# Generated by iptables-save v1.3.2 on Tue Oct 25 20:16:23 2005
*mangle
:PREROUTING ACCEPT [5428:428081]
:INPUT ACCEPT [5275:391537]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [27944:5739033]
:POSTROUTING ACCEPT [27924:5736953]
COMMIT
# Completed on Tue Oct 25 20:16:23 2005
# Generated by iptables-save v1.3.2 on Tue Oct 25 20:16:23 2005
*filter
:ACCEPT_ALL - [0:0]
:BADTCP - [0:0]
:BLUEINPUT - [0:0]
:CUSTOMFORWARD - [0:0]
:CUSTOMINPUT - [0:0]
:CUSTOMOUTPUT - [0:0]
:DHCPBLUEINPUT - [0:0]
:DMZHOLES - [0:0]
:INPUT DROP [8:706]
:FORWARD DROP [0:0]
:IPSECBLUE - [0:0]
:IPSECRED - [0:0]
:LOG_DROP - [0:0]
:LOG_REJECT - [0:0]
:NEWNOTSYN - [0:0]
:OPENVPN - [0:0]
:ORANGEINPUT - [0:0]
:OUTGOINGFW - [0:0]
:OUTPUT ACCEPT [27925:5737105]
:PORTFWACCESS - [0:0]
:PSCAN - [0:0]
:REDINPUT - [0:0]
:SIPROXD - [0:0]
:XTACCESS - [0:0]
:ipac~fi - [0:0]
:ipac~fo - [0:0]
:ipac~i - [0:0]
:ipac~o - [0:0]
-A ACCEPT_ALL -i br0 -o ! ppp0 -m state --state NEW -j ACCEPT 
-A ACCEPT_ALL -i ipsec+ -o ! ppp0 -j ACCEPT 
-A ACCEPT_ALL -o ppp0 -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j PSCAN 
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j PSCAN 
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j PSCAN 
-A BADTCP -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j PSCAN 
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j PSCAN 
-A BADTCP -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j NEWNOTSYN 
-A INPUT -j ipac~o 
-A INPUT -j BADTCP 
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec 
-A INPUT -j CUSTOMINPUT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -i lo -m state --state NEW -j ACCEPT 
-A INPUT -s 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP 
-A INPUT -d 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP 
-A INPUT -i br0 -p ! icmp -m state --state NEW -j ACCEPT 
-A INPUT -i ipsec+ -j ACCEPT 
-A INPUT -p ! icmp -m state --state NEW -j BLUEINPUT 
-A INPUT -p ! icmp -m state --state NEW -j ORANGEINPUT 
-A INPUT -m state --state NEW -j OUTGOINGFW 
-A INPUT -j DHCPBLUEINPUT 
-A INPUT -m state --state NEW -j OPENVPN 
-A INPUT -j IPSECRED 
-A INPUT -j IPSECBLUE 
-A INPUT -j REDINPUT 
-A INPUT -m state --state NEW -j XTACCESS 
-A INPUT -m limit --limit 10/min -j LOG --log-prefix "INPUT " 
-A FORWARD -j ipac~fi 
-A FORWARD -j ipac~fo 
-A FORWARD -j BADTCP 
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
-A FORWARD -j CUSTOMFORWARD 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i lo -m state --state NEW -j ACCEPT 
-A FORWARD -s 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP 
-A FORWARD -d 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP 
-A FORWARD -j ACCEPT_ALL 
-A FORWARD -m state --state NEW -j OUTGOINGFW 
-A FORWARD -m state --state NEW -j OPENVPN 
-A FORWARD -m state --state NEW -j DMZHOLES 
-A FORWARD -m state --state NEW -j PORTFWACCESS 
-A FORWARD -m limit --limit 10/min -j LOG --log-prefix "FORWARD " 
-A LOG_DROP -m limit --limit 10/min -j LOG 
-A LOG_DROP -j DROP 
-A LOG_REJECT -m limit --limit 10/min -j LOG 
-A LOG_REJECT -j REJECT --reject-with icmp-port-unreachable 
-A NEWNOTSYN -m limit --limit 10/min -j LOG --log-prefix "NEW not SYN? " 
-A NEWNOTSYN -j DROP 
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 80 -j ACCEPT 
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 443 -j ACCEPT 
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 21 -j ACCEPT 
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 20 -j ACCEPT 
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 25 -j ACCEPT 
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 110 -j ACCEPT 
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 143 -j ACCEPT 
-A OUTGOINGFW -i br0 -o ppp0 -p tcp -m tcp --dport 53 -j ACCEPT 
-A OUTGOINGFW -i br0 -o ppp0 -p udp -m udp --dport 53 -j ACCEPT 
-A OUTPUT -j ipac~i 
-A OUTPUT -j CUSTOMOUTPUT 
-A PSCAN -p tcp -m limit --limit 10/min -j LOG --log-prefix "TCP Scan? " 
-A PSCAN -p udp -m limit --limit 10/min -j LOG --log-prefix "UDP Scan? " 
-A PSCAN -p icmp -m limit --limit 10/min -j LOG --log-prefix "ICMP Scan? " 
-A PSCAN -f -m limit --limit 10/min -j LOG --log-prefix "FRAG Scan? " 
-A PSCAN -j DROP 
-A REDINPUT -i eth3 -j ACCEPT 
-A REDINPUT -i eth3 -j ACCEPT 
-A XTACCESS -d 85.124.37.74 -i ppp0 -p tcp -m tcp --dport 113 -j ACCEPT 
-A ipac~fi -i br0 
-A ipac~fi -i ppp0 
-A ipac~fo -o br0 
-A ipac~fo -o ppp0 
-A ipac~i -o br0 
-A ipac~i -o ppp0 
-A ipac~o -i br0 
-A ipac~o -i ppp0 
COMMIT
# Completed on Tue Oct 25 20:16:23 2005
# Generated by iptables-save v1.3.2 on Tue Oct 25 20:16:23 2005
*nat
:CONTENTFILTER - [0:0]
:CUSTOMPOSTROUTING - [0:0]
:CUSTOMPREROUTING - [0:0]
:ORANGENAT - [0:0]
:PORTFW - [0:0]
:POSTPORTFW - [0:0]
:PREROUTING ACCEPT [291:45998]
:POSTROUTING ACCEPT [3:197]
:OUTPUT ACCEPT [8:548]
:REDNAT - [0:0]
:SIPROXDPORTFW - [0:0]
:SQUID - [0:0]
-A PREROUTING -j CUSTOMPREROUTING 
-A PREROUTING -j SIPROXDPORTFW 
-A PREROUTING -j CONTENTFILTER 
-A PREROUTING -j SQUID 
-A PREROUTING -j PORTFW 
-A POSTROUTING -j CUSTOMPOSTROUTING 
-A POSTROUTING -j ORANGENAT 
-A POSTROUTING -j REDNAT 
-A POSTROUTING -j POSTPORTFW 
-A REDNAT -o ppp0 -j MASQUERADE 
COMMIT
# Completed on Tue Oct 25 20:16:23 2005