$ iptables-save # ON FIREWALL # Generated by iptables-save v1.3.5 on Tue Sep 12 17:33:12 2006 *nat :PREROUTING ACCEPT [3719:229334] :POSTROUTING ACCEPT [6226:1191889] :OUTPUT ACCEPT [13190:2505518] -A PREROUTING -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.0.0.2 -A PREROUTING -p tcp -m tcp --dport 11234 -j DNAT --to-destination 10.0.0.2 -A PREROUTING -p tcp -m tcp --dport 6881:6889 -j DNAT --to-destination 10.0.0.2:6881-6889 -A PREROUTING -p tcp -m tcp --dport 21 -j DNAT --to-destination 10.0.0.6 -A POSTROUTING -o eth0 -j MASQUERADE -A POSTROUTING -s 10.0.0.0/255.255.255.248 -d 10.0.0.0/255.255.255.248 -p tcp -m tcp --dport 25 -j SNAT --to-source 10.0.0.1 -A POSTROUTING -s 10.0.0.0/255.255.255.248 -d 10.0.0.0/255.255.255.248 -p tcp -m tcp --dport 11234 -j SNAT --to-source 10.0.0.1 -A POSTROUTING -s 10.0.0.0/255.255.255.248 -d 10.0.0.0/255.255.255.248 -p tcp -m tcp --dport 6881:6889 -j SNAT --to-source 10.0.0.1 -A POSTROUTING -s 10.0.0.0/255.255.255.248 -d 10.0.0.0/255.255.255.248 -o eth1 -p tcp -m tcp --dport 21 -j SNAT --to-source 10.0.0.1 COMMIT # Completed on Tue Sep 12 17:33:12 2006 # Generated by iptables-save v1.3.5 on Tue Sep 12 17:33:12 2006 *filter :INPUT DROP [1:222] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :Flood-Scan - [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j DROP -A INPUT -i eth1 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j DROP -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j Flood-Scan -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP -A INPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT -A INPUT -p tcp -m conntrack --ctstate RELATED -j ACCEPT -A INPUT -p udp -m conntrack --ctstate ESTABLISHED -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -s 10.0.0.0/255.255.255.248 -i eth1 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -s 10.0.0.0/255.255.255.248 -i eth1 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -s 10.0.0.0/255.255.255.248 -i eth1 -p tcp -m tcp --dport 631 -j ACCEPT -A INPUT -s 10.0.0.0/255.255.255.248 -i eth1 -p udp -m udp --dport 631 -j ACCEPT -A INPUT -s 10.0.0.0/255.255.255.248 -p tcp -m tcp --dport 3632 -j ACCEPT -A INPUT -s 10.0.0.0/255.255.255.248 -i eth1 -p tcp -m tcp --dport 10000 -j ACCEPT -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i eth1 -o eth1 -j ACCEPT -A FORWARD -i eth1 -j ACCEPT -A FORWARD -i eth0 -o eth0 -j DROP -A FORWARD -d 10.0.0.2 -i eth0 -o eth1 -p tcp -m tcp --dport 25 -j ACCEPT -A FORWARD -d 10.0.0.2 -i eth0 -o eth1 -p tcp -m tcp --dport 11234 -j ACCEPT -A FORWARD -d 10.0.0.2 -i eth0 -o eth1 -p tcp -m tcp --dport 6881:6889 -j ACCEPT -A FORWARD -d 10.0.0.6 -i eth0 -o eth1 -p tcp -m tcp --dport 20:21 -j ACCEPT -A OUTPUT -o lo -j ACCEPT -A OUTPUT -o eth1 -j ACCEPT -A OUTPUT -o eth0 -j ACCEPT -A Flood-Scan -m limit --limit 20/sec --limit-burst 10 -j RETURN -A Flood-Scan -j LOG --log-prefix "OVER-LIMIT: " -A Flood-Scan -j DROP COMMIT # Completed on Tue Sep 12 17:33:12 2006 $ lsmod # ON FIREWALL Module Size Used by shfs 40336 1 ipt_MASQUERADE 2688 1 ip_nat_ftp 2688 0 ip_conntrack_ftp 6128 1 ip_nat_ftp xt_state 1920 1 xt_conntrack 2304 4 ipt_LOG 5504 1 xt_limit 2432 1 xt_tcpudp 3072 23 iptable_nat 5380 1 ip_nat 13356 3 ipt_MASQUERADE,ip_nat_ftp,iptable_nat iptable_filter 2432 1 ip_tables 11100 2 iptable_nat,iptable_filter x_tables 10244 8 ipt_MASQUERADE,xt_state,xt_conntrack,ipt_LOG,xt_limit,xt_tcpudp,iptable_nat,ip_tables nfsd 78568 13 exportfs 4480 1 nfsd lockd 50440 2 nfsd sunrpc 122556 9 nfsd,lockd reiserfs 188912 3 snd_ens1371 18432 0 snd_rawmidi 17952 1 snd_ens1371 snd_seq_device 6028 1 snd_rawmidi snd_ac97_codec 79392 1 snd_ens1371 snd_ac97_bus 2176 1 snd_ac97_codec snd_pcm 68356 2 snd_ens1371,snd_ac97_codec nvidia 4545492 12 intel_agp 18332 1 snd_timer 18180 1 snd_pcm snd 41188 6 snd_ens1371,snd_rawmidi,snd_seq_device,snd_ac97_codec,snd_pcm,snd_timer agpgart 26060 2 nvidia,intel_agp ohci1394 27696 0 snd_page_alloc 7304 1 snd_pcm $ ftp domain.com # FROM INTERNAL AUXBOX TO DOMAINNAME ( RESOLVES TO INTERNAL FIREWALL ) Connected to domain.com (10.0.0.1). 220 Bahave! Name (domain.com:user): ftpuser 234 Proceed with negotiation. [SSL Cipher DES-CBC3-SHA] 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 500 Illegal PORT command. ftp: bind: Address already in use ftp> $ ftp ftpserver # FROM INTERNAL AUXBOX TO FTP SERVER Connected to ftpserver (10.0.0.6). 220 Bahave! Name (ftpserver:user): ftpuser 234 Proceed with negotiation. [SSL Cipher DES-CBC3-SHA] 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. drwxr-x--- 2 1001 21 4096 Sep 12 05:32 Directory 226 Directory send OK. ftp> QUIT ?Invalid command ftp> quit 221 Goodbye. # cat /etc/vsftpd/vsftpd.conf # ON FTP SERVER # /etc/vsftpd/vsftpd.conf listen=YES # SSL Opts ssl_enable=YES allow_anon_ssl=NO force_local_logins_ssl=YES ssl_tlsv1=YES ssl_sslv2=YES ssl_sslv3=YES rsa_cert_file=/etc/ssl/certs/vsftpd.pem # General anonymous_enable=NO local_enable=YES write_enable=YES dirmessage_enable=YES xferlog_enable=YES connect_from_port_20=YES chown_uploads=NO idle_session_timeout=600 data_connection_timeout=120 ascii_upload_enable=NO ascii_download_enable=NO ftpd_banner=Bahave! chroot_list_enable=YES ls_recurse_enable=NO # Passive pasv_enable=YES pasv_address=domain.com pasv_addr_resolve=YES #tcp_wrappers=YES #userlist_file=/etc/vsftpd/user_list #userlist_enable=YES # iptables-save # FTP SERVER # Generated by iptables-save v1.3.5 on Tue Sep 12 19:48:12 2006 *nat :PREROUTING ACCEPT [26614:4101229] :POSTROUTING ACCEPT [221:13585] :OUTPUT ACCEPT [221:13585] COMMIT # Completed on Tue Sep 12 19:48:12 2006 # Generated by iptables-save v1.3.5 on Tue Sep 12 19:48:12 2006 *filter :INPUT DROP [17527:3591636] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :Flood-Scan - [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j DROP -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j Flood-Scan -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP -A INPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT -A INPUT -p tcp -m conntrack --ctstate RELATED -j ACCEPT -A INPUT -p udp -m conntrack --ctstate ESTABLISHED -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT -A INPUT -p tcp -m tcp --sport 20 --dport 1024:65535 -j ACCEPT -A OUTPUT -o lo -j ACCEPT -A OUTPUT -o eth0 -j ACCEPT -A Flood-Scan -m limit --limit 3/sec --limit-burst 10 -j RETURN -A Flood-Scan -j LOG --log-prefix "OVER-LIMIT: " -A Flood-Scan -j DROP COMMIT # Completed on Tue Sep 12 19:48:12 2006