# Generated by iptables-save v1.3.8 on Thu Feb 5 14:31:00 2009 *raw :PREROUTING ACCEPT [61382877:18950362852] :OUTPUT ACCEPT [20616334:11987866585] COMMIT # Completed on Thu Feb 5 14:31:00 2009 # Generated by iptables-save v1.3.8 on Thu Feb 5 14:31:00 2009 *nat :PREROUTING ACCEPT [15696081:1287060356] :POSTROUTING ACCEPT [990384:63888569] :OUTPUT ACCEPT [357690:26219960] -A PREROUTING -d 200.212.28.3 -p tcp -j ACCEPT -A PREROUTING -d 200.212.28.66 -p tcp -j ACCEPT -A PREROUTING -d 200.212.28.2 -p tcp -j ACCEPT -A PREROUTING -d 202.219.50.106 -p tcp -j ACCEPT -A PREROUTING -d 200.114.201.14 -p tcp -j ACCEPT -A PREROUTING -d 193.88.8.59 -p tcp -j ACCEPT -A PREROUTING -d 201.1.22.113 -p tcp -j ACCEPT -A PREROUTING -d 201.8.252.66 -p tcp -j ACCEPT -A PREROUTING -d 80.185.251.49 -p tcp -j ACCEPT -A PREROUTING -d 200.206.190.61 -p tcp -j ACCEPT -A PREROUTING -d 207.46.111.23 -p tcp -j ACCEPT -A PREROUTING -d 200.245.207.163 -p tcp -j ACCEPT -A PREROUTING -d 200.248.232.2 -p tcp -j ACCEPT -A PREROUTING -d 204.9.202.104 -p tcp -j ACCEPT -A PREROUTING -d 200.201.174.204 -p tcp -j ACCEPT -A PREROUTING -d 200.201.174.207 -p tcp -j ACCEPT -A PREROUTING -d 200.201.173.68 -p tcp -j ACCEPT -A PREROUTING -i eth1 -p tcp -m multiport --ports 5900 -j DNAT --to-destination 192.168.0.160 -A POSTROUTING -d 200.201.173.68 -j MASQUERADE -A POSTROUTING -d 200.201.174.207 -j MASQUERADE -A POSTROUTING -d 200.201.174.204 -j MASQUERADE -A POSTROUTING -d 204.9.202.104 -j MASQUERADE -A POSTROUTING -d 200.248.232.2 -j MASQUERADE -A POSTROUTING -d 200.245.207.163 -j MASQUERADE -A POSTROUTING -d 207.46.111.23 -j MASQUERADE -A POSTROUTING -d 200.206.190.61 -j MASQUERADE -A POSTROUTING -d 80.185.251.49 -j MASQUERADE -A POSTROUTING -d 201.8.252.66 -j MASQUERADE -A POSTROUTING -d 201.1.22.113 -j MASQUERADE -A POSTROUTING -d 193.88.8.59 -j MASQUERADE -A POSTROUTING -d 200.114.201.14 -j MASQUERADE -A POSTROUTING -d 202.219.50.106 -j MASQUERADE -A POSTROUTING -d 200.212.28.2 -j MASQUERADE -A POSTROUTING -d 200.212.28.66 -j MASQUERADE -A POSTROUTING -d 200.212.28.3 -j MASQUERADE -A POSTROUTING -s 192.168.0.0/255.255.255.0 -p tcp -m multiport --ports 20,21,53,443,809,2631,3456,8017,3389,12105,1723,1093,137,500 -j MASQUERADE -A POSTROUTING -s 192.168.0.0/255.255.255.0 -p udp -m multiport --ports 53,443,2631,3456,3478,8017,500,137,4500,10000 -j MASQUERADE -A POSTROUTING -s 192.168.0.205 -o eth1 -j MASQUERADE -A POSTROUTING -s 192.168.0.160 -o eth1 -p tcp -m multiport --ports 5900 -j MASQUERADE COMMIT # Completed on Thu Feb 5 14:31:00 2009 # Generated by iptables-save v1.3.8 on Thu Feb 5 14:31:00 2009 *mangle :PREROUTING ACCEPT [61148938:18819553294] :INPUT ACCEPT [19793919:11130724208] :FORWARD ACCEPT [39989936:7319616838] :OUTPUT ACCEPT [20616313:11987865569] :POSTROUTING ACCEPT [58568220:19207779408] -A PREROUTING -j CONNMARK --restore-mark -A PREROUTING -p tcp -m tcp --sport 9236 -j TOS --set-tos 0x10 -A PREROUTING -p tcp -m tcp --sport 25 -j TOS --set-tos 0x10 -A PREROUTING -p tcp -m tcp --sport 110 -j TOS --set-tos 0x10 -A PREROUTING -p tcp -m tcp --sport 21 -j TOS --set-tos 0x10 -A PREROUTING -p tcp -m tcp --sport 80 -j TOS --set-tos 0x08 -A PREROUTING -p tcp -m tcp --sport 53 -j TOS --set-tos 0x08 -A PREROUTING -p udp -m udp --sport 53 -j TOS --set-tos 0x08 -A PREROUTING -m mark ! --mark 0x0 -j ACCEPT -A PREROUTING -i eth2 -j MARK --set-mark 0x3 -A PREROUTING -i eth1 -j MARK --set-mark 0x4 -A PREROUTING -m mark ! --mark 0x0 -j CONNMARK --save-mark -A OUTPUT -p tcp -m tcp --dport 9236 -j TOS --set-tos 0x10 -A OUTPUT -p tcp -m tcp --dport 25 -j TOS --set-tos 0x10 -A OUTPUT -p tcp -m tcp --dport 110 -j TOS --set-tos 0x10 -A OUTPUT -p tcp -m tcp --dport 21 -j TOS --set-tos 0x10 -A OUTPUT -p tcp -m tcp --dport 80 -j TOS --set-tos 0x08 -A OUTPUT -j CONNMARK --restore-mark COMMIT # Completed on Thu Feb 5 14:31:00 2009 # Generated by iptables-save v1.3.8 on Thu Feb 5 14:31:00 2009 *filter :INPUT DROP [9:3073] :FORWARD DROP [0:0] :OUTPUT ACCEPT [513:470810] :AIM - [0:0] :FINGERPRINT - [0:0] :ICMP - [0:0] :ICQ - [0:0] :IPS_FUCK - [0:0] :JABBER - [0:0] :MSN - [0:0] :NMAP - [0:0] :P2P - [0:0] :SYN_FLOOD - [0:0] :TROJAN - [0:0] :YAHOO - [0:0] -A INPUT -j LOG --log-prefix "RFW_INPUT: " --log-level 6 -A INPUT -j NMAP -A INPUT -j FINGERPRINT -A INPUT -j TROJAN -A INPUT -i eth1 -p udp -m multiport --dports 5000 -j ACCEPT -A INPUT -i tun+ -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -i eth1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j SYN_FLOOD -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -d 201.6.250.223 -p tcp -m tcp --dport 9236 -j ACCEPT -A INPUT -s 201.6.250.223 -p tcp -m tcp --sport 9236 -j ACCEPT -A INPUT -d 200.168.87.218 -p tcp -m tcp --dport 9236 -j ACCEPT -A INPUT -s 200.168.87.218 -p tcp -m tcp --sport 9236 -j ACCEPT -A INPUT -p ipencap -j ACCEPT -A INPUT -d 201.6.250.223 -i eth1 -p tcp -m multiport --dports 20,21,7281 -j ACCEPT -A INPUT -d 201.6.250.223 -i eth1 -p udp -m multiport --dports 53 -j ACCEPT -A INPUT -d 200.168.87.218 -i eth1 -p tcp -m multiport --dports 20,21,7281 -j ACCEPT -A INPUT -d 200.168.87.218 -i eth1 -p udp -m multiport --dports 53 -j ACCEPT -A INPUT -i eth0 -p tcp -m multiport --dports 20,21,22,3128,7281,443 -j ACCEPT -A INPUT -i eth0 -p udp -m multiport --dports 53,137,138,139,443 -j ACCEPT -A INPUT -i eth1 -j IPS_FUCK -A INPUT -j ICMP -A INPUT -m state --state INVALID -j DROP -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP -A FORWARD -j LOG --log-prefix "RFW_FORWARD: " --log-level 6 -A FORWARD -j ICQ -A FORWARD -j JABBER -A FORWARD -j YAHOO -A FORWARD -j AIM -A FORWARD -j MSN -A FORWARD -j P2P -A FORWARD -d 200.201.173.68 -i eth0 -o eth1 -j ACCEPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 200.201.173.68 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 200.201.174.207 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 200.201.174.207 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 200.201.174.204 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 200.201.174.204 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 204.9.202.104 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 204.9.202.104 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 200.248.232.2 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 200.248.232.2 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 200.245.207.163 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 200.245.207.163 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 207.46.111.23 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 207.46.111.23 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 200.206.190.61 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 200.206.190.61 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 80.185.251.49 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 80.185.251.49 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 201.8.252.66 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 201.8.252.66 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 201.1.22.113 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 201.1.22.113 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 193.88.8.59 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 193.88.8.59 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 200.114.201.14 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 200.114.201.14 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 202.219.50.106 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 202.219.50.106 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 200.212.28.2 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 200.212.28.2 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 200.212.28.66 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 200.212.28.66 -i eth1 -o eth0 -j ACCEPT -A FORWARD -d 200.212.28.3 -i eth0 -o eth1 -j ACCEPT -A FORWARD -s 200.212.28.3 -i eth1 -o eth0 -j ACCEPT -A FORWARD -i eth0 -o eth1 -p tcp -m multiport --dports 20,21,53,443,809,2631,3456,8017,3389,12105,1723,1093,137,500 -j ACCEPT -A FORWARD -i eth0 -o eth1 -p udp -m multiport --dports 53,443,2631,3456,3478,8017,500,137,4500,10000 -j ACCEPT -A FORWARD -i eth1 -o eth0 -p tcp -m multiport --sports 20,21,53,443,809,2631,3456,8017,3389,12105,1723,1093,137,500 -j ACCEPT -A FORWARD -i eth1 -o eth0 -p udp -m multiport --sports 53,443,2631,3456,3478,8017,500,137,4500,10000 -j ACCEPT -A FORWARD -s 192.168.0.205 -i eth0 -o eth1 -j ACCEPT -A FORWARD -d 192.168.0.205 -i eth1 -o eth0 -j ACCEPT -A FORWARD -i tun+ -j ACCEPT -A FORWARD -i tap+ -j ACCEPT -A FORWARD -o tun+ -j ACCEPT -A FORWARD -o tap+ -j ACCEPT -A FORWARD -s 192.168.1.0/255.255.255.0 -i tun0 -j ACCEPT -A FORWARD -s 192.168.1.0/255.255.255.0 -i tap0 -j ACCEPT -A FORWARD -d 192.168.1.0/255.255.255.0 -o tun0 -j ACCEPT -A FORWARD -d 192.168.1.0/255.255.255.0 -o tap0 -j ACCEPT -A FORWARD -d 192.168.0.160 -i eth1 -o eth0 -p tcp -m multiport --dports 5900 -j ACCEPT -A FORWARD -s 192.168.0.160 -i eth0 -o eth1 -p tcp -m multiport --sports 5900 -j ACCEPT -A FORWARD -i eth2 -o eth1 -j ACCEPT -A FORWARD -i eth1 -o eth2 -j ACCEPT -A FORWARD -j ICMP -A FORWARD -m state --state INVALID -j DROP -A FORWARD -j DROP -A AIM -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto aim -j REJECT --reject-with icmp-port-unreachable -A FINGERPRINT -p tcp -m tcp --dport 0 -j DROP -A FINGERPRINT -p udp -m udp --dport 0 -j DROP -A FINGERPRINT -p tcp -m tcp --sport 0 -j DROP -A FINGERPRINT -p udp -m udp --sport 0 -j DROP -A FINGERPRINT -p icmp -m icmp --icmp-type 17 -j DROP -A FINGERPRINT -p icmp -m icmp --icmp-type 18 -j DROP -A ICMP -p icmp -m icmp --icmp-type 3 -j ACCEPT -A ICMP -p icmp -m icmp --icmp-type 4 -j ACCEPT -A ICMP -p icmp -m icmp --icmp-type 9 -j ACCEPT -A ICMP -p icmp -m icmp --icmp-type 12 -j ACCEPT -A ICMP -p icmp -m icmp --icmp-type 14 -j ACCEPT -A ICMP -p icmp -m icmp --icmp-type 18 -j ACCEPT -A ICMP -p icmp -m icmp --icmp-type 11 -j ACCEPT -A ICQ -s 192.168.0.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 5190 -m state --state NEW -j REJECT --reject-with tcp-reset -A ICQ -s 192.168.0.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 1080 -m state --state NEW -j REJECT --reject-with tcp-reset -A JABBER -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto jabber -j ACCEPT -A JABBER -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto jabber -j REJECT --reject-with icmp-port-unreachable -A MSN -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto msnmessenger -j ACCEPT -A MSN -s 192.168.0.0/255.255.255.0 -p icmp -m icmp --icmp-type 8 -j ACCEPT -A MSN -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto msnmessenger -j REJECT --reject-with icmp-port-unreachable -A MSN -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto msn-filetransfer -j ACCEPT -A MSN -s 192.168.0.0/255.255.255.0 -p icmp -m icmp --icmp-type 8 -j ACCEPT -A MSN -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto msn-filetransfer -j REJECT --reject-with icmp-port-unreachable -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -m limit --limit 3/min -j LOG --log-prefix "Stealth XMAS scan: " --log-level 6 -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -m limit --limit 3/min -j LOG --log-prefix "Stealth XMAS-PSH scan: " --log-level 6 -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -m limit --limit 3/min -j LOG --log-prefix "Stealth XMAS-ALL scan: " --log-level 6 -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -m limit --limit 3/min -j LOG --log-prefix "Stealth FIN scan: " --log-level 6 -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j DROP -A NMAP -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 3/min -j LOG --log-prefix "Stealth SYN/RST scan: " --log-level 6 -A NMAP -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 3/min -j LOG --log-prefix "Stealth SYN/FIN scan(?): " --log-level 6 -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 3/min -j LOG --log-prefix "Stealth Null scan: " --log-level 6 -A NMAP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP -A P2P -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto edonkey -j DROP -A P2P -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto openft -j DROP -A P2P -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto gnutella -j DROP -A P2P -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto fasttrack -j DROP -A P2P -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto bittorrent -j DROP -A P2P -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto soulseek -j DROP -A P2P -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto ares -j DROP -A SYN_FLOOD -p tcp -m tcp --dport 25 -m limit --limit 1/sec -j RETURN -A SYN_FLOOD -j LOG --log-prefix "DROP SYN FLOOD: " --log-level 6 -A SYN_FLOOD -p tcp -m tcp --dport 25 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 12345 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 12345 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 12345 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 31336 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 31336 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 31336 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 31337 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 31337 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 31337 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 31338 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 31338 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 31338 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 3024 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 3024 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 3024 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 4092 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 4092 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 4092 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 5714 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 5714 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 5714 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 5742 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 5742 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 5742 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 2583 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 2583 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 2583 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 8787 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 8787 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 8787 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 5556 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 5556 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 5556 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 5557 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 5557 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 5557 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 33207 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 33207 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 33207 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 39096 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 39096 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 39096 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 44535 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 44535 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 44535 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 39917 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 39917 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 39917 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 31914 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 31914 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 31914 -j DROP -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 33257 -m state --state NEW -j LOG --log-prefix "RFW: Trojan 33257 Blocked! " -A TROJAN -p tcp -m tcp --sport 1024:65535 --dport 33257 -j DROP -A YAHOO -s 192.168.0.0/255.255.255.0 -m layer7 --l7proto yahoo -j REJECT --reject-with icmp-port-unreachable COMMIT # Completed on Thu Feb 5 14:31:00 2009