135 lines
8.1 KiB
Plaintext
135 lines
8.1 KiB
Plaintext
# Generated by xtables-save v1.8.2 on Sat Dec 12 13:40:39 2020
|
|
*filter
|
|
:INPUT DROP [0:0]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT DROP [0:0]
|
|
-A INPUT -m conntrack --ctstate INVALID -j DROP
|
|
-A INPUT -m state --state INVALID -j DROP
|
|
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j DROP
|
|
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
|
|
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
|
|
-A INPUT -f -j DROP
|
|
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
|
|
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
|
|
-A INPUT -i lo -j ACCEPT
|
|
-A INPUT -m state --state ESTABLISHED -j ACCEPT
|
|
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
|
|
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
|
|
-A INPUT -i eth0 -p tcp -m tcp --dport 9050 -j ACCEPT
|
|
-A INPUT -i eth0 -p tcp -m tcp --dport 9053 -j ACCEPT
|
|
-A INPUT -i eth0 -p tcp -m tcp --dport 9040 -j ACCEPT
|
|
-A INPUT -i eth0 -p tcp -m tcp --dport 9128 -j ACCEPT
|
|
-A INPUT -i eth1 -p udp -m udp --dport 5300 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9040 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9051 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9124 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9104 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9111 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9117 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9107 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9123 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9105 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9103 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9101 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9122 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9121 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9120 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9113 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9112 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9118 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9108 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9106 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9100 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9150 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9115 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9116 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9102 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9119 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9050 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9109 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9110 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9114 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m tcp --dport 9125 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m multiport --dports 9152:9189 -j ACCEPT
|
|
-A INPUT -i eth0 -p udp -m udp --dport 9053 -j ACCEPT
|
|
-A INPUT -j DROP
|
|
-A FORWARD -j REJECT --reject-with icmp-admin-prohibited
|
|
-A OUTPUT -m conntrack --ctstate INVALID -j REJECT --reject-with icmp-admin-prohibited
|
|
-A OUTPUT -m state --state INVALID -j REJECT --reject-with icmp-admin-prohibited
|
|
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j REJECT --reject-with icmp-admin-prohibited
|
|
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j REJECT --reject-with icmp-admin-prohibited
|
|
-A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j REJECT --reject-with icmp-admin-prohibited
|
|
-A OUTPUT -f -j REJECT --reject-with icmp-admin-prohibited
|
|
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j REJECT --reject-with icmp-admin-prohibited
|
|
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j REJECT --reject-with icmp-admin-prohibited
|
|
-A OUTPUT -m state --state ESTABLISHED -j ACCEPT
|
|
-A OUTPUT -m iprange --dst-range 127.0.0.0-127.0.0.24 -j ACCEPT
|
|
-A OUTPUT -m iprange --dst-range 192.168.0.0-192.168.0.24 -j ACCEPT
|
|
-A OUTPUT -m iprange --dst-range 192.168.1.0-192.168.1.24 -j ACCEPT
|
|
-A OUTPUT -m iprange --dst-range 10.152.152.0-10.152.152.24 -j ACCEPT
|
|
-A OUTPUT -m iprange --dst-range 10.0.2.2-10.0.2.24 -j ACCEPT
|
|
-A OUTPUT -o lo -j ACCEPT
|
|
-A OUTPUT -m owner --uid-owner 108 -j ACCEPT
|
|
-A OUTPUT -m owner --uid-owner 106 -j ACCEPT
|
|
-A OUTPUT -m owner --uid-owner 105 -j ACCEPT
|
|
-A OUTPUT -j REJECT --reject-with icmp-admin-prohibited
|
|
COMMIT
|
|
# Completed on Sat Dec 12 13:40:40 2020
|
|
# Generated by xtables-save v1.8.2 on Sat Dec 12 13:40:40 2020
|
|
*nat
|
|
:PREROUTING ACCEPT [0:0]
|
|
:INPUT ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9051 -j REDIRECT --to-ports 9051
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9124 -j REDIRECT --to-ports 9124
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9104 -j REDIRECT --to-ports 9104
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9111 -j REDIRECT --to-ports 9111
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9117 -j REDIRECT --to-ports 9117
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9107 -j REDIRECT --to-ports 9107
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9123 -j REDIRECT --to-ports 9123
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9105 -j REDIRECT --to-ports 9105
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9103 -j REDIRECT --to-ports 9103
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9101 -j REDIRECT --to-ports 9101
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9122 -j REDIRECT --to-ports 9122
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9121 -j REDIRECT --to-ports 9121
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9120 -j REDIRECT --to-ports 9120
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9113 -j REDIRECT --to-ports 9113
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9112 -j REDIRECT --to-ports 9112
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9118 -j REDIRECT --to-ports 9118
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9108 -j REDIRECT --to-ports 9108
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9106 -j REDIRECT --to-ports 9106
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9100 -j REDIRECT --to-ports 9100
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9150 -j REDIRECT --to-ports 9150
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9115 -j REDIRECT --to-ports 9115
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9116 -j REDIRECT --to-ports 9116
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9102 -j REDIRECT --to-ports 9102
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9119 -j REDIRECT --to-ports 9119
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9050 -j REDIRECT --to-ports 9050
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9109 -j REDIRECT --to-ports 9109
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9110 -j REDIRECT --to-ports 9110
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9114 -j REDIRECT --to-ports 9114
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9125 -j REDIRECT --to-ports 9125
|
|
-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9152:9189 -j REDIRECT
|
|
-A PREROUTING -i eth1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 5300
|
|
-A PREROUTING -i eth1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
|
|
-A OUTPUT -m owner --uid-owner 108 -j RETURN
|
|
-A OUTPUT -m owner --uid-owner 106 -j RETURN
|
|
-A OUTPUT -m owner --uid-owner 105 -j RETURN
|
|
-A OUTPUT -m iprange --dst-range 127.0.0.0-127.0.0.24 -j RETURN
|
|
-A OUTPUT -m iprange --dst-range 192.168.0.0-192.168.0.24 -j RETURN
|
|
-A OUTPUT -m iprange --dst-range 192.168.1.0-192.168.1.24 -j RETURN
|
|
-A OUTPUT -m iprange --dst-range 10.152.152.0-10.152.152.24 -j RETURN
|
|
-A OUTPUT -m iprange --dst-range 10.0.2.2-10.0.2.24 -j RETURN
|
|
COMMIT
|
|
# Completed on Sat Dec 12 13:40:40 2020
|
|
# Generated by xtables-save v1.8.2 on Sat Dec 12 13:40:40 2020
|
|
*mangle
|
|
:PREROUTING ACCEPT [0:0]
|
|
:INPUT ACCEPT [0:0]
|
|
:FORWARD ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
COMMIT
|
|
# Completed on Sat Dec 12 13:40:40 2020
|