --sport 80 --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED -j monitorix_nginx_IN
  77. -A OUTPUT -p tcp -m tcp --sport 143 --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED -j monitorix_IN_8
  78. -A OUTPUT -p udp -m udp --sport 53 --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED -j monitorix_IN_7
  79. -A OUTPUT -p tcp -m tcp --sport 3306 --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED -j monitorix_IN_6
  80. -A OUTPUT -p tcp -m tcp --sport 139 --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED -j monitorix_IN_5
  81. -A OUTPUT -p tcp -m tcp --sport 110 --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED -j monitorix_IN_4
  82. -A OUTPUT -p tcp -m tcp --sport 22 --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED -j monitorix_IN_3
  83. -A OUTPUT -p tcp -m tcp --sport 80 --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED -j monitorix_IN_2
  84. -A OUTPUT -p tcp -m tcp --sport 21 --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED -j monitorix_IN_1
  85. -A OUTPUT -p tcp -m tcp --sport 25 --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED -j monitorix_IN_0
  86. -A OUTPUT -j ufw-before-logging-output
  87. -A OUTPUT -j ufw-before-output
  88. -A OUTPUT -j ufw-after-output
  89. -A OUTPUT -j ufw-after-logging-output
  90. -A OUTPUT -j ufw-reject-output
  91. -A OUTPUT -j ufw-track-output
  92. -A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p udp -m udp --dport 1194 -j ACCEPT
  93. -A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 12001 -j ACCEPT
  94. -A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 10001 -j ACCEPT
  95. -A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8082 -j ACCEPT
  96. -A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
  97. -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
  98. -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
  99. -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
  100. -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
  101. -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
  102. -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
  103. -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
  104. -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  105. -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  106. -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  107. -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
  108. -A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
  109. -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
  110. -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
  111. -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
  112. -A ufw-before-forward -j ufw-user-forward
  113. -A ufw-before-input -i lo -j ACCEPT
  114. -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  115. -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
  116. -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
  117. -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
  118. -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
  119. -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
  120. -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
  121. -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
  122. -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
  123. -A ufw-before-input -j ufw-not-local
  124. -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
  125. -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
  126. -A ufw-before-input -j ufw-user-input
  127. -A ufw-before-output -o lo -j ACCEPT
  128. -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  129. -A ufw-before-output -j ufw-user-output
  130. -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
  131. -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
  132. -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
  133. -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
  134. -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
  135. -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
  136. -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
  137. -A ufw-not-local -j DROP
  138. -A ufw-skip-to-policy-forward -j DROP
  139. -A ufw-skip-to-policy-input -j DROP
  140. -A ufw-skip-to-policy-output -j ACCEPT
  141. -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
  142. -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
  143. -A ufw-user-input -p tcp -m tcp --dport 22228 -j ACCEPT
  144. -A ufw-user-input -p udp -m udp --dport 22228 -j ACCEPT
  145. -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
  146. -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
  147. -A ufw-user-limit-accept -j ACCEPT
  148. COMMIT
  149. # Completed on Mon Jan 18 15:43:49 2016
RAW Paste Data
Top