*filter
:LOGDROP_ILLEGAL_PACKET - [0:0]
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j LOGDROP_ILLEGAL_PACKET
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j LOGDROP_ILLEGAL_PACKET
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j LOGDROP_ILLEGAL_PACKET
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOGDROP_ILLEGAL_PACKET
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LOGDROP_ILLEGAL_PACKET
-A INPUT -p tcp -m tcp --tcp-flags FIN,ACK FIN -j LOGDROP_ILLEGAL_PACKET
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j LOGDROP_ILLEGAL_PACKET
-A LOGDROP_ILLEGAL_PACKET -m limit --limit 2/sec -j LOG --log-prefix "IPTFW-bad-flag " --log-level 7
-A LOGDROP_ILLEGAL_PACKET -j DROP
:FORWARD ACCEPT [0:0]
:INPUT DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED,UNTRACKED -j ACCEPT
-A INPUT -s 172.16.0.0/12 -j LOGDROP_ILLEGAL_PACKET
-A INPUT -s 169.254.0.0/16 -j LOGDROP_ILLEGAL_PACKET
-A INPUT -s 210.14.0.0/16 -j ACCEPT
-A INPUT -s 192.168.0.0/16 -j ACCEPT
-A INPUT -s 124.193.179.238/32 -j ACCEPT
-A INPUT -s 10.0.0.0/8 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3222 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 7140 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 112 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 4505 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 4506 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 5/sec -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -m limit --limit 5/sec -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -m limit --limit 5/sec -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -m limit --limit 5/sec -j ACCEPT
-A INPUT -p vrrp -j ACCEPT
-A INPUT -p icmp -j DROP
-A INPUT -i lo -j ACCEPT
:OUTPUT DROP [0:0]
-A OUTPUT -s 210.14.0.0/16 -j ACCEPT
-A OUTPUT -s 192.168.0.0/16 -j ACCEPT
-A OUTPUT -s 124.193.179.238/32 -j ACCEPT
-A OUTPUT -s 10.0.0.0/8 -j ACCEPT
-A OUTPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 3222 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 7140 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 112 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 4505 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 4506 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 5/sec -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 0 -m limit --limit 5/sec -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 11 -m limit --limit 5/sec -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 3 -m limit --limit 5/sec -j ACCEPT
-A OUTPUT -p vrrp -j ACCEPT
-A OUTPUT -p icmp -j DROP
-A OUTPUT -o lo -j ACCEPT
COMMIT
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 80 -j NOTRACK
-A OUTPUT -p tcp -m tcp --sport 80 -j NOTRACK
-A PREROUTING -p tcp -m tcp --dport 443 -j NOTRACK
-A OUTPUT -p tcp -m tcp --sport 443 -j NOTRACK
COMMIT
阅读(2652) | 评论(0) | 转发(0) |
