Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT udp -- anywhere anywhere udp dpt:21331 ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:mysql ACCEPT udp -- anywhere anywhere state NEW udp dpt:mysql ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:cvspserver ACCEPT udp -- anywhere anywhere state NEW udp dpt:cvspserver ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:webcache ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh ACCEPT udp -- anywhere anywhere state NEW udp dpt:ssh ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:pop3 ACCEPT udp -- anywhere anywhere state NEW udp dpt:pop3 ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https ACCEPT udp -- anywhere anywhere state NEW udp dpt:https ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ftp ACCEPT udp -- anywhere anywhere state NEW udp dpt:ftp ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp ACCEPT udp -- anywhere anywhere state NEW udp dpt:smtp ACCEPT all -- anywhere anywhere state NEW TRUSTED all -- anywhere anywhere state NEW ACCEPT tcp -- anywhere anywhere tcp dpt:21321 REJECT tcp -- anywhere anywhere tcp dpt:10000 reject-with icmp-port-unreachable REJECT udp -- anywhere anywhere udp dpt:10000 reject-with icmp-port-unreachable ACCEPT all -- anywhere anywhere REJECT all -- anywhere 127.0.0.0/8 reject-with icmp-port-unreachable DROP tcp -- anywhere anywhere tcp dpt:10000 DROP udp -- anywhere anywhere udp dpt:10000 ACCEPT tcp -- anywhere anywhere tcp dpt:21331 ACCEPT udp -- anywhere anywhere udp dpt:21331 Chain FORWARD (policy DROP) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination DROP icmp -- anywhere anywhere state INVALID ACCEPT tcp -- anywhere anywhere tcp dpt:21331 ACCEPT udp -- anywhere anywhere udp dpt:21331 Chain TRUSTED (1 references) target prot opt source destination ACCEPT icmp -- anywhere anywhere icmp echo-request DROP icmp -- anywhere anywhere REJECT all -- anywhere anywhere reject-with icmp-port-unreachable