Subversion Repositories configs

Rev

Rev 33 | Go to most recent revision | Blame | Compare with Previous | Last modification | View Log | RSS feed 

*filter
:LOG_ICMP - [0:0]
:FORWARD ACCEPT [0:0]
:LOG_REJECT - [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:LOG_ACCEPT - [0:0]
:LOG_IPSEC - [0:0]
-A LOG_REJECT -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES REJECT] : "
-A LOG_REJECT -j REJECT
-A LOG_ACCEPT -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES ACCEPT] : "
-A LOG_ACCEPT -j ACCEPT
-A LOG_ICMP -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES ICMP] : "
-A LOG_ICMP -j ACCEPT
-A LOG_IPSEC -j LOG  --log-tcp-options --log-ip-options --log-prefix "[IPTABLES IPSEC] : "
-A LOG_IPSEC -j ACCEPT
-A INPUT -p esp -m esp -i eth1 -j ACCEPT
-A INPUT -p ah -m ah -i eth1 -j ACCEPT
-A INPUT -p udp -m udp -i eth1 --dport 500 -j ACCEPT
-A INPUT -p udp -m udp -i eth1 --dport 1194 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth1 --dport 8080 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 25 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 53 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 80 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 111 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 135 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 136 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 137 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 138 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 139 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 177 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 445 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 631 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 783 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 953 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 1433 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 10000 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 27374 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 32770 -j LOG_REJECT
-A INPUT -p tcp -m tcp -i eth1 --dport 32771 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 53 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 68 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 111 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 135 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 136 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 137 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 138 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 139 -j LOG_REJECT
# Allow NTP client traffic
-A INPUT -p udp -m udp --dport 123 -j LOG_ACCEPT
-A INPUT -p udp -m udp --sport 123 -j LOG_ACCEPT
-A INPUT -p udp -m udp -i eth1 --dport 177 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 445 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 922 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 1433 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 3130 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 10000 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 27374 -j LOG_REJECT
-A INPUT -p udp -m udp -i eth1 --dport 32768 -j LOG_REJECT
# Allow openvpn traffic
-A INPUT -p udp -m udp --dport 1194 -j LOG_ACCEPT
-A INPUT -p udp -m udp --sport 1194 -j LOG_ACCEPT
-A INPUT -p icmp -m icmp -i eth1 -j LOG_ICMP
COMMIT

*nat
:PREROUTING ACCEPT [9:1101]
:POSTROUTING ACCEPT [14:962]
:OUTPUT ACCEPT [14:962]

###-A PREROUTING -p tcp -i eth1 --dport 25 -j DNAT --to 10.192.25.253:25
###-A PREROUTING -d 10.192.25.253 -p tcp -i eth0 --dport 25 -j DNAT --to 10.192.25.253:25

###-A PREROUTING -p tcp -i eth1 --dport 8080 -j DNAT --to 10.192.25.253:80
###-A PREROUTING -d 10.192.25.253 -p tcp -i eth0 --dport 80 -j DNAT --to 10.192.25.253:80

# Squid
-A PREROUTING -i eth0 -s 10.192.25.231/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
-A POSTROUTING -o eth1 -s 10.192.25.231/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
-A PREROUTING -i eth0 -s 10.192.25.232/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
-A POSTROUTING -o eth1 -s 10.192.25.232/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
-A PREROUTING -i eth0 -s 10.192.25.203/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
-A POSTROUTING -o eth1 -s 10.192.25.203/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
-A PREROUTING -i eth0 -s 10.192.25.205/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
-A POSTROUTING -o eth1 -s 10.192.25.205/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254
-A PREROUTING -i eth0 -s 10.192.25.206/32 -p tcp --dport 80 -j DNAT --to 10.192.25.240:3128
-A POSTROUTING -o eth1 -s 10.192.25.206/32 -d 10.192.25.240 -j SNAT --to 10.192.25.254

# openvpn
-A POSTROUTING -s 192.168.200.0/24 -d 10.192.25.0/24 -j ACCEPT
-A POSTROUTING -d 192.168.200.0/24 -s 10.192.25.0/24 -j ACCEPT

-A POSTROUTING -s 10.192.25.0/255.255.255.0 -j MASQUERADE
-A POSTROUTING -s 192.168.200.0/255.255.255.0 -j MASQUERADE

COMMIT