Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED TRINOO tcp -- anywhere anywhere tcp dpt:27444 TRINOO tcp -- anywhere anywhere tcp dpt:27665 TRINOO tcp -- anywhere anywhere tcp dpt:31335 TRINOO tcp -- anywhere anywhere tcp dpt:34555 TRINOO tcp -- anywhere anywhere tcp dpt:35555 TROJAN tcp -- anywhere anywhere tcp dpt:mdqs TROJAN tcp -- anywhere anywhere tcp dpt:mdqs TROJAN tcp -- anywhere anywhere tcp dpt:terabase TROJAN tcp -- anywhere anywhere tcp dpt:x11 TROJAN tcp -- anywhere anywhere tcp dpt:6006 TROJAN tcp -- anywhere anywhere tcp dpt:16660 firewall icmp -- anywhere anywhere icmp echo-reply firewall icmp -- anywhere anywhere icmp destination-unreachable firewall icmp -- anywhere anywhere icmp time-exceeded DROP icmp -- anywhere anywhere icmp echo-request limit: avg 1/sec burst 5 firewall icmp -- anywhere anywhere SCANNER tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG SCANNER tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE SCANNER tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG SCANNER tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN SCANNER tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG SCANNER tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST SCANNER tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN LOG tcp -- anywhere anywhere tcp dpt:ftp-data LOG level info prefix `FIREWALL: ftp-data: ' LOG tcp -- anywhere anywhere tcp dpt:ftp LOG level info prefix `FIREWALL: ftp: ' LOG tcp -- anywhere anywhere tcp dpt:telnet LOG level info prefix `FIREWALL: telnet: ' LOG udp -- anywhere anywhere udp dpt:sunrpc LOG level info prefix `FIREWALL: rpc: ' LOG tcp -- anywhere anywhere tcp dpt:auth LOG level info prefix `FIREWALL: identd: ' LOG tcp -- anywhere anywhere tcp dpts:netbios-ns:netbios-ssn LOG level info prefix `FIREWALL: samba: ' LOG udp -- anywhere anywhere udp dpts:netbios-ns:netbios-ssn LOG level info prefix `FIREWALL: samba: ' LOG tcp -- anywhere anywhere tcp dpts:snmp:162 LOG level info prefix `FIREWALL: snmp: ' LOG tcp -- anywhere anywhere tcp dpts:ircd:6668 LOG level info prefix `FIREWALL: irc: ' LOG tcp -- anywhere anywhere tcp dpt:squid LOG level info prefix `FIREWALL: squid: ' DROP tcp -- anywhere anywhere tcp dpt:squid ACCEPT all -- 192.168.0.0/24 anywhere ACCEPT tcp -- anywhere anywhere tcp dpt:ftp ACCEPT tcp -- anywhere anywhere tcp dpt:ftp-data ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:8089 ACCEPT tcp -- anywhere anywhere tcp dpt:8089 ACCEPT tcp -- anywhere anywhere tcp dpt:5902 ACCEPT tcp -- anywhere anywhere tcp dpt:5902 ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:webcache ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT tcp -- anywhere anywhere tcp dpt:5900 ACCEPT tcp -- anywhere anywhere tcp dpt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:pop3 ACCEPT tcp -- anywhere anywhere tcp dpt:pop3 ACCEPT tcp -- anywhere anywhere tcp dpt:domain ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:ms-wbt-server Chain FORWARD (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED REJECT tcp -- anywhere anywhere tcp dpt:epmap reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere tcp dpt:epmap reject-with icmp-port-unreachable ACCEPT tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 2/sec burst 5 DROP icmp -- anywhere anywhere icmp echo-request limit: avg 1/sec burst 5 LOG tcp -- anywhere anywhere tcp dpt:smtp LOG level warning ACCEPT tcp -- anywhere anywhere tcp spt:ftp ACCEPT tcp -- anywhere anywhere tcp dpt:ftp ACCEPT tcp -- anywhere anywhere tcp dpt:pop3 ACCEPT tcp -- anywhere anywhere tcp dpt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:msnp Chain OUTPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere tcp spt:ftp ACCEPT tcp -- anywhere anywhere tcp spt:http ACCEPT tcp -- anywhere anywhere tcp spt:webcache ACCEPT tcp -- anywhere anywhere tcp spt:https ACCEPT tcp -- anywhere anywhere tcp spt:pop3 ACCEPT tcp -- anywhere anywhere tcp spt:pop3 ACCEPT tcp -- anywhere anywhere tcp spt:smtp ACCEPT tcp -- anywhere anywhere tcp spt:smtp ACCEPT tcp -- anywhere anywhere tcp spt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:ms-wbt-server ACCEPT tcp -- anywhere anywhere tcp dpt:ms-wbt-server Chain SCANNER (7 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 15/min burst 5 LOG level info prefix `FIREWALL: port scanner: ' DROP all -- anywhere anywhere Chain TRINOO (5 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 15/min burst 5 LOG level info prefix `FIREWALL: trinoo: ' DROP all -- anywhere anywhere Chain TROJAN (6 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 15/min burst 5 LOG level info prefix `FIREWALL: trojan: ' DROP all -- anywhere anywhere Chain firewall (4 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 15/min burst 5 LOG level warning prefix `Firewall: ping_dead: ' DROP all -- anywhere anywhere