View Single Post
  #5  
Old 15th March 2006, 07:01
zacch zacch is offline
Junior Member
 
Join Date: Mar 2006
Posts: 9
Thanks: 0
Thanked 0 Times in 0 Posts
Default

-A forward_ext -s 10.1.0.0/255.255.0.0 -j DROP
-A forward_ext -d 10.1.0.254 -j LOG --log-prefix "SFW2-FWDext-DROP-CIRCUMV " --log-tcp-options --log-ip-options
-A forward_ext -d 10.1.0.254 -j DROP
-A forward_ext -p icmp -m state --state RELATED -m icmp --icmp-type 3 -j ACCEPT
-A forward_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 0 -j ACCEPT
-A forward_ext -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A forward_ext -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A forward_ext -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-FWDext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_ext -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-FWDext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_ext -p icmp -m icmp --icmp-type 5 -j LOG --log-prefix "SFW2-FWDext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_ext -p icmp -m icmp --icmp-type 8 -j LOG --log-prefix "SFW2-FWDext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_ext -p icmp -m icmp --icmp-type 13 -j LOG --log-prefix "SFW2-FWDext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_ext -p icmp -m icmp --icmp-type 17 -j LOG --log-prefix "SFW2-FWDext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_ext -p udp -j LOG --log-prefix "SFW2-FWDext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_ext -m state --state INVALID -j LOG --log-prefix "SFW2-FWDext-DROP-DEFLT-INV " --log-tcp-options --log-ip-options
-A forward_ext -j DROP
-A forward_int -s 172.17.17.0/255.255.255.0 -j LOG --log-prefix "SFW2-FWDint-DROP-ANTISPOOF " --log-tcp-options --log-ip-options
-A forward_int -s 172.17.17.0/255.255.255.0 -j DROP
-A forward_int -d 172.17.17.20 -j LOG --log-prefix "SFW2-FWDint-DROP-CIRCUMV " --log-tcp-options --log-ip-options
-A forward_int -d 172.17.17.20 -j DROP
-A forward_int -p icmp -m state --state RELATED -m icmp --icmp-type 3 -j ACCEPT
-A forward_int -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 0 -j ACCEPT
-A forward_int -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A forward_int -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A forward_int -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-FWDint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_int -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-FWDint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_int -p icmp -m icmp --icmp-type 5 -j LOG --log-prefix "SFW2-FWDint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_int -p icmp -m icmp --icmp-type 8 -j LOG --log-prefix "SFW2-FWDint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_int -p icmp -m icmp --icmp-type 13 -j LOG --log-prefix "SFW2-FWDint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_int -p icmp -m icmp --icmp-type 17 -j LOG --log-prefix "SFW2-FWDint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_int -p udp -j LOG --log-prefix "SFW2-FWDint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A forward_int -m state --state INVALID -j LOG --log-prefix "SFW2-FWDint-DROP-DEFLT-INV " --log-tcp-options --log-ip-options
-A forward_int -j DROP
-A input_dmz -s 172.17.17.0/255.255.255.0 -j LOG --log-prefix "SFW2-INdmz-DROP-ANTISPOOF " --log-tcp-options --log-ip-options
-A input_dmz -s 172.17.17.0/255.255.255.0 -j DROP
-A input_dmz -s 10.1.0.0/255.255.0.0 -j LOG --log-prefix "SFW2-INdmz-DROP-ANTISPOOF " --log-tcp-options --log-ip-options
-A input_dmz -s 10.1.0.0/255.255.0.0 -j DROP
-A input_dmz -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 0 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 3 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 11 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 12 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 14 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 18 -j ACCEPT
-A input_dmz -p icmp -m icmp --icmp-type 5 -j LOG --log-prefix "SFW2-INdmz-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-INdmz-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 13 -j LOG --log-prefix "SFW2-INdmz-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 17 -j LOG --log-prefix "SFW2-INdmz-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 2 -j LOG --log-prefix "SFW2-INdmz-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -j DROP
-A input_dmz -p tcp -m tcp --dport 113 --tcp-flags SYN,RST,ACK SYN -j reject_func
-A input_dmz -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 80 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 80 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 111 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 111 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 631 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 631 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 3128 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 3128 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 8080 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 8080 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 10000 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 10000 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m state --state RELATED,ESTABLISHED -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-ACC-HiTCP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A input_dmz -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A input_dmz -p udp -m udp --dport 22 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 80 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 111 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 111 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 631 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 631 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 1024 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 1025 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 1026 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 3128 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 3130 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 3401 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 8080 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 10000 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 10000 -m state --state NEW -j DROP
-A input_dmz -p udp -m state --state NEW -m udp --dport 1024:65535 -j ACCEPT
-A input_dmz -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 5 -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 8 -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 13 -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 17 -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p udp -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -m state --state INVALID -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT-INV " --log-tcp-options --log-ip-options
-A input_dmz -j DROP
-A input_ext -s 10.1.0.0/255.255.0.0 -j LOG --log-prefix "SFW2-INext-DROP-ANTISPOOF " --log-tcp-options --log-ip-options
-A input_ext -s 10.1.0.0/255.255.0.0 -j DROP
-A input_ext -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-INext-ACC-SOURCEQUENCH " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A input_ext -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 0 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 3 -j ACCEPT
Reply With Quote