# Generated by iptables-save v1.2.11 on Thu Jul 28 13:17:42 2005 *filter :tcp_outbound - [0:0] :INPUT DROP [0:0] :udp_inbound - [0:0] :OUTPUT DROP [0:0] :bad_packets - [0:0] :FORWARD DROP [0:0] :ssh_brute - [0:0] :udp_outbound - [0:0] :icmp_packets - [0:0] :bad_tcp_packets - [0:0] :tcp_inbound - [0:0] -A INPUT -i eth0 -j LOG --log-prefix "BANDWIDTH_IN:" --log-level 7 -A INPUT -i lo -j ACCEPT -A INPUT -j bad_packets -A INPUT -d 224.0.0.1 -j DROP -A INPUT -d 192.168.0.0/255.255.0.0 -j DROP -A INPUT -d 192.168.1.1 -j DROP -A INPUT -s 192.168.1.1/255.255.255.0 -j DROP -A INPUT -s 10.10.6.0/255.255.255.0 -i eth1 -j ACCEPT -A INPUT -d 10.10.6.255 -i eth1 -j ACCEPT -A INPUT -m state -i eth0 --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -i eth0 -j tcp_inbound -A INPUT -p udp -i eth0 -j udp_inbound -A INPUT -p icmp -i eth0 -j icmp_packets -A INPUT -d 255.255.255.255 -j DROP -A FORWARD -o eth0 -j LOG --log-prefix "BANDWIDTH_OUT:" --log-level 7 -A FORWARD -i eth0 -j LOG --log-prefix "BANDWIDTH_IN:" --log-level 7 -A FORWARD -j bad_packets -A FORWARD -p tcp -i eth1 -j tcp_outbound -A FORWARD -p udp -i eth1 -j udp_outbound -A FORWARD -i eth1 -j ACCEPT -A FORWARD -m state -i eth0 --state RELATED,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -j LOG --log-prefix "BANDWIDTH_OUT:" --log-level 7 -A OUTPUT -p icmp -m state --state INVALID -j DROP -A OUTPUT -s 127.0.0.1 -j ACCEPT -A OUTPUT -o lo -j ACCEPT -A OUTPUT -s 10.10.6.1 -j ACCEPT -A OUTPUT -o eth1 -j ACCEPT -A OUTPUT -o eth0 -j ACCEPT -A bad_packets -m state --state INVALID -j DROP -A bad_packets -p tcp -j bad_tcp_packets -A bad_packets -j RETURN -A bad_tcp_packets -p tcp -i eth1 -j RETURN -A bad_tcp_packets -p tcp -m tcp -m state ! --tcp-flags SYN,RST,ACK SYN --state NEW -j DROP -A bad_tcp_packets -p tcp -j RETURN -A icmp_packets -p icmp -f -j DROP -A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT -A icmp_packets -p icmp -m icmp --icmp-type 8 -j DROP -A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT -A icmp_packets -p icmp -j RETURN -A ssh_brute -m recent --set --name SSH --rsource -A ssh_brute -m recent -j RETURN ! --rcheck --seconds 60 --hitcount 4 --name SSH --rsource -A ssh_brute -m limit --limit 3/min -j LOG --log-prefix "SSH Brute Force Attempt: " -A ssh_brute -p tcp -j REJECT --reject-with icmp-port-unreachable -A tcp_inbound -p tcp -m tcp --dport 113 -j REJECT --reject-with icmp-port-unreachable -A tcp_inbound -p tcp -m tcp --dport 80 -j ACCEPT -A tcp_inbound -p tcp -m tcp --dport 443 -j ACCEPT -A tcp_inbound -p tcp -m tcp -m state -i eth0 --state NEW -j ssh_brute -A tcp_inbound -p tcp -m tcp --dport 22 -j ACCEPT -A tcp_inbound -p tcp -m tcp --dport 10000 -j ACCEPT -A tcp_inbound -p tcp -j RETURN -A tcp_outbound -p tcp -j ACCEPT -A udp_inbound -p udp -m udp --dport 137 -j DROP -A udp_inbound -p udp -m udp --dport 138 -j DROP -A udp_inbound -p udp -m udp --dport 113 -j REJECT --reject-with icmp-port-unreachable -A udp_inbound -p udp -m udp --dport 123 -j ACCEPT -A udp_inbound -p udp -m udp --dport 68 --sport 67 -j ACCEPT -A udp_inbound -p udp -j RETURN -A udp_outbound -p udp -j ACCEPT COMMIT # Completed on Thu Jul 28 13:17:42 2005 # Generated by iptables-save v1.2.11 on Thu Jul 28 13:17:42 2005 *mangle :PREROUTING ACCEPT [2457:1930535] :INPUT ACCEPT [2348:1906295] :FORWARD ACCEPT [109:24240] :OUTPUT ACCEPT [2505:409814] :POSTROUTING ACCEPT [2614:434054] COMMIT # Completed on Thu Jul 28 13:17:42 2005 # Generated by iptables-save v1.2.11 on Thu Jul 28 13:17:42 2005 *nat :PREROUTING ACCEPT [15:1472] :POSTROUTING ACCEPT [155:9526] :OUTPUT ACCEPT [155:9526] -A POSTROUTING -o eth0 -j MASQUERADE COMMIT # Completed on Thu Jul 28 13:17:42 2005 # iptables -L Chain INPUT (policy DROP) target prot opt source destination LOG all -- anywhere anywhere LOG level debug prefix `BANDWIDTH_IN:' ACCEPT all -- anywhere anywhere bad_packets all -- anywhere anywhere DROP all -- anywhere ALL-SYSTEMS.MCAST.NET DROP all -- anywhere 192.168.0.0/16 DROP all -- anywhere 192.168.1.1 DROP all -- 192.168.1.0/24 anywhere ACCEPT all -- localnet/24 anywhere ACCEPT all -- anywhere 10.10.6.255 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED tcp_inbound tcp -- anywhere anywhere udp_inbound udp -- anywhere anywhere icmp_packets icmp -- anywhere anywhere DROP all -- anywhere 255.255.255.255 Chain FORWARD (policy DROP) target prot opt source destination LOG all -- anywhere anywhere LOG level debug prefix `BANDWIDTH_OUT:' LOG all -- anywhere anywhere LOG level debug prefix `BANDWIDTH_IN:' bad_packets all -- anywhere anywhere tcp_outbound tcp -- anywhere anywhere udp_outbound udp -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED Chain OUTPUT (policy DROP) target prot opt source destination LOG all -- anywhere anywhere LOG level debug prefix `BANDWIDTH_OUT:' DROP icmp -- anywhere anywhere state INVALID ACCEPT all -- localhost anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- kin-gw.office.mwater.ca anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere Chain bad_packets (2 references) target prot opt source destination DROP all -- anywhere anywhere state INVALID bad_tcp_packets tcp -- anywhere anywhere RETURN all -- anywhere anywhere Chain bad_tcp_packets (1 references) target prot opt source destination RETURN tcp -- anywhere anywhere DROP tcp -- anywhere anywhere tcp flags:!SYN,RST,ACK/SYN state NEW RETURN tcp -- anywhere anywhere Chain icmp_packets (1 references) target prot opt source destination DROP icmp -f anywhere anywhere ACCEPT icmp -- anywhere anywhere icmp echo-request DROP icmp -- anywhere anywhere icmp echo-request ACCEPT icmp -- anywhere anywhere icmp time-exceeded RETURN icmp -- anywhere anywhere Chain ssh_brute (1 references) target prot opt source destination all -- anywhere anywhere recent: SET name: SSH side: source RETURN all -- anywhere anywhere !recent: CHECK seconds: 60 hit_count: 4 name: SSHside: source LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix`SSH Brute Force Attempt: ' REJECT tcp -- anywhere anywhere reject-with icmp-port-unreachable Chain tcp_inbound (1 references) target prot opt source destination REJECT tcp -- anywhere anywhere tcp dpt:auth reject-with icmp-port-unreachable ACCEPT tcp -- anywhere anywhere tcp dpt:www ACCEPT tcp -- anywhere anywhere tcp dpt:https ssh_brute tcp -- anywhere anywhere tcp state NEW ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:10000 RETURN tcp -- anywhere anywhere Chain tcp_outbound (1 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere Chain udp_inbound (1 references) target prot opt source destination DROP udp -- anywhere anywhere udp dpt:netbios-ns DROP udp -- anywhere anywhere udp dpt:netbios-dgm REJECT udp -- anywhere anywhere udp dpt:113 reject-with icmp-port-unreachable ACCEPT udp -- anywhere anywhere udp dpt:ntp ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc RETURN udp -- anywhere anywhere Chain udp_outbound (1 references) target prot opt source destination ACCEPT udp -- anywhere anywhere