| 3 |
- |
1 |
*filter
|
|
|
2 |
-A INPUT -p esp -m esp -i eth1 -j ACCEPT
|
|
|
3 |
-A INPUT -p ah -m ah -i eth1 -j ACCEPT
|
|
|
4 |
-A INPUT -p udp -m udp -i eth1 --dport 500 -j ACCEPT
|
| 150 |
- |
5 |
-A INPUT -p tcp -m tcp -i eth1 --dport 443 -j ACCEPT
|
| 3 |
- |
6 |
-A INPUT -p udp -m udp -i eth1 --dport 1194 -j ACCEPT
|
| 145 |
- |
7 |
# Closed by Cox
|
| 150 |
- |
8 |
-A INPUT -p tcp -m tcp -i eth1 --dport 80 -j REJECT
|
|
|
9 |
-A INPUT -p tcp -m tcp -i eth1 --dport 8000 -j REJECT
|
|
|
10 |
-A INPUT -p tcp -m tcp -i eth1 --dport 8080 -j REJECT
|
| 145 |
- |
11 |
# Closed by Cox
|
| 150 |
- |
12 |
-A INPUT -p tcp -m tcp -i eth1 --dport 25 -j REJECT
|
|
|
13 |
-A INPUT -p tcp -m tcp -i eth1 --dport 22 -j REJECT
|
|
|
14 |
-A INPUT -p tcp -m tcp -i eth1 --dport 53 -j REJECT
|
|
|
15 |
-A INPUT -p tcp -m tcp -i eth1 --dport 111 -j REJECT
|
|
|
16 |
-A INPUT -p tcp -m tcp -i eth1 --dport 135 -j REJECT
|
|
|
17 |
-A INPUT -p tcp -m tcp -i eth1 --dport 136 -j REJECT
|
|
|
18 |
-A INPUT -p tcp -m tcp -i eth1 --dport 137 -j REJECT
|
|
|
19 |
-A INPUT -p tcp -m tcp -i eth1 --dport 138 -j REJECT
|
|
|
20 |
-A INPUT -p tcp -m tcp -i eth1 --dport 139 -j REJECT
|
|
|
21 |
-A INPUT -p tcp -m tcp -i eth1 --dport 177 -j REJECT
|
|
|
22 |
-A INPUT -p tcp -m tcp -i eth1 --dport 445 -j REJECT
|
|
|
23 |
-A INPUT -p tcp -m tcp -i eth1 --dport 631 -j REJECT
|
|
|
24 |
-A INPUT -p tcp -m tcp -i eth1 --dport 783 -j REJECT
|
|
|
25 |
-A INPUT -p tcp -m tcp -i eth1 --dport 953 -j REJECT
|
|
|
26 |
-A INPUT -p tcp -m tcp -i eth1 --dport 1433 -j REJECT
|
|
|
27 |
-A INPUT -p tcp -m tcp -i eth1 --dport 10000 -j REJECT
|
|
|
28 |
-A INPUT -p tcp -m tcp -i eth1 --dport 27374 -j REJECT
|
|
|
29 |
-A INPUT -p tcp -m tcp -i eth1 --dport 32770 -j REJECT
|
|
|
30 |
-A INPUT -p tcp -m tcp -i eth1 --dport 32771 -j REJECT
|
|
|
31 |
-A INPUT -p udp -m udp -i eth1 --dport 53 -j REJECT
|
|
|
32 |
-A INPUT -p udp -m udp -i eth1 --dport 68 -j REJECT
|
|
|
33 |
-A INPUT -p udp -m udp -i eth1 --dport 111 -j REJECT
|
|
|
34 |
-A INPUT -p udp -m udp -i eth1 --dport 135 -j REJECT
|
|
|
35 |
-A INPUT -p udp -m udp -i eth1 --dport 136 -j REJECT
|
|
|
36 |
-A INPUT -p udp -m udp -i eth1 --dport 137 -j REJECT
|
|
|
37 |
-A INPUT -p udp -m udp -i eth1 --dport 138 -j REJECT
|
|
|
38 |
-A INPUT -p udp -m udp -i eth1 --dport 139 -j REJECT
|
| 3 |
- |
39 |
# Allow NTP client traffic
|
| 150 |
- |
40 |
-A INPUT -p udp -m udp --dport 123 -j ACCEPT
|
|
|
41 |
-A INPUT -p udp -m udp --sport 123 -j ACCEPT
|
|
|
42 |
-A INPUT -p udp -m udp -i eth1 --dport 177 -j REJECT
|
|
|
43 |
-A INPUT -p udp -m udp -i eth1 --dport 445 -j REJECT
|
|
|
44 |
-A INPUT -p udp -m udp -i eth1 --dport 922 -j REJECT
|
|
|
45 |
-A INPUT -p udp -m udp -i eth1 --dport 1433 -j REJECT
|
|
|
46 |
-A INPUT -p udp -m udp -i eth1 --dport 3130 -j REJECT
|
|
|
47 |
-A INPUT -p udp -m udp -i eth1 --dport 10000 -j REJECT
|
|
|
48 |
-A INPUT -p udp -m udp -i eth1 --dport 27374 -j REJECT
|
|
|
49 |
-A INPUT -p udp -m udp -i eth1 --dport 32768 -j REJECT
|
| 3 |
- |
50 |
# Allow openvpn traffic
|
| 150 |
- |
51 |
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
|
|
|
52 |
-A INPUT -p udp -m udp --sport 1194 -j ACCEPT
|
|
|
53 |
-A INPUT -p icmp -m icmp -i eth1 -j ACCEPT
|
| 3 |
- |
54 |
COMMIT
|
|
|
55 |
|
|
|
56 |
*nat
|
|
|
57 |
:PREROUTING ACCEPT [9:1101]
|
|
|
58 |
:POSTROUTING ACCEPT [14:962]
|
|
|
59 |
:OUTPUT ACCEPT [14:962]
|
|
|
60 |
|
| 133 |
- |
61 |
# Webserver
|
|
|
62 |
-A PREROUTING -i eth1 -p tcp --dport 443 -j DNAT --to-destination 10.192.25.240:443
|
| 145 |
- |
63 |
-A PREROUTING -i eth0 -d 72.192.249.173 -p tcp --dport 443 -j DNAT --to-destination 10.192.25.240:443
|
| 3 |
- |
64 |
|
|
|
65 |
# openvpn
|
|
|
66 |
-A POSTROUTING -s 192.168.200.0/24 -d 10.192.25.0/24 -j ACCEPT
|
|
|
67 |
-A POSTROUTING -d 192.168.200.0/24 -s 10.192.25.0/24 -j ACCEPT
|
|
|
68 |
|
|
|
69 |
-A POSTROUTING -s 10.192.25.0/255.255.255.0 -j MASQUERADE
|
|
|
70 |
-A POSTROUTING -s 192.168.200.0/255.255.255.0 -j MASQUERADE
|
|
|
71 |
|
|
|
72 |
COMMIT
|