Subversion Repositories configs

Rev

Rev 133 | Rev 145 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed

Rev Author Line No. Line
3 - 1 
*filter
2 
:LOG_ICMP - [0:0]
3 
:FORWARD ACCEPT [0:0]
4 
:LOG_REJECT - [0:0]
5 
:INPUT ACCEPT [0:0]
6 
:OUTPUT ACCEPT [0:0]
7 
:LOG_ACCEPT - [0:0]
8 
:LOG_IPSEC - [0:0]
9 
-A LOG_REJECT -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES REJECT] : "
10 
-A LOG_REJECT -j REJECT
11 
-A LOG_ACCEPT -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES ACCEPT] : "
12 
-A LOG_ACCEPT -j ACCEPT
13 
-A LOG_ICMP -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES ICMP] : "
14 
-A LOG_ICMP -j ACCEPT
15 
-A LOG_IPSEC -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES IPSEC] : "
16 
-A LOG_IPSEC -j ACCEPT
17 
-A INPUT -p esp -m esp -i eth1 -j ACCEPT
18 
-A INPUT -p ah -m ah -i eth1 -j ACCEPT
19 
-A INPUT -p udp -m udp -i eth1 --dport 500 -j ACCEPT
133 - 20 
-A INPUT -p tcp -m tcp -i eth1 --dport 443 -j LOG_ACCEPT
3 - 21 
-A INPUT -p udp -m udp -i eth1 --dport 1194 -j ACCEPT
138 - 22 
# letsencrypt certificate renewal
23 
-A INPUT -p tcp -m tcp -i eth1 --dport 80 -j LOG_ACCEPT
3 - 24 
-A INPUT -p tcp -m tcp -i eth1 --dport 8080 -j LOG_REJECT
25 
-A INPUT -p tcp -m tcp -i eth1 --dport 25 -j LOG_REJECT
133 - 26 
-A INPUT -p tcp -m tcp -i eth1 --dport 22 -j LOG_REJECT
3 - 27 
-A INPUT -p tcp -m tcp -i eth1 --dport 53 -j LOG_REJECT
28 
-A INPUT -p tcp -m tcp -i eth1 --dport 111 -j LOG_REJECT
29 
-A INPUT -p tcp -m tcp -i eth1 --dport 135 -j LOG_REJECT
30 
-A INPUT -p tcp -m tcp -i eth1 --dport 136 -j LOG_REJECT
31 
-A INPUT -p tcp -m tcp -i eth1 --dport 137 -j LOG_REJECT
32 
-A INPUT -p tcp -m tcp -i eth1 --dport 138 -j LOG_REJECT
33 
-A INPUT -p tcp -m tcp -i eth1 --dport 139 -j LOG_REJECT
34 
-A INPUT -p tcp -m tcp -i eth1 --dport 177 -j LOG_REJECT
35 
-A INPUT -p tcp -m tcp -i eth1 --dport 445 -j LOG_REJECT
36 
-A INPUT -p tcp -m tcp -i eth1 --dport 631 -j LOG_REJECT
37 
-A INPUT -p tcp -m tcp -i eth1 --dport 783 -j LOG_REJECT
38 
-A INPUT -p tcp -m tcp -i eth1 --dport 953 -j LOG_REJECT
39 
-A INPUT -p tcp -m tcp -i eth1 --dport 1433 -j LOG_REJECT
40 
-A INPUT -p tcp -m tcp -i eth1 --dport 10000 -j LOG_REJECT
41 
-A INPUT -p tcp -m tcp -i eth1 --dport 27374 -j LOG_REJECT
42 
-A INPUT -p tcp -m tcp -i eth1 --dport 32770 -j LOG_REJECT
43 
-A INPUT -p tcp -m tcp -i eth1 --dport 32771 -j LOG_REJECT
44 
-A INPUT -p udp -m udp -i eth1 --dport 53 -j LOG_REJECT
45 
-A INPUT -p udp -m udp -i eth1 --dport 68 -j LOG_REJECT
46 
-A INPUT -p udp -m udp -i eth1 --dport 111 -j LOG_REJECT
47 
-A INPUT -p udp -m udp -i eth1 --dport 135 -j LOG_REJECT
48 
-A INPUT -p udp -m udp -i eth1 --dport 136 -j LOG_REJECT
49 
-A INPUT -p udp -m udp -i eth1 --dport 137 -j LOG_REJECT
50 
-A INPUT -p udp -m udp -i eth1 --dport 138 -j LOG_REJECT
51 
-A INPUT -p udp -m udp -i eth1 --dport 139 -j LOG_REJECT
52 
# Allow NTP client traffic
53 
-A INPUT -p udp -m udp --dport 123 -j LOG_ACCEPT
54 
-A INPUT -p udp -m udp --sport 123 -j LOG_ACCEPT
55 
-A INPUT -p udp -m udp -i eth1 --dport 177 -j LOG_REJECT
56 
-A INPUT -p udp -m udp -i eth1 --dport 445 -j LOG_REJECT
57 
-A INPUT -p udp -m udp -i eth1 --dport 922 -j LOG_REJECT
58 
-A INPUT -p udp -m udp -i eth1 --dport 1433 -j LOG_REJECT
59 
-A INPUT -p udp -m udp -i eth1 --dport 3130 -j LOG_REJECT
60 
-A INPUT -p udp -m udp -i eth1 --dport 10000 -j LOG_REJECT
61 
-A INPUT -p udp -m udp -i eth1 --dport 27374 -j LOG_REJECT
62 
-A INPUT -p udp -m udp -i eth1 --dport 32768 -j LOG_REJECT
63 
# Allow openvpn traffic
64 
-A INPUT -p udp -m udp --dport 1194 -j LOG_ACCEPT
65 
-A INPUT -p udp -m udp --sport 1194 -j LOG_ACCEPT
66 
-A INPUT -p icmp -m icmp -i eth1 -j LOG_ICMP
67 
COMMIT
68 
 
69 
*nat
70 
:PREROUTING ACCEPT [9:1101]
71 
:POSTROUTING ACCEPT [14:962]
72 
:OUTPUT ACCEPT [14:962]
73 
 
133 - 74 
# Webserver
138 - 75 
# letsencrypt certificate renewal
76 
-A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 10.192.25.240:443
77 
# https
133 - 78 
-A PREROUTING -i eth1 -p tcp --dport 443 -j DNAT --to-destination 10.192.25.240:443
3 - 79 
 
133 - 80 
-A PREROUTING -i eth0 -d 72.219.238.135 -p tcp --dport 80 -j DNAT --to-destination 10.192.25.240:80
81 
-A PREROUTING -i eth0 -d 72.219.238.135 -p tcp --dport 443 -j DNAT --to-destination 10.192.25.240:443
3 - 82 
 
83 
# Squid
33 - 84 
#-A PREROUTING -i eth0 -s 10.192.25.231/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
85 
#-A POSTROUTING -o eth1 -s 10.192.25.231/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
86 
#-A PREROUTING -i eth0 -s 10.192.25.232/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
87 
#-A POSTROUTING -o eth1 -s 10.192.25.232/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
88 
#-A PREROUTING -i eth0 -s 10.192.25.203/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
89 
#-A POSTROUTING -o eth1 -s 10.192.25.203/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
90 
#-A PREROUTING -i eth0 -s 10.192.25.205/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
91 
#-A POSTROUTING -o eth1 -s 10.192.25.205/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
92 
#-A PREROUTING -i eth0 -s 10.192.25.206/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
93 
#-A POSTROUTING -o eth1 -s 10.192.25.206/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
3 - 94 
 
95 
# openvpn
96 
-A POSTROUTING -s 192.168.200.0/24 -d 10.192.25.0/24 -j ACCEPT
97 
-A POSTROUTING -d 192.168.200.0/24 -s 10.192.25.0/24 -j ACCEPT
98 
 
99 
-A POSTROUTING -s 10.192.25.0/255.255.255.0 -j MASQUERADE
100 
-A POSTROUTING -s 192.168.200.0/255.255.255.0 -j MASQUERADE
101 
 
102 
COMMIT