# firewall.conf.new.9
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:LIBVIRT_PRT - [0:0]
#D#-A INPUT -j LOG --log-prefix "iptables_mangle_END-i: " --log-uid
-A POSTROUTING -j LIBVIRT_PRT
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:LIBVIRT_PRT - [0:0]
# was ! -o lo - -o wlan6
# let resolve.conf redirect to lo - this rule cannot be removed
#-A OUTPUT -o wlan6 -p tcp --dport 53 -j DNAT --to-destination 127.0.0.1:53
#-A OUTPUT -o wlan6 -p udp --dport 53 -j DNAT --to-destination 127.0.0.1:53

# .onion mapped addresses redirection to Tor.
###-A OUTPUT -d 172.16.0.0/12 -p tcp -j DNAT --to-destination 127.0.0.1:9040

-A POSTROUTING -j LIBVIRT_PRT
-A LIBVIRT_PRT -s 10.0.2.0/24 -d 224.0.0.0/24 -j RETURN
-A LIBVIRT_PRT -s 10.0.2.0/24 -d 255.255.255.255/32 -j RETURN
-A LIBVIRT_PRT -s 10.0.2.0/24 ! -d 10.0.2.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 10.0.2.0/24 ! -d 10.0.2.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 10.0.2.0/24 ! -d 10.0.2.0/24 -j MASQUERADE
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:LIBVIRT_FWI - [0:0]
:LIBVIRT_FWO - [0:0]
:LIBVIRT_FWX - [0:0]
:LIBVIRT_INP - [0:0]
:LIBVIRT_OUT - [0:0]

#D#-A INPUT -j LOG --log-prefix "iptables_filter_BEGIN-i: firewall.conf.new.9" --log-uid

# blocks wlan
-A INPUT -s 217.182.196.70 -p tcp -j DROP
-A INPUT -s 185.213.20.105 -p tcp -j DROP
-A INPUT -s 185.32.222.237 -p tcp -j DROP
-A INPUT -s 92.223.105.174 -p tcp -j DROP
-A INPUT -s 195.201.168.111 -p tcp -j DROP
-A INPUT -s 51.15.115.217 -p tcp -j DROP
-A INPUT -s 89.163.224.33 -p tcp -j DROP
-A INPUT -s 130.193.15.49 -p tcp -j DROP
-A INPUT -s 95.216.19.207 -p tcp -j DROP
-A INPUT -s 176.158.122.84 -p tcp -j DROP
-A INPUT -s 80.66.135.13 -p tcp -j DROP
-A INPUT -s 176.9.118.73 -p tcp -j DROP
-A INPUT -s 109.236.90.209 -p tcp -j DROP
-A INPUT -s 51.79.22.224 -m tcp -p tcp -j DROP
-A INPUT -s 37.191.192.147 -m tcp -p tcp -j DROP
-A INPUT -s 5.1.56.52 -m tcp -p tcp -j DROP
-A INPUT -s 5.39.72.2 -m tcp -p tcp -j DROP
-A INPUT -s 51.38.81.39 -m tcp -p tcp -j DROP
-A INPUT -s 136.243.4.139 -m tcp -p tcp -j DROP
-A INPUT -s 95.211.136.23 -m tcp -p tcp -j DROP

## DROP INVALID
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m state --state INVALID -j DROP

## DROP INVALID SYN PACKETS
-A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
-A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
-A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

## DROP PACKETS WITH INCOMING FRAGMENTS. THIS ATTACK ONCE RESULTED IN KERNEL PANICS
-A INPUT -f -j DROP
## DROP INCOMING MALFORMED XMAS PACKETS
-A INPUT -p tcp --tcp-flags ALL ALL -j DROP
## DROP INCOMING MALFORMED NULL PACKETS
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP

-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
### this is required for outgoing pings
-A INPUT -i wlan6 -p icmp -j LOG --log-prefix "iptables_icmp_ACCEPT-i: " --log-uid
-A INPUT -i wlan6 -p icmp -j ACCEPT

#!-A INPUT -i wlan6 -m owner --gid-owner 226 -p udp --sport 123 -j LOG --log-uid --log-prefix "iptables_123_ACCEPT-o: "
#!-A INPUT -i wlan6 -m udp -p udp --sport 123 -m owner --gid-owner 226 -j ACCEPT
#!-A INPUT -i wlan6 -m owner --uid-owner 0 -p udp --sport 123 -j LOG --log-uid --log-prefix "iptables_123_ACCEPT-o: "
#!-A INPUT -i wlan6 -p udp --sport 123 -m owner --uid-owner 0 -j ACCEPT
#!-A INPUT -i wlan6 -p udp --sport 123 -m owner --uid-owner 0 -j ACCEPT
#!!-A INPUT -i wlan6 -p tcp -m owner --gid-owner 216 -j ACCEPT
#!!-A INPUT -i wlan6 -p tcp -m owner --gid-owner 1 -j ACCEPT
#!!-A INPUT -i wlan6 -p tcp -m owner --gid-owner 115 -j ACCEPT

### let dhcp through?
#?-A INPUT -p udp --sport 68 -j ACCEPT
#?-A INPUT -p udp --sport 67 -j ACCEPT
-A INPUT -i wlan6 -p udp --sport 137 -j DROP
-A INPUT -i wlan6 -p udp --sport 138 -j DROP
-A INPUT -i wlan6 -p udp --sport 139 -j DROP
### this is required for outgoing pings
-A INPUT -i virbr1 -p icmp -j LOG --log-prefix "iptables_icmp_ACCEPT-i: " --log-uid
-A INPUT -i virbr1 -p icmp -j ACCEPT
-A INPUT -i virbr1 -p tcp --sport 22 -j LOG --log-uid --log-prefix "iptables_22_ACCEPT-i: "
-A INPUT -i virbr1 -p tcp --sport 22 -j ACCEPT
-A INPUT -i virbr1 -p tcp --sport 9128 -j LOG --log-uid --log-prefix "iptables_9128_ACCEPT-i: "
-A INPUT -i virbr1 -p tcp --sport 9128 -j ACCEPT
-A INPUT -i virbr1 -p tcp --sport 9040 -j LOG --log-uid --log-prefix "iptables_9040_ACCEPT-i: "
-A INPUT -i virbr1 -p tcp --sport 9040 -j ACCEPT
-A INPUT -i virbr1 -p tcp --sport 9050 -j LOG --log-uid --log-prefix "iptables_9050_ACCEPT-i: "
-A INPUT -i virbr1 -p tcp --sport 9050 -j ACCEPT
-A INPUT -i virbr1 -p udp --sport 9053 -j LOG --log-uid --log-prefix "iptables_9053_ACCEPT-i: "
-A INPUT -i virbr1 -p udp --sport 9053 -j ACCEPT
-A INPUT -i virbr1 -p udp --sport 7001 -j LOG --log-uid --log-prefix "iptables_7001_ACCEPT-i: "
-A INPUT -i virbr1 -p udp --sport 7001 -j ACCEPT

#D#-A INPUT -j LOG --log-prefix "IPTABLES_filter_DROP-i: " --log-uid
#D#-A INPUT -j DROP
##-A FORWARD -j LOG --log-prefix "IPTABLES_forward_DROP-i: " --log-uid
##-A FORWARD -j REJECT --reject-with icmp-admin-prohibited
-A INPUT -j LIBVIRT_INP
-A FORWARD -j LIBVIRT_FWX
-A FORWARD -j LIBVIRT_FWI
-A FORWARD -j LIBVIRT_FWO
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o wlan6 -p icmp -j LOG --log-prefix "iptables_icmp_ACCEPT-o: " --log-uid
-A OUTPUT -o wlan6 -p icmp -j ACCEPT
## Accept outgoing connections to local network, Whonix-Workstation and VirtualBox,
#? WHY?!
##-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
##-A OUTPUT -d 10.16.238.0/24 -j ACCEPT
##-A OUTPUT -d 10.152.152.0/24 -j ACCEPT
##-A OUTPUT -d 10.0.2.0/24 -j ACCEPT

# The ntp user is allowed to connect to services listening on the ntp port...
# If root runs ntpdate manually you will see requests to port 53 UID=0
-A OUTPUT -o wlan6 -m owner --gid-owner 226 -p udp --dport 123 -j LOG --log-uid --log-prefix "iptables_123_ACCEPT-o: "
-A OUTPUT -o wlan6 -m owner --gid-owner 226 -p udp --dport 123 -j ACCEPT
-A OUTPUT -o wlan6 -m owner --uid-owner 0 -p udp --dport 123 -j LOG --log-uid --log-prefix "iptables_123_ACCEPT-o: "
-A OUTPUT -o wlan6 -m owner --uid-owner 0 -p udp --dport 123 -j ACCEPT
-A OUTPUT -o wlan6 -p tcp --dport 22 -j LOG --log-uid --log-prefix "IPTABLES_ssh_REJECT-o: "
-A OUTPUT -o wlan6 -p tcp --dport 22 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -o wlan6 -m owner --gid-owner 216 -j ACCEPT
-A OUTPUT -o wlan6 -m owner --gid-owner 115 -j ACCEPT
-A OUTPUT -o wlan6 -m owner --gid-owner 1 -j ACCEPT
-A OUTPUT -o virbr1 -p icmp -j LOG --log-prefix "iptables_icmp_ACCEPT-o: " --log-uid
-A OUTPUT -o virbr1 -p icmp -j ACCEPT
-A OUTPUT -o virbr1 -p tcp --dport 22 -j LOG --log-uid --log-prefix "iptables_22_ACCEPT-o: "
-A OUTPUT -o virbr1 -p tcp --dport 22 -j ACCEPT
-A OUTPUT -o virbr1 -p tcp --dport 9128 -j LOG --log-uid --log-prefix "iptables_9128_ACCEPT-o: "
-A OUTPUT -o virbr1 -p tcp --dport 9128 -j ACCEPT
-A OUTPUT -o virbr1 -p tcp --dport 9040 -j LOG --log-uid --log-prefix "iptables_9040_ACCEPT-o: "
-A OUTPUT -o virbr1 -p tcp --dport 9040 -j ACCEPT
-A OUTPUT -o virbr1 -p tcp --dport 9050 -j LOG --log-uid --log-prefix "iptables_9050_ACCEPT-o: "
-A OUTPUT -o virbr1 -p tcp --dport 9050 -j ACCEPT
-A OUTPUT -o virbr1 -p udp --dport 9053 -j LOG --log-uid --log-prefix "iptables_9053_ACCEPT-o: "
-A OUTPUT -o virbr1 -p udp --dport 9053 -j ACCEPT
-A OUTPUT -o virbr1 -p tcp --dport 7001 -j LOG --log-uid --log-prefix "iptables_7001_ACCEPT-o: "
-A OUTPUT -o virbr1 -p tcp --dport 7001 -j ACCEPT
#??-A OUTPUT -p udp -m udp --sport 68 --dport 67 -j RETURN
#?-A OUTPUT -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A OUTPUT -j LIBVIRT_OUT

# blocks virbr1
-A LIBVIRT_FWI -s 217.182.196.70 -p tcp -j DROP
-A LIBVIRT_FWI -s 185.213.20.105 -p tcp -j DROP
-A LIBVIRT_FWI -s 185.32.222.237 -p tcp -j DROP
-A LIBVIRT_FWI -s 92.223.105.174 -p tcp -j DROP
-A LIBVIRT_FWI -s 195.201.168.111 -p tcp -j DROP
-A LIBVIRT_FWI -s 51.15.115.217 -p tcp -j DROP
-A LIBVIRT_FWI -s 89.163.224.33 -p tcp -j DROP
-A LIBVIRT_FWI -s 130.193.15.49 -p tcp -j DROP
-A LIBVIRT_FWI -s 95.216.19.207 -p tcp -j DROP
-A LIBVIRT_FWI -s 176.158.122.84 -p tcp -j DROP
-A LIBVIRT_FWI -s 80.66.135.13 -p tcp -j DROP
-A LIBVIRT_FWI -s 176.9.118.73 -p tcp -j DROP
-A LIBVIRT_FWI -s 109.236.90.209 -p tcp -j DROP
-A LIBVIRT_FWI -s 51.79.22.224 -m tcp -p tcp -j DROP
-A LIBVIRT_FWI -s 37.191.192.147 -m tcp -p tcp -j DROP
-A LIBVIRT_FWI -s 5.1.56.52 -m tcp -p tcp -j DROP
-A LIBVIRT_FWI -s 5.39.72.2 -m tcp -p tcp -j DROP
-A LIBVIRT_FWI -s 51.38.81.39 -m tcp -p tcp -j DROP
-A LIBVIRT_FWI -s 136.243.4.139 -m tcp -p tcp -j DROP
-A LIBVIRT_FWI -s 95.211.136.23 -m tcp -p tcp -j DROP

# Drop any TCP Acknowlegements they are not needed an they trigger the logs
# https://serverfault.com/questions/578735/for-what-is-a-general-allow-ack-rule-in-iptables-good-for
# This creates a hole in the firewall big enough to portscan through; 
# nmap even has a flag to do an ACK scan which this rule will permit.  Michael Hampton
# -A LIBVIRT_FWI -i wlan6 -m tcp -p tcp --tcp-flags ACK ACK -j DROP

-A LIBVIRT_FWI -o virbr1 -j LOG --log-uid --log-prefix "IPTABLES_FWI_REJECT-o: "
-A LIBVIRT_FWI -o virbr2 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWI -d 10.0.2.0/24 -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A LIBVIRT_FWI -o virbr1 -j LOG --log-uid --log-prefix "IPTABLES_FWI_REJECT-o: "
-A LIBVIRT_FWI -o virbr1 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWO -i virbr2 -j LOG --log-uid --log-prefix "IPTABLES_FWO_REJECT-i: "
-A LIBVIRT_FWO -i virbr2 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWO -s 10.0.2.0/24 -i virbr1 -j ACCEPT
-A LIBVIRT_FWO -i virbr1 -j LOG --log-uid --log-prefix "IPTABLES_FWO_REJECT-i: "
-A LIBVIRT_FWO -i virbr1 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWX -i virbr2 -o virbr2 -j ACCEPT
-A LIBVIRT_FWX -i virbr1 -o virbr1 -j ACCEPT
# FixMe: sic this is what libvirt did -i --dport
# FixMe: I will disable them as I dont think theyre needed
#no -A LIBVIRT_INP -i virbr2 -p udp --dport 53 -j ACCEPT
#no -A LIBVIRT_INP -i virbr2 -p tcp --dport 53 -j ACCEPT
#no -A LIBVIRT_INP -i virbr2 -p udp --dport 67 -j ACCEPT
#no -A LIBVIRT_INP -i virbr2 -p tcp --dport 67 -j ACCEPT
#no -A LIBVIRT_INP -i virbr1 -p udp --dport 53 -j ACCEPT
#no -A LIBVIRT_INP -i virbr1 -p tcp --dport 53 -j ACCEPT
#no -A LIBVIRT_INP -i virbr1 -p udp --dport 67 -j ACCEPT
#no -A LIBVIRT_INP -i virbr1 -p tcp --dport 67 -j ACCEPT
#no -A LIBVIRT_OUT -o virbr2 -p udp --dport 53 -j ACCEPT
#no -A LIBVIRT_OUT -o virbr2 -p tcp --dport 53 -j ACCEPT
#no -A LIBVIRT_OUT -o virbr2 -p udp --dport 68 -j ACCEPT
#no -A LIBVIRT_OUT -o virbr2 -p tcp --dport 68 -j ACCEPT
#no -A LIBVIRT_OUT -o virbr1 -p udp --dport 53 -j ACCEPT
#no -A LIBVIRT_OUT -o virbr1 -p tcp --dport 53 -j ACCEPT
#no -A LIBVIRT_OUT -o virbr1 -p udp --dport 68 -j ACCEPT
#no -A LIBVIRT_OUT -o virbr1 -p tcp --dport 68 -j ACCEPT
-A OUTPUT -j LOG --log-uid --log-prefix "IPTABLES_filter_DROP-o: "
-A OUTPUT -j DROP
COMMIT
# Completed on Wed Nov  4 01:14:37 2020
# Whonix firewall for wlan6 10.16.238.64 10.16.238.64/24 LIBVIRT_FW=1
# WORKS with Gateway tor - ssh