# Generated by iptables-save v1.3.4 on Sat Dec 10 15:27:56 2005
*mangle
:PREROUTING ACCEPT [13525:11434103]
:INPUT ACCEPT [13038:11153814]
:FORWARD ACCEPT [335:192408]
:OUTPUT ACCEPT [12376:11538078]
:POSTROUTING ACCEPT [12336:11534686]
COMMIT
# Completed on Sat Dec 10 15:27:56 2005
# Generated by iptables-save v1.3.4 on Sat Dec 10 15:27:56 2005
*filter
:ACCEPT_ALL - [0:0]
:BADTCP - [0:0]
:BLUEINPUT - [0:0]
:CUSTOMFORWARD - [0:0]
:CUSTOMINPUT - [0:0]
:CUSTOMOUTPUT - [0:0]
:DHCPBLUEINPUT - [0:0]
:DMZHOLES - [0:0]
:INPUT DROP [55:5850]
:FORWARD DROP [335:192408]
:IPSECBLUE - [0:0]
:IPSECRED - [0:0]
:LOG_DROP - [0:0]
:LOG_REJECT - [0:0]
:NEWNOTSYN - [0:0]
:OPENVPN - [0:0]
:OPENVPNCLIENT - [0:0]
:ORANGEINPUT - [0:0]
:OUTGOINGFW - [0:0]
:OUTPUT ACCEPT [12340:11535166]
:PORTFWACCESS - [0:0]
:PSCAN - [0:0]
:REDINPUT - [0:0]
:SIPROXD - [0:0]
:SMTPD - [0:0]
:XTACCESS - [0:0]
:ipac~fi - [0:0]
:ipac~fo - [0:0]
:ipac~i - [0:0]
:ipac~o - [0:0]
-A ACCEPT_ALL -i br0 -o br1 -m state --state NEW -j ACCEPT
-A ACCEPT_ALL -i ipsec+ -o br0 -m state --state NEW -j ACCEPT
-A ACCEPT_ALL -i ipsec+ -o br2 -m state --state NEW -j ACCEPT
-A ACCEPT_ALL -i ipsec+ -o br1 -m state --state NEW -j ACCEPT
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j PSCAN
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j PSCAN
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j PSCAN
-A BADTCP -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j PSCAN
-A BADTCP -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j NEWNOTSYN
-A BLUEINPUT -i br2 -j ACCEPT
-A DHCPBLUEINPUT -i br2 -p tcp -m tcp --sport 68 --dport 67 -j ACCEPT
-A DHCPBLUEINPUT -i br2 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -j ipac~o
-A INPUT -j BADTCP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec
-A INPUT -j CUSTOMINPUT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -s 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
-A INPUT -d 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
-A INPUT -i br0 -p ! icmp -m state --state NEW -j ACCEPT
-A INPUT -i ipsec+ -j ACCEPT
-A INPUT -p ! icmp -m state --state NEW -j BLUEINPUT
-A INPUT -p ! icmp -m state --state NEW -j ORANGEINPUT
-A INPUT -m state --state NEW -j OUTGOINGFW
-A INPUT -j DHCPBLUEINPUT
-A INPUT -m state --state NEW -j OPENVPN
-A INPUT -m state --state NEW -j SMTPD
-A INPUT -j IPSECRED
-A INPUT -j IPSECBLUE
-A INPUT -j REDINPUT
-A INPUT -m state --state NEW -j XTACCESS
-A INPUT -m limit --limit 10/min -j LOG --log-prefix "INPUT "
-A FORWARD -j ipac~fi
-A FORWARD -j ipac~fo
-A FORWARD -j BADTCP
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -j CUSTOMFORWARD
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -m state --state NEW -j ACCEPT
-A FORWARD -s 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
-A FORWARD -d 127.0.0.0/255.0.0.0 -m state --state NEW -j DROP
-A FORWARD -j ACCEPT_ALL
-A FORWARD -m state --state NEW -j OUTGOINGFW
-A FORWARD -m state --state NEW -j OPENVPN
-A FORWARD -m state --state NEW -j OPENVPNCLIENT
-A FORWARD -m state --state NEW -j DMZHOLES
-A FORWARD -m state --state NEW -j PORTFWACCESS
-A FORWARD -m limit --limit 10/min -j LOG --log-prefix "FORWARD "
-A LOG_DROP -m limit --limit 10/min -j LOG
-A LOG_DROP -j DROP
-A LOG_REJECT -m limit --limit 10/min -j LOG
-A LOG_REJECT -j REJECT --reject-with icmp-port-unreachable
-A NEWNOTSYN -m limit --limit 10/min -j LOG --log-prefix "NEW not SYN? "
-A NEWNOTSYN -j DROP
-A OPENVPN -p udp -m udp --dport 1194 -j ACCEPT
-A ORANGEINPUT -i br1 -j ACCEPT
-A OUTPUT -j ipac~i
-A OUTPUT -j CUSTOMOUTPUT
-A PSCAN -p tcp -m limit --limit 10/min -j LOG --log-prefix "TCP Scan? "
-A PSCAN -p udp -m limit --limit 10/min -j LOG --log-prefix "UDP Scan? "
-A PSCAN -p icmp -m limit --limit 10/min -j LOG --log-prefix "ICMP Scan? "
-A PSCAN -f -m limit --limit 10/min -j LOG --log-prefix "FRAG Scan? "
-A PSCAN -j DROP
-A ipac~fi -i br0
-A ipac~fi -i br2
-A ipac~fi -i br1
-A ipac~fi
-A ipac~fo -o br0
-A ipac~fo -o br2
-A ipac~fo -o br1
-A ipac~fo
-A ipac~i -o br0
-A ipac~i -o br2
-A ipac~i -o br1
-A ipac~i
-A ipac~o -i br0
-A ipac~o -i br2
-A ipac~o -i br1
-A ipac~o
COMMIT
# Completed on Sat Dec 10 15:27:56 2005
# Generated by iptables-save v1.3.4 on Sat Dec 10 15:27:56 2005
*nat
:PREROUTING ACCEPT [591:289474]
:POSTROUTING ACCEPT [95:4810]
:OUTPUT ACCEPT [95:4810]
:CONTENTFILTER - [0:0]
:CUSTOMPOSTROUTING - [0:0]
:CUSTOMPREROUTING - [0:0]
:OPENVPNCLIENT - [0:0]
:ORANGENAT - [0:0]
:P3SCAN - [0:0]
:PORTFW - [0:0]
:POSTPORTFW - [0:0]
:REDNAT - [0:0]
:SIPROXDPORTFW - [0:0]
:SMTPSCAN - [0:0]
:SQUID - [0:0]
-A PREROUTING -j CUSTOMPREROUTING
-A PREROUTING -j OPENVPNCLIENT
-A PREROUTING -j SIPROXDPORTFW
-A PREROUTING -j CONTENTFILTER
-A PREROUTING -j SQUID
-A PREROUTING -j PORTFW
-A POSTROUTING -j CUSTOMPOSTROUTING
-A POSTROUTING -j ORANGENAT
-A POSTROUTING -j REDNAT
-A POSTROUTING -j POSTPORTFW
-A CUSTOMPREROUTING -p tcp -m tcp --dport 110 -j P3SCAN
-A CUSTOMPREROUTING -p tcp -m tcp --dport 25 -j SMTPSCAN
-A P3SCAN -i br0 -p tcp -j DNAT --to-destination 192.168.3.1:8110
-A POSTPORTFW -s 192.168.3.0/255.255.255.0 -d 192.168.3.5 -p tcp -m tcp --dport 5000 -j SNAT --to-source 192.168.3.1
-A POSTPORTFW -s 192.168.5.0/255.255.255.0 -d 192.168.3.5 -p tcp -m tcp --dport 5000 -j SNAT --to-source 192.168.5.1
-A POSTPORTFW -s 192.168.3.0/255.255.255.0 -d 192.168.3.5 -p tcp -m tcp --dport 5500 -j SNAT --to-source 192.168.3.1
-A POSTPORTFW -s 192.168.5.0/255.255.255.0 -d 192.168.3.5 -p tcp -m tcp --dport 5500 -j SNAT --to-source 192.168.5.1
-A POSTPORTFW -s 192.168.3.0/255.255.255.0 -d 192.168.3.5 -p tcp -m tcp --dport 4662 -j SNAT --to-source 192.168.3.1
-A POSTPORTFW -s 192.168.5.0/255.255.255.0 -d 192.168.3.5 -p tcp -m tcp --dport 4662 -j SNAT --to-source 192.168.5.1
-A POSTPORTFW -s 192.168.3.0/255.255.255.0 -d 192.168.3.5 -p udp -m udp --dport 4672 -j SNAT --to-source 192.168.3.1
-A POSTPORTFW -s 192.168.5.0/255.255.255.0 -d 192.168.3.5 -p udp -m udp --dport 4672 -j SNAT --to-source 192.168.5.1
-A SMTPSCAN -i br0 -p tcp -j DNAT --to-destination 192.168.3.1:25
-A SQUID -d ! 192.168.3.0/255.255.255.0 -i br0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
COMMIT
# Completed on Sat Dec 10 15:27:56 2005