http://cocnm.computerisms.ca/index.php?action=history&feed=atom&title=%2Froot%2Fscripts%2Fiptables-restore 2026-11-14T11:55:08Z Revision history for this page on the wiki MediaWiki 1.41.0 http://cocnm.computerisms.ca/index.php?title=/root/scripts/iptables-restore&diff=422&oldid=prev 2014-08-30T21:58:50Z

<p><span dir="auto"><span class="autocomment">Completed</span></span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 21:58, 30 August 2014</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l83">Line 83:</td> <td colspan="2" class="diff-lineno">Line 83:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A POSTROUTING -m conntrack --ctstate INVALID -j DROP</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A POSTROUTING -m conntrack --ctstate INVALID -j DROP</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A POSTROUTING -j ACCOUNT --addr 0/0 --tname wan</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A POSTROUTING -j ACCOUNT --addr 0/0 --tname wan</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">-A FORWARD -j ACCOUNT --addr 192.168.26.0/24 --tname computerisms</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">-A FORWARD -j ACCOUNT --addr 192.168.27.0/24 --tname pubaccess</ins></div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 25 -j MARK --set-xmark 0x1/0xffffffff  </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 25 -j MARK --set-xmark 0x1/0xffffffff  </div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x1/0xffffffff  </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x1/0xffffffff  </div></td></tr> <tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l119">Line 119:</td> <td colspan="2" class="diff-lineno">Line 121:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A INPUT -j LOG --log-prefix INPUT</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A INPUT -j LOG --log-prefix INPUT</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A INPUT -j DROP</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A INPUT -j DROP</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">-A FORWARD -j ACCOUNT --addr 192.168.26.0/24 --tname computerisms</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">-A FORWARD -j ACCOUNT --addr 192.168.27.0/24 --tname pubaccess</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A FORWARD -m mark --mark 0x1 -j ACCEPT  </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A FORWARD -m mark --mark 0x1 -j ACCEPT  </div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT</div></td></tr> </table>

Bob http://cocnm.computerisms.ca/index.php?title=/root/scripts/iptables-restore&diff=97&oldid=prev 2013-09-19T06:19:54Z

<p>1 revision</p> <p><b>New page</b></p><div>==Basic==<br /> &lt;pre&gt;<br /> *nat<br /> :PREROUTING ACCEPT [0:0]<br /> :INPUT ACCEPT [0:0]<br /> :OUTPUT ACCEPT [0:0]<br /> :POSTROUTING ACCEPT [0:0]<br /> -A POSTROUTING -s 192.168.26.0/24 -o eth0 -j SNAT --to-source 192.168.25.15<br /> COMMIT<br /> *mangle<br /> :PREROUTING ACCEPT [0:0]<br /> :INPUT ACCEPT [0:0]<br /> :FORWARD ACCEPT [0:0]<br /> :OUTPUT ACCEPT [0:0]<br /> :POSTROUTING ACCEPT [0:0]<br /> -A POSTROUTING -m conntrack --ctstate INVALID -j DROP<br /> COMMIT<br /> *raw<br /> :PREROUTING ACCEPT [0:0]<br /> :OUTPUT ACCEPT [0:0]<br /> COMMIT<br /> *filter<br /> :INPUT DROP [0:0]<br /> :FORWARD DROP [0:0]<br /> :OUTPUT DROP [0:0]<br /> -A INPUT -i lo -j ACCEPT<br /> -A INPUT -s 127.0.0.0/8 ! -i lo -j LOG --log-prefix INPUTlo<br /> -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP<br /> -A INPUT -d 255.255.255.255/32 -j ACCEPT<br /> -A INPUT -d 224.0.0.0/4 -i eth1 ! -p tcp -j ACCEPT<br /> -A INPUT -d 192.168.25.15/32 -i eth0 -j ACCEPT<br /> -A INPUT -d 192.168.25.255/32 -i eth0 -j ACCEPT<br /> -A INPUT -s 192.168.26.0/24 -i eth1 -j ACCEPT<br /> -A INPUT -s 192.168.26.0/24 ! -i eth1 -j LOG --log-prefix INPUT1<br /> -A INPUT -s 192.168.26.0/24 ! -i eth1 -j DROP<br /> -A INPUT -j LOG --log-prefix INPUT<br /> -A INPUT -j DROP<br /> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT<br /> -A FORWARD -s 192.168.26.0/24 -i eth1 -o eth0 -j ACCEPT<br /> -A FORWARD -j LOG --log-prefix FORWARD<br /> -A FORWARD -j DROP<br /> -A OUTPUT -o lo -j ACCEPT<br /> -A OUTPUT -d 127.0.0.0/8 ! -o lo -j LOG --log-prefix OUTPUTlo<br /> -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP<br /> -A OUTPUT -d 255.255.255.255/32 -j ACCEPT<br /> -A OUTPUT -d 224.0.0.0/4 -o eth1 ! -p tcp -j ACCEPT<br /> -A OUTPUT -d 224.0.0.0/4 -o eth2 ! -p tcp -j ACCEPT<br /> -A OUTPUT -s 192.168.25.15/32 -o eth0 -j ACCEPT<br /> -A OUTPUT -s 192.168.25.255/32 -o eth0 -j ACCEPT<br /> -A OUTPUT -d 192.168.26.0/24 -o eth1 -j ACCEPT<br /> -A OUTPUT -d 192.168.26.0/24 ! -o eth1 -j LOG --log-prefix OUTPUT1<br /> -A OUTPUT -d 192.168.26.0/24 ! -o eth1 -j DROP<br /> -A OUTPUT -j LOG --log-prefix OUTPUT<br /> -A OUTPUT -j DROP<br /> COMMIT<br /> &lt;/pre&gt;<br /> <br /> ==Completed==<br /> &lt;pre&gt;<br /> # Generated by iptables-save v1.4.20 on Thu Aug 29 20:35:34 2013<br /> *nat<br /> :PREROUTING ACCEPT [16208:2924135]<br /> :INPUT ACCEPT [12634:2681037]<br /> :OUTPUT ACCEPT [5147:372035]<br /> :POSTROUTING ACCEPT [5147:372035]<br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.26.10:25 <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.26.10:80 <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.26.10:443<br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 587 -j DNAT --to-destination 192.168.26.10:587<br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 993 -j DNAT --to-destination 192.168.26.10:993 <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 995 -j DNAT --to-destination 192.168.26.10:995<br /> -A POSTROUTING ! -d 10.25.0.0/24 -s 192.168.26.0/24 -o eth0 -j SNAT --to-source 192.168.25.15<br /> -A POSTROUTING -s 192.168.27.0/24 -o eth0 -j SNAT --to-source 192.168.25.15<br /> COMMIT<br /> # Completed on Thu Aug 29 20:35:34 2013<br /> # Generated by iptables-save v1.4.20 on Thu Aug 29 20:35:34 2013<br /> *mangle<br /> :PREROUTING ACCEPT [154883:126645061]<br /> :INPUT ACCEPT [133756:117641671]<br /> :FORWARD ACCEPT [20465:8966111]<br /> :OUTPUT ACCEPT [86452:6816891]<br /> :POSTROUTING ACCEPT [106905:15782402]<br /> -A POSTROUTING -m conntrack --ctstate INVALID -j DROP<br /> -A POSTROUTING -j ACCOUNT --addr 0/0 --tname wan<br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 25 -j MARK --set-xmark 0x1/0xffffffff <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x1/0xffffffff <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 443 -j MARK --set-xmark 0x1/0xffffffff<br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 587 -j MARK --set-xmark 0x1/0xffffffff <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 993 -j MARK --set-xmark 0x1/0xffffffff <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 995 -j MARK --set-xmark 0x1/0xffffffff <br /> COMMIT<br /> # Completed on Thu Aug 29 20:35:34 2013<br /> # Generated by iptables-save v1.4.20 on Thu Aug 29 20:35:34 2013<br /> *raw<br /> :PREROUTING ACCEPT [154883:126645061]<br /> :OUTPUT ACCEPT [86452:6816891]<br /> COMMIT<br /> # Completed on Thu Aug 29 20:35:34 2013<br /> # Generated by iptables-save v1.4.20 on Thu Aug 29 20:35:34 2013<br /> *filter<br /> :INPUT DROP [0:0]<br /> :FORWARD DROP [0:0]<br /> :OUTPUT DROP [0:0]<br /> -A INPUT -m mark --mark 0x1 -j ACCEPT <br /> -A INPUT -i lo -j ACCEPT<br /> -A INPUT -s 127.0.0.0/8 ! -i lo -j LOG --log-prefix INPUTlo<br /> -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP<br /> -A INPUT -d 255.255.255.255/32 -j ACCEPT<br /> -A INPUT -d 224.0.0.0/4 -i eth1 ! -p tcp -j ACCEPT<br /> -A INPUT -d 224.0.0.0/4 -i eth2 ! -p tcp -j ACCEPT<br /> -A INPUT -d 192.168.25.15/32 -i eth0 -j ACCEPT<br /> -A INPUT -d 192.168.25.255/32 -i eth0 -j ACCEPT<br /> -A INPUT -s 192.168.26.0/24 -i eth1 -j ACCEPT<br /> -A INPUT -s 192.168.26.0/24 ! -i eth1 -j LOG --log-prefix INPUT1<br /> -A INPUT -s 192.168.26.0/24 ! -i eth1 -j DROP<br /> -A INPUT -s 192.168.27.0/24 -i eth2 -j ACCEPT<br /> -A INPUT -s 192.168.27.0/24 ! -i eth2 -j LOG --log-prefix INPUT2<br /> -A INPUT -s 192.168.27.0/24 ! -i eth2 -j DROP<br /> -A INPUT -j LOG --log-prefix INPUT<br /> -A INPUT -j DROP<br /> -A FORWARD -j ACCOUNT --addr 192.168.26.0/24 --tname computerisms<br /> -A FORWARD -j ACCOUNT --addr 192.168.27.0/24 --tname pubaccess<br /> -A FORWARD -m mark --mark 0x1 -j ACCEPT <br /> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT<br /> -A FORWARD -s 192.168.26.0/24 -d 192.168.27.0/24 -j LOG --log-prefix FORWARD1<br /> -A FORWARD -s 192.168.26.0/24 -d 192.168.27.0/24 -j DROP<br /> -A FORWARD -s 192.168.27.0/24 -d 192.168.26.0/24 -j LOG --log-prefix FORWARD2<br /> -A FORWARD -s 192.168.27.0/24 -d 192.168.26.0/24 -j DROP<br /> -A FORWARD -s 192.168.26.0/24 -d 10.25.0.0/24 -j ACCEPT<br /> -A FORWARD -d 192.168.26.0/24 -s 10.25.0.0/24 -j ACCEPT<br /> -A FORWARD -s 192.168.26.0/24 -i eth1 -o eth0 -j ACCEPT<br /> -A FORWARD -s 192.168.27.0/24 -i eth2 -o eth0 -j ACCEPT<br /> -A FORWARD -j LOG --log-prefix FORWARD<br /> -A FORWARD -j DROP<br /> -A OUTPUT -o lo -j ACCEPT<br /> -A OUTPUT -d 127.0.0.0/8 ! -o lo -j LOG --log-prefix OUTPUTlo<br /> -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP<br /> -A OUTPUT -d 255.255.255.255/32 -j ACCEPT<br /> -A OUTPUT -d 224.0.0.0/4 -o eth1 ! -p tcp -j ACCEPT<br /> -A OUTPUT -d 224.0.0.0/4 -o eth2 ! -p tcp -j ACCEPT<br /> -A OUTPUT -s 192.168.25.15/32 -o eth0 -j ACCEPT<br /> -A OUTPUT -s 192.168.25.255/32 -o eth0 -j ACCEPT<br /> -A OUTPUT -d 192.168.26.0/24 -o eth1 -j ACCEPT<br /> -A OUTPUT -d 192.168.26.0/24 ! -o eth1 -j LOG --log-prefix OUTPUT1<br /> -A OUTPUT -d 192.168.26.0/24 ! -o eth1 -j DROP<br /> -A OUTPUT -d 192.168.27.0/24 -o eth2 -j ACCEPT<br /> -A OUTPUT -d 192.168.27.0/24 ! -o eth2 -j LOG --log-prefix OUTPUT2<br /> -A OUTPUT -d 192.168.27.0/24 ! -o eth2 -j DROP<br /> -A OUTPUT -j LOG --log-prefix OUTPUT<br /> -A OUTPUT -j DROP<br /> COMMIT<br /> # Completed on Thu Aug 29 20:35:34 2013<br /> &lt;/pre&gt;</div>

Bob