Subversion Repositories configs

Rev

Rev 145 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed

Rev Author Line No. Line
3 - 1 
*filter
2 
:LOG_ICMP - [0:0]
3 
:FORWARD ACCEPT [0:0]
4 
:LOG_REJECT - [0:0]
5 
:INPUT ACCEPT [0:0]
6 
:OUTPUT ACCEPT [0:0]
7 
:LOG_ACCEPT - [0:0]
8 
:LOG_IPSEC - [0:0]
9 
-A LOG_REJECT -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES REJECT] : "
10 
-A LOG_REJECT -j REJECT
11 
-A LOG_ACCEPT -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES ACCEPT] : "
12 
-A LOG_ACCEPT -j ACCEPT
13 
-A LOG_ICMP -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES ICMP] : "
14 
-A LOG_ICMP -j ACCEPT
15 
-A LOG_IPSEC -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES IPSEC] : "
16 
-A LOG_IPSEC -j ACCEPT
17 
-A INPUT -p esp -m esp -i eth1 -j ACCEPT
18 
-A INPUT -p ah -m ah -i eth1 -j ACCEPT
19 
-A INPUT -p udp -m udp -i eth1 --dport 500 -j ACCEPT
133 - 20 
-A INPUT -p tcp -m tcp -i eth1 --dport 443 -j LOG_ACCEPT
3 - 21 
-A INPUT -p udp -m udp -i eth1 --dport 1194 -j ACCEPT
145 - 22 
# Closed by Cox
149 - 23 
-A INPUT -p tcp -m tcp -i eth1 --dport 80 -j LOG_REJECT
145 - 24 
-A INPUT -p tcp -m tcp -i eth1 --dport 8000 -j LOG_REJECT
3 - 25 
-A INPUT -p tcp -m tcp -i eth1 --dport 8080 -j LOG_REJECT
145 - 26 
# Closed by Cox
3 - 27 
-A INPUT -p tcp -m tcp -i eth1 --dport 25 -j LOG_REJECT
133 - 28 
-A INPUT -p tcp -m tcp -i eth1 --dport 22 -j LOG_REJECT
3 - 29 
-A INPUT -p tcp -m tcp -i eth1 --dport 53 -j LOG_REJECT
30 
-A INPUT -p tcp -m tcp -i eth1 --dport 111 -j LOG_REJECT
31 
-A INPUT -p tcp -m tcp -i eth1 --dport 135 -j LOG_REJECT
32 
-A INPUT -p tcp -m tcp -i eth1 --dport 136 -j LOG_REJECT
33 
-A INPUT -p tcp -m tcp -i eth1 --dport 137 -j LOG_REJECT
34 
-A INPUT -p tcp -m tcp -i eth1 --dport 138 -j LOG_REJECT
35 
-A INPUT -p tcp -m tcp -i eth1 --dport 139 -j LOG_REJECT
36 
-A INPUT -p tcp -m tcp -i eth1 --dport 177 -j LOG_REJECT
37 
-A INPUT -p tcp -m tcp -i eth1 --dport 445 -j LOG_REJECT
38 
-A INPUT -p tcp -m tcp -i eth1 --dport 631 -j LOG_REJECT
39 
-A INPUT -p tcp -m tcp -i eth1 --dport 783 -j LOG_REJECT
40 
-A INPUT -p tcp -m tcp -i eth1 --dport 953 -j LOG_REJECT
41 
-A INPUT -p tcp -m tcp -i eth1 --dport 1433 -j LOG_REJECT
42 
-A INPUT -p tcp -m tcp -i eth1 --dport 10000 -j LOG_REJECT
43 
-A INPUT -p tcp -m tcp -i eth1 --dport 27374 -j LOG_REJECT
44 
-A INPUT -p tcp -m tcp -i eth1 --dport 32770 -j LOG_REJECT
45 
-A INPUT -p tcp -m tcp -i eth1 --dport 32771 -j LOG_REJECT
46 
-A INPUT -p udp -m udp -i eth1 --dport 53 -j LOG_REJECT
47 
-A INPUT -p udp -m udp -i eth1 --dport 68 -j LOG_REJECT
48 
-A INPUT -p udp -m udp -i eth1 --dport 111 -j LOG_REJECT
49 
-A INPUT -p udp -m udp -i eth1 --dport 135 -j LOG_REJECT
50 
-A INPUT -p udp -m udp -i eth1 --dport 136 -j LOG_REJECT
51 
-A INPUT -p udp -m udp -i eth1 --dport 137 -j LOG_REJECT
52 
-A INPUT -p udp -m udp -i eth1 --dport 138 -j LOG_REJECT
53 
-A INPUT -p udp -m udp -i eth1 --dport 139 -j LOG_REJECT
54 
# Allow NTP client traffic
55 
-A INPUT -p udp -m udp --dport 123 -j LOG_ACCEPT
56 
-A INPUT -p udp -m udp --sport 123 -j LOG_ACCEPT
57 
-A INPUT -p udp -m udp -i eth1 --dport 177 -j LOG_REJECT
58 
-A INPUT -p udp -m udp -i eth1 --dport 445 -j LOG_REJECT
59 
-A INPUT -p udp -m udp -i eth1 --dport 922 -j LOG_REJECT
60 
-A INPUT -p udp -m udp -i eth1 --dport 1433 -j LOG_REJECT
61 
-A INPUT -p udp -m udp -i eth1 --dport 3130 -j LOG_REJECT
62 
-A INPUT -p udp -m udp -i eth1 --dport 10000 -j LOG_REJECT
63 
-A INPUT -p udp -m udp -i eth1 --dport 27374 -j LOG_REJECT
64 
-A INPUT -p udp -m udp -i eth1 --dport 32768 -j LOG_REJECT
65 
# Allow openvpn traffic
66 
-A INPUT -p udp -m udp --dport 1194 -j LOG_ACCEPT
67 
-A INPUT -p udp -m udp --sport 1194 -j LOG_ACCEPT
68 
-A INPUT -p icmp -m icmp -i eth1 -j LOG_ICMP
69 
COMMIT
70 
 
71 
*nat
72 
:PREROUTING ACCEPT [9:1101]
73 
:POSTROUTING ACCEPT [14:962]
74 
:OUTPUT ACCEPT [14:962]
75 
 
133 - 76 
# Webserver
145 - 77 
# http (Closed by Cox)
78 
#-A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 10.192.25.240:80
79 
#-A PREROUTING -i eth0 -d 72.219.238.135 -p tcp --dport 80 -j DNAT --to-destination 10.192.25.240:80
138 - 80 
# https
133 - 81 
-A PREROUTING -i eth1 -p tcp --dport 443 -j DNAT --to-destination 10.192.25.240:443
145 - 82 
-A PREROUTING -i eth0 -d 72.192.249.173 -p tcp --dport 443 -j DNAT --to-destination 10.192.25.240:443
3 - 83 
 
84 
# Squid
33 - 85 
#-A PREROUTING -i eth0 -s 10.192.25.231/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
86 
#-A POSTROUTING -o eth1 -s 10.192.25.231/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
87 
#-A PREROUTING -i eth0 -s 10.192.25.232/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
88 
#-A POSTROUTING -o eth1 -s 10.192.25.232/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
89 
#-A PREROUTING -i eth0 -s 10.192.25.203/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
90 
#-A POSTROUTING -o eth1 -s 10.192.25.203/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
91 
#-A PREROUTING -i eth0 -s 10.192.25.205/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
92 
#-A POSTROUTING -o eth1 -s 10.192.25.205/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
93 
#-A PREROUTING -i eth0 -s 10.192.25.206/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
94 
#-A POSTROUTING -o eth1 -s 10.192.25.206/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
3 - 95 
 
96 
# openvpn
97 
-A POSTROUTING -s 192.168.200.0/24 -d 10.192.25.0/24 -j ACCEPT
98 
-A POSTROUTING -d 192.168.200.0/24 -s 10.192.25.0/24 -j ACCEPT
99 
 
100 
-A POSTROUTING -s 10.192.25.0/255.255.255.0 -j MASQUERADE
101 
-A POSTROUTING -s 192.168.200.0/255.255.255.0 -j MASQUERADE
102 
 
103 
COMMIT