Tag: Open Source

Database

Drizzle – Lightweight DB Based on MySQL

Brain Acker, director of architecture for MySQL has opened the door to Drizzle, a light-weight, high-concurrency database server based on MySQL, targeted at web applications.

The architectural ideas as described in the FAQ:

A micro-kernel that we then extend to add what we need (all additions come through interfaces that can be compiled/loaded in as needed). The target for the project is web infrastructure backend and cloud components.

The FAQ goes on explain the differences between Drizzle and MySQL which include:

No modes, views, triggers, prepared statements, stored procedures, query cache, data conversion inserts, ACL. Fewer data types.  Less engines, less code. Assume the primary engine is transactional.

Michael Widenius, founder and original MySQL developer, explains more about Drizzle in this blog post, including the most interesting piece (to me) – that Drizzle will always contain the most up-to-date InnoDB code, meaning you don’t need to wait around for MySQL 6 or download the plugins from Oracle each year to get the latest and greatest.

While Drizzle is still in development you can check out the code and try it out. Or maybe even get involved and help out. More information on how to do both is available on the wiki.

Hardware

Sun opens UltraSPARC T2

Sun announced their entrance into the commodity silicon business with the UltraSPARC T2 (or Niagara 2), which is their fastest processor to date, delivering 89.6 Ghz of parallel computing on a single chip. They have signed their first OEM agreement with Marvell, and more are sure to follow.

In a surprising move, Sun will be releasing the blueprints and core design files and test suites for the T2 under the GPL.

Technorati Tags: , ,

Community

Petition for Linux Users

Bryan Peters at showusthecode.com has put out a petition for users of Linux to add their voice to the Open Letter to Steve Ballmer to show the code where Linux infringes on Microsoft’s intellectual property. It would seem to be the only strategy left to MS at this point, is to prove that there is some basis for their threats of lawsuit against distributors of Linux for IP infringement, or to apologize tactfully and say “We made a mistake.”

Technorati Tags:

Java

Sun Releases Java under GPL

Found this over at InfoQ:

Sun today is releasing Java SE, ME and Glassfish under . This is in combination with an early release of the SE 7 Hotspot JVM, javac compiler and JavaHelp.

Sun has more information about the Java open-source project, as well as a press center.

Read More

IDE

Tabbed Python editing with PythonCard

While I have been partial to IDLE for developing Python I recently came across on SourceForge while looking for some help building a Python GUI. While PythonCard has plenty of tools and examples to help with GUI construction, it was the Tabbed Code Editor that really got my attention.

One thing that I look for in any development environment is the ability to open mutiple files in tabs. While IDLE is extremely useable, it lacks this feature. And yes, there are other tabbed IDE’s that can parse Python syntax, but none of them seem to do as good of a job as IDLE.

While I can’t claim that the PythonCard tabbed editor is as good IDLE in terms of hinting and code completion, (at least as far as Python builtins) it does a rather decent job of that for objects/scripts that are imported.

While I may or may not end up actually building Python GUIs with it, PythonCard has definitely found a permanent place in my toolbox.

Open Source

Simpler iptables firewalls with firehol

As everyone knows, security depends on defense-in-depth. (And if you didn’t before, you do now!) The idea being that defense should take place in layers, from the edge of the network to the heart of the system. That’s why we have firewalls, anti-virus, intrusion detection, anti-spam and kernel and compiler hardening mechanisms. But just because you have a firewall at the edge of the network doesn’t mean you can skip the host-based firewall.

The most common Linux host-based firewall is probably iptables. Unfortunately, iptables can be incredibly complex to configure correctly. There are lots of tools to help with this. My favorite has to be firehol. Both from an ease of use standpoint, and from a “don’t kill me while I’m testing” sort of operation. If you are not careful while editing iptables rules it is actually fairly easy to lock yourself out.

Say you are remote in your server via ssh. You edit your iptables firewall rules and disable shh port 22 by placing a comment marker in the wrong line. You HUP the firewall and BANG you’re locked out. The way firehol gets around this is to generate a rule to accept all ESTABLISHED and RELATED connections. So you’re connected via ssh, change the firehol configs, restart the service and you are still connected. Now you start another shell and try to log in and when you find that you can’t you can return to the open connection, fix the error and restart, and so on.

In the interest of showing how firehol works, here is a sample firehol.conf and the generated iptables firewall rules that it created.

interface eth0 internal src "192.168.1.0/24" dst 192.168.1.10/32
  	policy drop
  	server ICMP accept
  	server dns accept
  	server ftp accept
  	server ident accept
  	server microsoft_ds accept
  	server mysql accept
  	server samba accept
  	server time accept
  	server ssh accept
  	server http accept
  	server https accept
  	server ntp accept
  	server vnc accept
  	server webmin accept
  	server smtp accept
  	server pop3 accept
  	client all accept
  interface eth0 outside src not "${UNROUTABLE_IPS} 192.168.1.0/24" dst 192.168.1.10/32
  	policy drop
  	server ICMP accept
  	server dns accept
  	server ftp accept
  	server http accept
  	server https accept
  	server ntp accept
  	server smtp accept
  	server pop3 accept
  	client all accept
  interface lo loopback src "127.0.0.0/8" dst "127.0.0.0/8 192.168.1.10/32"
  	policy accept

Generated rules:

# Generated by iptables-save v1.2.11 on Wed Dec  7 14:49:09 2005
 *mangle
 :PREROUTING ACCEPT [7340:1260938]
 :INPUT ACCEPT [7296:1245746]
 :FORWARD ACCEPT [0:0]
 :OUTPUT ACCEPT [7454:4772446]
 :POSTROUTING ACCEPT [7468:4775764]
 COMMIT
 # Completed on Wed Dec  7 14:49:09 2005
 # Generated by iptables-save v1.2.11 on Wed Dec  7 14:49:09 2005
 *nat
 :PREROUTING ACCEPT [340:49114]
 :POSTROUTING ACCEPT [19:2454]
 :OUTPUT ACCEPT [19:2454]
 COMMIT
 # Completed on Wed Dec  7 14:49:09 2005
 # Generated by iptables-save v1.2.11 on Wed Dec  7 14:49:09 2005
 *filter
 :INPUT DROP [0:0]
 :FORWARD DROP [0:0]
 :OUTPUT DROP [0:0]
 :in_internal - [0:0]
 :in_internal_ICMP_s1 - [0:0]
 :in_internal_all_c14 - [0:0]
 :in_internal_dns_s2 - [0:0]
 :in_internal_ftp_c16 - [0:0]
 :in_internal_ftp_s3 - [0:0]
 :in_internal_http_s10 - [0:0]
 :in_internal_https_s11 - [0:0]
 :in_internal_ident_s4 - [0:0]
 :in_internal_irc_c15 - [0:0]
 :in_internal_microsoft_ds_s5 - [0:0]
 :in_internal_mysql_s6 - [0:0]
 :in_internal_ntp_s12 - [0:0]
 :in_internal_samba_s7 - [0:0]
 :in_internal_ssh_s9 - [0:0]
 :in_internal_time_s8 - [0:0]
 :in_internal_webmin_s13 - [0:0]
 :in_loopback - [0:0]
 :in_outside - [0:0]
 :in_outside_ICMP_s1 - [0:0]
 :in_outside_all_c9 - [0:0]
 :in_outside_dns_s2 - [0:0]
 :in_outside_ftp_c11 - [0:0]
 :in_outside_ftp_s3 - [0:0]
 :in_outside_http_s4 - [0:0]
 :in_outside_https_s5 - [0:0]
 :in_outside_irc_c10 - [0:0]
 :in_outside_ntp_s6 - [0:0]
 :in_outside_ssh_s7 - [0:0]
 :in_outside_webmin_s8 - [0:0]
 :out_internal - [0:0]
 :out_internal_ICMP_s1 - [0:0]
 :out_internal_all_c14 - [0:0]
 :out_internal_dns_s2 - [0:0]
 :out_internal_ftp_c16 - [0:0]
 :out_internal_ftp_s3 - [0:0]
 :out_internal_http_s10 - [0:0]
 :out_internal_https_s11 - [0:0]
 :out_internal_ident_s4 - [0:0]
 :out_internal_irc_c15 - [0:0]
 :out_internal_microsoft_ds_s5 - [0:0]
 :out_internal_mysql_s6 - [0:0]
 :out_internal_ntp_s12 - [0:0]
 :out_internal_samba_s7 - [0:0]
 :out_internal_ssh_s9 - [0:0]
 :out_internal_time_s8 - [0:0]
 :out_internal_webmin_s13 - [0:0]
 :out_loopback - [0:0]
 :out_outside - [0:0]
 :out_outside_ICMP_s1 - [0:0]
 :out_outside_all_c9 - [0:0]
 :out_outside_dns_s2 - [0:0]
 :out_outside_ftp_c11 - [0:0]
 :out_outside_ftp_s3 - [0:0]
 :out_outside_http_s4 - [0:0]
 :out_outside_https_s5 - [0:0]
 :out_outside_irc_c10 - [0:0]
 :out_outside_ntp_s6 - [0:0]
 :out_outside_ssh_s7 - [0:0]
 :out_outside_webmin_s8 - [0:0]
 -A INPUT -i lo -j ACCEPT
 -A INPUT -s 192.168.1.0/255.255.255.0 -d 192.168.1.10 -i eth0 -j in_internal
 -A INPUT -d 192.168.1.10 -i eth0 -j in_outside
 -A INPUT -s 127.0.0.0/255.0.0.0 -d 127.0.0.0/255.0.0.0 -i lo -j in_loopback
 -A INPUT -s 127.0.0.0/255.0.0.0 -d 192.168.1.10 -i lo -j in_loopback
 -A INPUT -m state --state RELATED -j ACCEPT
 -A INPUT -m limit --limit 1/sec -j LOG --log-prefix "IN-unknown:"
 -A INPUT -j DROP
 -A FORWARD -m state --state RELATED -j ACCEPT
 -A FORWARD -m limit --limit 1/sec -j LOG --log-prefix "PASS-unknown:"
 -A FORWARD -j DROP
 -A OUTPUT -o lo -j ACCEPT
 -A OUTPUT -s 192.168.1.10 -d 192.168.1.0/255.255.255.0 -o eth0 -j out_internal
 -A OUTPUT -s 192.168.1.10 -o eth0 -j out_outside
 -A OUTPUT -s 127.0.0.0/255.0.0.0 -d 127.0.0.0/255.0.0.0 -o lo -j out_loopback
 -A OUTPUT -s 192.168.1.10 -d 127.0.0.0/255.0.0.0 -o lo -j out_loopback
 -A OUTPUT -m state --state RELATED -j ACCEPT
 -A OUTPUT -m limit --limit 1/sec -j LOG --log-prefix "OUT-unknown:"
 -A OUTPUT -j DROP
 -A in_internal -j in_internal_ICMP_s1
 -A in_internal -j in_internal_dns_s2
 -A in_internal -j in_internal_ftp_s3
 -A in_internal -j in_internal_ident_s4
 -A in_internal -j in_internal_microsoft_ds_s5
 -A in_internal -j in_internal_mysql_s6
 -A in_internal -j in_internal_samba_s7
 -A in_internal -j in_internal_time_s8
 -A in_internal -j in_internal_ssh_s9
 -A in_internal -j in_internal_http_s10
 -A in_internal -j in_internal_https_s11
 -A in_internal -j in_internal_ntp_s12
 -A in_internal -j in_internal_webmin_s13
 -A in_internal -j in_internal_all_c14
 -A in_internal -j in_internal_irc_c15
 -A in_internal -j in_internal_ftp_c16
 -A in_internal -m state --state RELATED -j ACCEPT
 -A in_internal -m limit --limit 1/sec -j LOG --log-prefix "IN-internal:"
 -A in_internal -j DROP
 -A in_internal_ICMP_s1 -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_all_c14 -m state --state ESTABLISHED -j ACCEPT
 -A in_internal_dns_s2 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_dns_s2 -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ftp_c16 -p tcp -m tcp --sport 21 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_internal_ftp_c16 -p tcp -m tcp --sport 20 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A in_internal_ftp_c16 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_internal_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT
 -A in_internal_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A in_internal_http_s10 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_https_s11 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ident_s4 -p tcp -m tcp --sport 1024:65535 --dport 113 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_irc_c15 -p tcp -m tcp --sport 6667 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_internal_microsoft_ds_s5 -p tcp -m tcp --sport 1024:65535 --dport 445 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_mysql_s6 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ntp_s12 -p udp -m udp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ntp_s12 -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ntp_s12 -p tcp -m tcp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ntp_s12 -p tcp -m tcp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p udp -m udp --sport 137 --dport 137 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p udp -m udp --sport 1024:65535 --dport 137 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p udp -m udp --sport 138 --dport 138 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p udp -m udp --sport 1024:65535 --dport 138 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p tcp -m tcp --sport 1024:65535 --dport 139 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p tcp -m tcp --sport 1024:65535 --dport 445 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ssh_s9 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_time_s8 -p tcp -m tcp --sport 1024:65535 --dport 37 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_time_s8 -p udp -m udp --sport 1024:65535 --dport 37 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_webmin_s13 -p tcp -m tcp --sport 1024:65535 --dport 10000 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_loopback -m state --state RELATED -j ACCEPT
 -A in_loopback -j ACCEPT
 -A in_outside -s 0.0.0.0/254.0.0.0 -j RETURN
 -A in_outside -s 2.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 5.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 7.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 23.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 27.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 31.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 36.0.0.0/254.0.0.0 -j RETURN
 -A in_outside -s 39.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 41.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 42.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 73.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 74.0.0.0/254.0.0.0 -j RETURN
 -A in_outside -s 76.0.0.0/252.0.0.0 -j RETURN
 -A in_outside -s 89.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 90.0.0.0/254.0.0.0 -j RETURN
 -A in_outside -s 92.0.0.0/252.0.0.0 -j RETURN
 -A in_outside -s 96.0.0.0/224.0.0.0 -j RETURN
 -A in_outside -s 173.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 174.0.0.0/254.0.0.0 -j RETURN
 -A in_outside -s 176.0.0.0/248.0.0.0 -j RETURN
 -A in_outside -s 184.0.0.0/252.0.0.0 -j RETURN
 -A in_outside -s 189.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 190.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 197.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 223.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 240.0.0.0/240.0.0.0 -j RETURN
 -A in_outside -s 10.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 169.254.0.0/255.255.0.0 -j RETURN
 -A in_outside -s 172.16.0.0/255.240.0.0 -j RETURN
 -A in_outside -s 192.0.2.0/255.255.255.0 -j RETURN
 -A in_outside -s 192.88.99.0/255.255.255.0 -j RETURN
 -A in_outside -s 192.168.0.0/255.255.0.0 -j RETURN
 -A in_outside -s 192.168.1.0/255.255.255.0 -j RETURN
 -A in_outside -j in_outside_ICMP_s1
 -A in_outside -j in_outside_dns_s2
 -A in_outside -j in_outside_ftp_s3
 -A in_outside -j in_outside_http_s4
 -A in_outside -j in_outside_https_s5
 -A in_outside -j in_outside_ntp_s6
 -A in_outside -j in_outside_ssh_s7
 -A in_outside -j in_outside_webmin_s8
 -A in_outside -j in_outside_all_c9
 -A in_outside -j in_outside_irc_c10
 -A in_outside -j in_outside_ftp_c11
 -A in_outside -m state --state RELATED -j ACCEPT
 -A in_outside -m limit --limit 1/sec -j LOG --log-prefix "IN-outside:"
 -A in_outside -j DROP
 -A in_outside_ICMP_s1 -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_all_c9 -m state --state ESTABLISHED -j ACCEPT
 -A in_outside_dns_s2 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_dns_s2 -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ftp_c11 -p tcp -m tcp --sport 21 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_outside_ftp_c11 -p tcp -m tcp --sport 20 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A in_outside_ftp_c11 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_outside_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT
 -A in_outside_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A in_outside_http_s4 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_https_s5 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_irc_c10 -p tcp -m tcp --sport 6667 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_outside_ntp_s6 -p udp -m udp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ntp_s6 -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ntp_s6 -p tcp -m tcp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ntp_s6 -p tcp -m tcp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ssh_s7 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_webmin_s8 -p tcp -m tcp --sport 1024:65535 --dport 10000 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal -j out_internal_ICMP_s1
 -A out_internal -j out_internal_dns_s2
 -A out_internal -j out_internal_ftp_s3
 -A out_internal -j out_internal_ident_s4
 -A out_internal -j out_internal_microsoft_ds_s5
 -A out_internal -j out_internal_mysql_s6
 -A out_internal -j out_internal_samba_s7
 -A out_internal -j out_internal_time_s8
 -A out_internal -j out_internal_ssh_s9
 -A out_internal -j out_internal_http_s10
 -A out_internal -j out_internal_https_s11
 -A out_internal -j out_internal_ntp_s12
 -A out_internal -j out_internal_webmin_s13
 -A out_internal -j out_internal_all_c14
 -A out_internal -j out_internal_irc_c15
 -A out_internal -j out_internal_ftp_c16
 -A out_internal -m state --state RELATED -j ACCEPT
 -A out_internal -m limit --limit 1/sec -j LOG --log-prefix "OUT-internal:"
 -A out_internal -j DROP
 -A out_internal_ICMP_s1 -p icmp -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_all_c14 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal_dns_s2 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_dns_s2 -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ftp_c16 -p tcp -m tcp --sport 1024:4999 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal_ftp_c16 -p tcp -m tcp --sport 1024:4999 --dport 20 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ftp_c16 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A out_internal_ftp_s3 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ftp_s3 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A out_internal_ftp_s3 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_http_s10 -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_https_s11 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ident_s4 -p tcp -m tcp --sport 113 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_irc_c15 -p tcp -m tcp --sport 1024:4999 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal_microsoft_ds_s5 -p tcp -m tcp --sport 445 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_mysql_s6 -p tcp -m tcp --sport 3306 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ntp_s12 -p udp -m udp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ntp_s12 -p udp -m udp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ntp_s12 -p tcp -m tcp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ntp_s12 -p tcp -m tcp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p udp -m udp --sport 137 --dport 137 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p udp -m udp --sport 137 --dport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p udp -m udp --sport 138 --dport 138 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p udp -m udp --sport 138 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p tcp -m tcp --sport 139 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p tcp -m tcp --sport 445 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ssh_s9 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_time_s8 -p tcp -m tcp --sport 37 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_time_s8 -p udp -m udp --sport 37 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_webmin_s13 -p tcp -m tcp --sport 10000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_loopback -m state --state RELATED -j ACCEPT
 -A out_loopback -j ACCEPT
 -A out_outside -d 0.0.0.0/254.0.0.0 -j RETURN
 -A out_outside -d 2.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 5.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 7.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 23.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 27.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 31.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 36.0.0.0/254.0.0.0 -j RETURN
 -A out_outside -d 39.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 41.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 42.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 73.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 74.0.0.0/254.0.0.0 -j RETURN
 -A out_outside -d 76.0.0.0/252.0.0.0 -j RETURN
 -A out_outside -d 89.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 90.0.0.0/254.0.0.0 -j RETURN
 -A out_outside -d 92.0.0.0/252.0.0.0 -j RETURN
 -A out_outside -d 96.0.0.0/224.0.0.0 -j RETURN
 -A out_outside -d 173.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 174.0.0.0/254.0.0.0 -j RETURN
 -A out_outside -d 176.0.0.0/248.0.0.0 -j RETURN
 -A out_outside -d 184.0.0.0/252.0.0.0 -j RETURN
 -A out_outside -d 189.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 190.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 197.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 223.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 240.0.0.0/240.0.0.0 -j RETURN
 -A out_outside -d 10.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 169.254.0.0/255.255.0.0 -j RETURN
 -A out_outside -d 172.16.0.0/255.240.0.0 -j RETURN
 -A out_outside -d 192.0.2.0/255.255.255.0 -j RETURN
 -A out_outside -d 192.88.99.0/255.255.255.0 -j RETURN
 -A out_outside -d 192.168.0.0/255.255.0.0 -j RETURN
 -A out_outside -d 192.168.1.0/255.255.255.0 -j RETURN
 -A out_outside -j out_outside_ICMP_s1
 -A out_outside -j out_outside_dns_s2
 -A out_outside -j out_outside_ftp_s3
 -A out_outside -j out_outside_http_s4
 -A out_outside -j out_outside_https_s5
 -A out_outside -j out_outside_ntp_s6
 -A out_outside -j out_outside_ssh_s7
 -A out_outside -j out_outside_webmin_s8
 -A out_outside -j out_outside_all_c9
 -A out_outside -j out_outside_irc_c10
 -A out_outside -j out_outside_ftp_c11
 -A out_outside -m state --state RELATED -j ACCEPT
 -A out_outside -m limit --limit 1/sec -j LOG --log-prefix "OUT-outside:"
 -A out_outside -j DROP
 -A out_outside_ICMP_s1 -p icmp -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_all_c9 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_outside_dns_s2 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_dns_s2 -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ftp_c11 -p tcp -m tcp --sport 1024:4999 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_outside_ftp_c11 -p tcp -m tcp --sport 1024:4999 --dport 20 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ftp_c11 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A out_outside_ftp_s3 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ftp_s3 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A out_outside_ftp_s3 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_http_s4 -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_https_s5 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_irc_c10 -p tcp -m tcp --sport 1024:4999 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_outside_ntp_s6 -p udp -m udp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ntp_s6 -p udp -m udp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ntp_s6 -p tcp -m tcp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ntp_s6 -p tcp -m tcp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ssh_s7 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_webmin_s8 -p tcp -m tcp --sport 10000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 COMMIT
 # Completed on Wed Dec  7 14:49:09 2005

Read More