# iptables --list --verbose Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 56 3560 ACCEPT 0 -- lo any anywhere anywhere 18555 21M ACCEPT 0 -- any any anywhere anywhere state RELATED,ESTABLISHED 569 50163 input_ext 0 -- eth0 any anywhere anywhere 1121 75913 input_ext 0 -- any any anywhere anywhere 0 0 LOG 0 -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-IN-ILL-TARGET ' 0 0 DROP 0 -- any any anywhere anywhere Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 LOG 0 -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWD-ILL-ROUTING ' Chain OUTPUT (policy ACCEPT 11 packets, 548 bytes) pkts bytes target prot opt in out source destination 57 3600 ACCEPT 0 -- any lo anywhere anywhere 18962 1607K ACCEPT 0 -- any any anywhere anywhere state NEW,RELATED,ESTABLISHED 11 548 LOG 0 -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-OUT-ERROR ' Chain forward_ext (0 references) pkts bytes target prot opt in out source destination Chain input_ext (2 references) pkts bytes target prot opt in out source destination 20 1920 DROP 0 -- any any anywhere anywhere PKTTYPE = broadcast 0 0 ACCEPT icmp -- any any anywhere anywhere icmp source-quench 22 1320 ACCEPT icmp -- any any anywhere anywhere icmp echo-request 0 0 ACCEPT icmp -- any any anywhere anywhere state RELATED,ESTABLISHED icmp echo-reply 0 0 ACCEPT icmp -- any any anywhere anywhere state RELATED,ESTABLISHED icmp destination-unreachable 0 0 ACCEPT icmp -- any any anywhere anywhere state RELATED,ESTABLISHED icmp time-exceeded 0 0 ACCEPT icmp -- any any anywhere anywhere state RELATED,ESTABLISHED icmp parameter-problem 0 0 ACCEPT icmp -- any any anywhere anywhere state RELATED,ESTABLISHED icmp timestamp-reply 0 0 ACCEPT icmp -- any any anywhere anywhere state RELATED,ESTABLISHED icmp address-mask-reply 0 0 ACCEPT icmp -- any any anywhere anywhere state RELATED,ESTABLISHED icmp protocol-unreachable 0 0 ACCEPT icmp -- any any anywhere anywhere state RELATED,ESTABLISHED icmp redirect 0 0 LOG tcp -- any any anywhere anywhere limit: avg 3/min burst 5 tcp dpt:tftps flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' 0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:tftps 0 0 LOG tcp -- any any anywhere anywhere limit: avg 3/min burst 5 tcp dpt:odette-ftps flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' 0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:odette-ftps 0 0 LOG tcp -- any any anywhere anywhere limit: avg 3/min burst 5 tcp dpt:ftps-data flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' 0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ftps-data 9 468 LOG tcp -- any any anywhere anywhere limit: avg 3/min burst 5 tcp dpt:ftps flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' 17 884 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ftps 0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:tftps 0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:odette-ftps 0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:ftps-data 0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:ftps 0 0 reject_func tcp -- any any anywhere anywhere tcp dpt:ident state NEW 81 7857 LOG 0 -- any any anywhere anywhere limit: avg 3/min burst 5 PKTTYPE = multicast LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT ' 822 79968 DROP 0 -- any any anywhere anywhere PKTTYPE = multicast 152 7904 LOG tcp -- any any anywhere anywhere limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT ' 0 0 LOG icmp -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT ' 0 0 LOG udp -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT ' 20 1016 LOG 0 -- any any anywhere anywhere limit: avg 3/min burst 5 state INVALID LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT-INV ' 809 41984 DROP 0 -- any any anywhere anywhere Chain reject_func (1 references) pkts bytes target prot opt in out source destination 0 0 REJECT tcp -- any any anywhere anywhere reject-with tcp-reset 0 0 REJECT udp -- any any anywhere anywhere reject-with icmp-port-unreachable 0 0 REJECT 0 -- any any anywhere anywhere reject-with icmp-proto-unreachable