xen02:~# iptables -L -n -v --line-numbers Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 22326 2422K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 2 553K 93M in_internet all -- * * 0.0.0.0/0 0.0.0.0/0 3 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED 4 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `IN-unknown:' 5 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED 2 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `PASS-unknown:' 3 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 22326 2422K ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0 2 552K 76M out_internet all -- * * 0.0.0.0/0 0.0.0.0/0 3 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED 4 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `OUT-unknown:' 5 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain in_internet (1 references) num pkts bytes target prot opt in out source destination 1 55 22988 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 2 0 0 pr_internet_fragments all -f * * 0.0.0.0/0 0.0.0.0/0 3 9 468 pr_internet_nosyn tcp -- * * 0.0.0.0/0 0.0. 0.0/0 state NEW tcp flags:!0x16/0x02 4 549 34611 pr_internet_icmpflood icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 5 46735 2796K pr_internet_synflood tcp -- * * 0.0.0.0/0 0 .0.0.0/0 tcp flags:0x16/0x02 6 0 0 pr_internet_malxmas tcp -- * * 0.0.0.0/0 0. 0.0.0/0 tcp flags:0x3F/0x3F 7 0 0 pr_internet_malnull tcp -- * * 0.0.0.0/0 0. 0.0.0/0 tcp flags:0x3F/0x00 8 0 0 pr_internet_malbad tcp -- * * 0.0.0.0/0 0.0 .0.0/0 tcp flags:0x03/0x03 9 0 0 pr_internet_malbad tcp -- * * 0.0.0.0/0 0.0 .0.0/0 tcp flags:0x06/0x06 10 0 0 pr_internet_malbad tcp -- * * 0.0.0.0/0 0.0 .0.0/0 tcp flags:0x3F/0x37 11 0 0 pr_internet_malbad tcp -- * * 0.0.0.0/0 0.0 .0.0/0 tcp flags:0x3F/0x29 12 553K 93M in_internet_ftp_s1 all -- * * 0.0.0.0/0 0.0 .0.0/0 13 553K 93M in_internet_ssh_s2 all -- * * 0.0.0.0/0 0.0 .0.0/0 14 109K 51M in_internet_dns_s3 all -- * * 0.0.0.0/0 0.0 .0.0/0 15 109K 51M in_internet_http_s4 all -- * * 0.0.0.0/0 0. 0.0.0/0 16 109K 50M in_internet_https_s5 all -- * * 0.0.0.0/0 0 .0.0.0/0 17 109K 50M in_internet_socks_s6 all -- * * 0.0.0.0/0 0 .0.0.0/0 18 109K 50M in_internet_syslog_s7 all -- * * 0.0.0.0/0 0.0.0.0/0 19 109K 50M in_internet_all_c8 all -- * * 0.0.0.0/0 0.0 .0.0/0 20 19906 3505K in_internet_irc_c9 all -- * * 0.0.0.0/0 0.0 .0.0/0 21 19906 3505K in_internet_ftp_c10 all -- * * 0.0.0.0/0 0. 0.0.0/0 22 1 110 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED 23 9746 2895K LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `IN-internet:' 24 19905 3504K DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain in_internet_all_c8 (1 references) num pkts bytes target prot opt in out source destination 1 88708 47M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED Chain in_internet_dns_s3 (1 references) num pkts bytes target prot opt in out source destination 1 50 3134 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 state NEW,ESTABLISHED 2 7 420 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 state NEW,ESTABLISHED Chain in_internet_ftp_c10 (1 references) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:21 dpts:1024:4999 state ESTABLISHED 2 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20 dpts:1024:4999 state RELATED,ESTABLISHED 3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpts:1024:4999 state ESTABLISHED Chain in_internet_ftp_s1 (1 references) num pkts bytes target prot opt in out source destination 1 93 5270 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:21 state NEW,ESTABLISHED 2 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:20 state ESTABLISHED 3 18 992 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpts:1024:4999 state RELATED,ESTABLISHED Chain in_internet_http_s4 (1 references) num pkts bytes target prot opt in out source destination 1 703 141K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:80 state NEW,ESTABLISHED Chain in_internet_https_s5 (1 references) num pkts bytes target prot opt in out source destination 1 58 3485 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:443 state NEW,ESTABLISHED Chain in_internet_irc_c9 (1 references) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:6667 dpts:1024:4999 state ESTABLISHED Chain in_internet_socks_s6 (1 references) num pkts bytes target prot opt in out source destination 1 11 564 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:1080 state NEW,ESTABLISHED 2 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spts:1024:65535 dpt:1080 state NEW,ESTABLISHED Chain in_internet_ssh_s2 (1 references) num pkts bytes target prot opt in out source destination 1 444K 42M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:22 state NEW,ESTABLISHED Chain in_internet_syslog_s7 (1 references) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:514 dpt:514 state NEW,ESTABLISHED 2 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spts:1024:65535 dpt:514 state NEW,ESTABLISHED Chain out_internet (1 references) num pkts bytes target prot opt in out source destination 1 552K 76M out_internet_ftp_s1 all -- * * 0.0.0.0/0 0. 0.0.0/0 2 552K 76M out_internet_ssh_s2 all -- * * 0.0.0.0/0 0. 0.0.0/0 3 79270 5996K out_internet_dns_s3 all -- * * 0.0.0.0/0 0. 0.0.0/0 4 79238 5988K out_internet_http_s4 all -- * * 0.0.0.0/0 0 .0.0.0/0 5 78680 5616K out_internet_https_s5 all -- * * 0.0.0.0/0 0.0.0.0/0 6 78628 5614K out_internet_socks_s6 all -- * * 0.0.0.0/0 0.0.0.0/0 7 78628 5614K out_internet_syslog_s7 all -- * * 0.0.0.0/0 0.0.0.0/0 8 78628 5614K out_internet_all_c8 all -- * * 0.0.0.0/0 0. 0.0.0/0 9 95 7524 out_internet_irc_c9 all -- * * 0.0.0.0/0 0. 0.0.0/0 10 95 7524 out_internet_ftp_c10 all -- * * 0.0.0.0/0 0 .0.0.0/0 11 31 3180 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED 12 42 3248 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `OUT-internet:' 13 64 4344 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain out_internet_all_c8 (1 references) num pkts bytes target prot opt in out source destination 1 78533 5606K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED Chain out_internet_dns_s3 (1 references) num pkts bytes target prot opt in out source destination 1 25 8512 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:53 state ESTABLISHED 2 7 280 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:53 state ESTABLISHED Chain out_internet_ftp_c10 (1 references) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:4999 dpt:21 state NEW,ESTABLISHED 2 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:4999 dpt:20 state ESTABLISHED 3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:4999 dpts:1024:65535 state RELATED,ESTABLISHED Chain out_internet_ftp_s1 (1 references) num pkts bytes target prot opt in out source destination 1 67 5041 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:21 dpts:1024:65535 state ESTABLISHED 2 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20 dpts:1024:65535 state RELATED,ESTABLISHED 3 27 2573 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:4999 dpts:1024:65535 state ESTABLISHED Chain out_internet_http_s4 (1 references) num pkts bytes target prot opt in out source destination 1 558 371K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:80 dpts:1024:65535 state ESTABLISHED Chain out_internet_https_s5 (1 references) num pkts bytes target prot opt in out source destination 1 52 2311 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:443 dpts:1024:65535 state ESTABLISHED Chain out_internet_irc_c9 (1 references) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:4999 dpt:6667 state NEW,ESTABLISHED Chain out_internet_socks_s6 (1 references) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:1080 dpts:1024:65535 state ESTABLISHED 2 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:1080 dpts:1024:65535 state ESTABLISHED Chain out_internet_ssh_s2 (1 references) num pkts bytes target prot opt in out source destination 1 473K 70M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:22 dpts:1024:65535 state ESTABLISHED Chain out_internet_syslog_s7 (1 references) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:514 dpt:514 state ESTABLISHED 2 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:514 dpts:1024:65535 state ESTABLISHED Chain pr_internet_fragments (1 references) num pkts bytes target prot opt in out source destination 1 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `PACKET FRAGMENTS:' 2 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain pr_internet_icmpflood (1 references) num pkts bytes target prot opt in out source destination 1 549 34611 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 100/sec burst 50 2 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `ICMP FLOOD:' 3 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain pr_internet_malbad (4 references) num pkts bytes target prot opt in out source destination 1 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `MALFORMED BAD:' 2 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain pr_internet_malnull (1 references) num pkts bytes target prot opt in out source destination 1 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `MALFORMED NULL:' 2 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain pr_internet_malxmas (1 references) num pkts bytes target prot opt in out source destination 1 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `MALFORMED XMAS:' 2 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain pr_internet_nosyn (1 references) num pkts bytes target prot opt in out source destination 1 9 468 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `NEW TCP w/o SYN:' 2 9 468 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain pr_internet_synflood (1 references) num pkts bytes target prot opt in out source destination 1 46575 2787K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 100/sec burst 50 2 16 960 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `SYN FLOOD:' 3 160 9600 DROP all -- * * 0.0.0.0/0 0.0.0.0/0