-
Notifications
You must be signed in to change notification settings - Fork 0
/
iptables-x
162 lines (162 loc) · 5.64 KB
/
iptables-x
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
# Generated by xtables-save v1.8.2 on Sat May 2 10:00:54 2020
*raw
:PREROUTING ACCPET [0:0]
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED -j ACCEPT
#-A PREROUTING -m state --state ESTABLISHED -j ACCEPT
COMMIT
#
*security
:PREROUTING DROP [0:0]
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A PREROUTING -m state --state ESTABLISHED -j ACCEPT
COMMIT
#
*mangle
:PREROUTING DROP [0:0]
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A PREROUTING -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j TOS --set-tos 0x10/0xff
-A OUTPUT -p tcp -m tcp --dport 80 -j TOS --set-tos 0x08/0xff
-A OUTPUT -p tcp -m tcp --dport 443 -j TOS --set-tos 0x08/0xff
-A OUTPUT -p tcp -m tcp --dport 8080 -j TOS --set-tos 0x08/0xff
-A OUTPUT -p tcp -m tcp --dport 21 -j TOS --set-tos 0x08/0xff
-A OUTPUT -p tcp -m tcp --dport 53 -j TOS --set-tos 0x10/0xff
-A OUTPUT -p tcp -m tcp --dport 53 -j TOS --set-tos 0x10/0xff
COMMIT
# Completed on Sat May 2 10:00:54 2020
# Generated by xtables-save v1.8.2 on Sat May 2 10:00:54 2020
*nat
:PREROUTING DROP [0:0]
:INPUT DROP [0:0]
:POSTROUTING DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o tun+ -j MASQUERADE
-A POSTROUTING -o wlp2s0 -j MASQUERADE
COMMIT
# Completed on Sat May 2 10:00:54 2020
# Generated by xtables-save v1.8.2 on Sat May 2 10:00:54 2020
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP: [0:0]
:TCP - [0:0]
:UDP - [0:0]
:ICMP DROP [0:0]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-forward - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
#-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j DROP
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -j DROP
-A INPUT -j DROP
-A INPUT -j DROP
-A INPUT -i lo -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A INPUT -p icmp -j DROP
#-A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
#-A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
-A INPUT -p icmp -j DROP
-A INPUT -p tcp -m tcp --dport 80 -j DROP
-A INPUT -p tcp -m tcp --dport 443 -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --dport 113 -j DROP
-A INPUT -p udp -m udp -j DROP
-A INPUT -p tcp -m tcp -j DROP
-A INPUT -j DROP
-A INPUT -j DROP
-A INPUT -j DROP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -j DROP
-A INPUT -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
#-A FORWARD -p icmp -m icmp --icmp-type 8 -j DROP
-A FORWARD -p tcp -m string --string "apollo.archlinux.org" --algo kmp --to 65535 -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A OUTPUT -j ACCEPT
-A OUTPUT -o lo -j DROP
-A OUTPUT -p icmp -j DROP
#-A OUTPUT -p icmp -m icmp --icmp-type 8 -j DROP
#-A OUTPUT -p icmp -m icmp --icmp-type 8 -j DROP
-A OUTPUT -p icmp -j DROP
#-A OUTPUT -s 167.99.198.217/32 -j DROP
#-A OUTPUT -s 167.99.198.217/32 -j DROP
#-A OUTPUT -s 163.53.140.136/32 -j DROP
#-A OUTPUT -s 151.101.0.201/32 -j DROP
#-A OUTPUT -s 180.211.201.0/24 -p tcp -m tcp --dport 25 -j DROP
-A OUTPUT -p tcp -m string --string "apollo.archlinux.org" --algo kmp --to 65535 -j DROP
-A OUTPUT
-A OUTPUT -j DROP
-A OUTPUT -j DROP
-A OUTPUT -j DROP
-A OUTPUT -j DROP
-A ufw-after-logging-forward -m limit --limit 1/sec --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-after-logging-input -m limit --limit 1/sec --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-logging-allow -m limit --limit 1/sec --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
-A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
-A ufw-logging-deny -m limit --limit 1/sec --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-user-input -p tcp -m tcp --dport 48898 -j DROP
-A ufw-user-input -p tcp -m tcp --dport 4101 -j DROP
-A ufw-user-input -p udp -m udp --dport 4101 -j DROP
-A ufw-user-input -p tcp -m tcp --dport 443 -j DROP
-A ufw-user-input -p udp -m udp --dport 443 -j DROP
-A ufw-user-limit -m limit --limit 1/sec -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-output -p tcp -m tcp --dport 48898 -j DROP
-A ufw-user-output -p tcp -m tcp --dport 4101 -j DROP
-A ufw-user-output -p udp -m udp --dport 4101 -j DROP
-A ufw-user-output -p tcp -m tcp --dport 443 -j DROP
-A ufw-user-output -p udp -m udp --dport 443 -j DROP
COMMIT
# Completed on Sat May 2 10:00:54 2020