As everyone knows, security depends on defense-in-depth. (And if you didn’t before, you do now!) The idea being that defense should take place in layers, from the edge of the network to the heart of the system. That’s why we have firewalls, anti-virus, intrusion detection, anti-spam and kernel and compiler hardening mechanisms. But just because you have a firewall at the edge of the network doesn’t mean you can skip the host-based firewall.<\/p>\n
The most common Linux host-based firewall is probably iptables<\/a>. Unfortunately, iptables can be incredibly complex to configure correctly. There are lots of tools to help with this. My favorite has to be firehol<\/a>. Both from an ease of use standpoint, and from a “don’t kill me while I’m testing” sort of operation. If you are not careful while editing iptables rules it is actually fairly easy to lock yourself out.<\/p>\n Say you are remote in your server via ssh. You edit your iptables firewall rules and disable shh port 22 by placing a comment marker in the wrong line. You HUP the firewall and BANG<\/font> you’re locked out. The way firehol gets around this is to generate a rule to accept all ESTABLISHED and RELATED connections. So you’re connected via ssh, change the firehol configs, restart the service and you are still connected. Now you start another shell and try to log in and when you find that you can’t you can return to the open connection, fix the error and restart, and so on.<\/p>\n In the interest of showing how firehol works, here is a sample firehol.conf and the generated iptables firewall rules that it created.<\/p>\n Generated rules:<\/strong><\/p>\n As everyone knows, security depends on defense-in-depth. (And if you didn’t before, you do now!) The idea being that defense should take place in layers, from the edge of the network to the heart of …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[43,10,12],"tags":[180,147,149],"class_list":["post-132","post","type-post","status-publish","format-standard","hentry","category-open-source","category-security","category-tools","tag-open-source","tag-security","tag-tools"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pxT7i-28","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.evardsson.com\/blog\/wp-json\/wp\/v2\/posts\/132","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.evardsson.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.evardsson.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.evardsson.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.evardsson.com\/blog\/wp-json\/wp\/v2\/comments?post=132"}],"version-history":[{"count":0,"href":"https:\/\/www.evardsson.com\/blog\/wp-json\/wp\/v2\/posts\/132\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.evardsson.com\/blog\/wp-json\/wp\/v2\/media?parent=132"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.evardsson.com\/blog\/wp-json\/wp\/v2\/categories?post=132"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.evardsson.com\/blog\/wp-json\/wp\/v2\/tags?post=132"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}interface eth0 internal src \"192.168.1.0\/24\" dst 192.168.1.10\/32\r\n \tpolicy drop\r\n \tserver ICMP accept\r\n \tserver dns accept\r\n \tserver ftp accept\r\n \tserver ident accept\r\n \tserver microsoft_ds accept\r\n \tserver mysql accept\r\n \tserver samba accept\r\n \tserver time accept\r\n \tserver ssh accept\r\n \tserver http accept\r\n \tserver https accept\r\n \tserver ntp accept\r\n \tserver vnc accept\r\n \tserver webmin accept\r\n \tserver smtp accept\r\n \tserver pop3 accept\r\n \tclient all accept\r\n interface eth0 outside src not \"${UNROUTABLE_IPS} 192.168.1.0\/24\" dst 192.168.1.10\/32\r\n \tpolicy drop\r\n \tserver ICMP accept\r\n \tserver dns accept\r\n \tserver ftp accept\r\n \tserver http accept\r\n \tserver https accept\r\n \tserver ntp accept\r\n \tserver smtp accept\r\n \tserver pop3 accept\r\n \tclient all accept\r\n interface lo loopback src \"127.0.0.0\/8\" dst \"127.0.0.0\/8 192.168.1.10\/32\"\r\n \tpolicy accept<\/pre>\n<\/pre>\n
# Generated by iptables-save v1.2.11 on Wed Dec 7 14:49:09 2005\r\n *mangle\r\n :PREROUTING ACCEPT [7340:1260938]\r\n :INPUT ACCEPT [7296:1245746]\r\n :FORWARD ACCEPT [0:0]\r\n :OUTPUT ACCEPT [7454:4772446]\r\n :POSTROUTING ACCEPT [7468:4775764]\r\n COMMIT\r\n # Completed on Wed Dec 7 14:49:09 2005\r\n # Generated by iptables-save v1.2.11 on Wed Dec 7 14:49:09 2005\r\n *nat\r\n :PREROUTING ACCEPT [340:49114]\r\n :POSTROUTING ACCEPT [19:2454]\r\n :OUTPUT ACCEPT [19:2454]\r\n COMMIT\r\n # Completed on Wed Dec 7 14:49:09 2005\r\n # Generated by iptables-save v1.2.11 on Wed Dec 7 14:49:09 2005\r\n *filter\r\n :INPUT DROP [0:0]\r\n :FORWARD DROP [0:0]\r\n :OUTPUT DROP [0:0]\r\n :in_internal - [0:0]\r\n :in_internal_ICMP_s1 - [0:0]\r\n :in_internal_all_c14 - [0:0]\r\n :in_internal_dns_s2 - [0:0]\r\n :in_internal_ftp_c16 - [0:0]\r\n :in_internal_ftp_s3 - [0:0]\r\n :in_internal_http_s10 - [0:0]\r\n :in_internal_https_s11 - [0:0]\r\n :in_internal_ident_s4 - [0:0]\r\n :in_internal_irc_c15 - [0:0]\r\n :in_internal_microsoft_ds_s5 - [0:0]\r\n :in_internal_mysql_s6 - [0:0]\r\n :in_internal_ntp_s12 - [0:0]\r\n :in_internal_samba_s7 - [0:0]\r\n :in_internal_ssh_s9 - [0:0]\r\n :in_internal_time_s8 - [0:0]\r\n :in_internal_webmin_s13 - [0:0]\r\n :in_loopback - [0:0]\r\n :in_outside - [0:0]\r\n :in_outside_ICMP_s1 - [0:0]\r\n :in_outside_all_c9 - [0:0]\r\n :in_outside_dns_s2 - [0:0]\r\n :in_outside_ftp_c11 - [0:0]\r\n :in_outside_ftp_s3 - [0:0]\r\n :in_outside_http_s4 - [0:0]\r\n :in_outside_https_s5 - [0:0]\r\n :in_outside_irc_c10 - [0:0]\r\n :in_outside_ntp_s6 - [0:0]\r\n :in_outside_ssh_s7 - [0:0]\r\n :in_outside_webmin_s8 - [0:0]\r\n :out_internal - [0:0]\r\n :out_internal_ICMP_s1 - [0:0]\r\n :out_internal_all_c14 - [0:0]\r\n :out_internal_dns_s2 - [0:0]\r\n :out_internal_ftp_c16 - [0:0]\r\n :out_internal_ftp_s3 - [0:0]\r\n :out_internal_http_s10 - [0:0]\r\n :out_internal_https_s11 - [0:0]\r\n :out_internal_ident_s4 - [0:0]\r\n :out_internal_irc_c15 - [0:0]\r\n :out_internal_microsoft_ds_s5 - [0:0]\r\n :out_internal_mysql_s6 - [0:0]\r\n :out_internal_ntp_s12 - [0:0]\r\n :out_internal_samba_s7 - [0:0]\r\n :out_internal_ssh_s9 - [0:0]\r\n :out_internal_time_s8 - [0:0]\r\n :out_internal_webmin_s13 - [0:0]\r\n :out_loopback - [0:0]\r\n :out_outside - [0:0]\r\n :out_outside_ICMP_s1 - [0:0]\r\n :out_outside_all_c9 - [0:0]\r\n :out_outside_dns_s2 - [0:0]\r\n :out_outside_ftp_c11 - [0:0]\r\n :out_outside_ftp_s3 - [0:0]\r\n :out_outside_http_s4 - [0:0]\r\n :out_outside_https_s5 - [0:0]\r\n :out_outside_irc_c10 - [0:0]\r\n :out_outside_ntp_s6 - [0:0]\r\n :out_outside_ssh_s7 - [0:0]\r\n :out_outside_webmin_s8 - [0:0]\r\n -A INPUT -i lo -j ACCEPT\r\n -A INPUT -s 192.168.1.0\/255.255.255.0 -d 192.168.1.10 -i eth0 -j in_internal\r\n -A INPUT -d 192.168.1.10 -i eth0 -j in_outside\r\n -A INPUT -s 127.0.0.0\/255.0.0.0 -d 127.0.0.0\/255.0.0.0 -i lo -j in_loopback\r\n -A INPUT -s 127.0.0.0\/255.0.0.0 -d 192.168.1.10 -i lo -j in_loopback\r\n -A INPUT -m state --state RELATED -j ACCEPT\r\n -A INPUT -m limit --limit 1\/sec -j LOG --log-prefix \"IN-unknown:\"\r\n -A INPUT -j DROP\r\n -A FORWARD -m state --state RELATED -j ACCEPT\r\n -A FORWARD -m limit --limit 1\/sec -j LOG --log-prefix \"PASS-unknown:\"\r\n -A FORWARD -j DROP\r\n -A OUTPUT -o lo -j ACCEPT\r\n -A OUTPUT -s 192.168.1.10 -d 192.168.1.0\/255.255.255.0 -o eth0 -j out_internal\r\n -A OUTPUT -s 192.168.1.10 -o eth0 -j out_outside\r\n -A OUTPUT -s 127.0.0.0\/255.0.0.0 -d 127.0.0.0\/255.0.0.0 -o lo -j out_loopback\r\n -A OUTPUT -s 192.168.1.10 -d 127.0.0.0\/255.0.0.0 -o lo -j out_loopback\r\n -A OUTPUT -m state --state RELATED -j ACCEPT\r\n -A OUTPUT -m limit --limit 1\/sec -j LOG --log-prefix \"OUT-unknown:\"\r\n -A OUTPUT -j DROP\r\n -A in_internal -j in_internal_ICMP_s1\r\n -A in_internal -j in_internal_dns_s2\r\n -A in_internal -j in_internal_ftp_s3\r\n -A in_internal -j in_internal_ident_s4\r\n -A in_internal -j in_internal_microsoft_ds_s5\r\n -A in_internal -j in_internal_mysql_s6\r\n -A in_internal -j in_internal_samba_s7\r\n -A in_internal -j in_internal_time_s8\r\n -A in_internal -j in_internal_ssh_s9\r\n -A in_internal -j in_internal_http_s10\r\n -A in_internal -j in_internal_https_s11\r\n -A in_internal -j in_internal_ntp_s12\r\n -A in_internal -j in_internal_webmin_s13\r\n -A in_internal -j in_internal_all_c14\r\n -A in_internal -j in_internal_irc_c15\r\n -A in_internal -j in_internal_ftp_c16\r\n -A in_internal -m state --state RELATED -j ACCEPT\r\n -A in_internal -m limit --limit 1\/sec -j LOG --log-prefix \"IN-internal:\"\r\n -A in_internal -j DROP\r\n -A in_internal_ICMP_s1 -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_all_c14 -m state --state ESTABLISHED -j ACCEPT\r\n -A in_internal_dns_s2 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_dns_s2 -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_ftp_c16 -p tcp -m tcp --sport 21 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT\r\n -A in_internal_ftp_c16 -p tcp -m tcp --sport 20 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n -A in_internal_ftp_c16 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT\r\n -A in_internal_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT\r\n -A in_internal_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n -A in_internal_http_s10 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_https_s11 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_ident_s4 -p tcp -m tcp --sport 1024:65535 --dport 113 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_irc_c15 -p tcp -m tcp --sport 6667 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT\r\n -A in_internal_microsoft_ds_s5 -p tcp -m tcp --sport 1024:65535 --dport 445 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_mysql_s6 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_ntp_s12 -p udp -m udp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_ntp_s12 -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_ntp_s12 -p tcp -m tcp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_ntp_s12 -p tcp -m tcp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_samba_s7 -p udp -m udp --sport 137 --dport 137 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_samba_s7 -p udp -m udp --sport 1024:65535 --dport 137 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_samba_s7 -p udp -m udp --sport 138 --dport 138 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_samba_s7 -p udp -m udp --sport 1024:65535 --dport 138 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_samba_s7 -p tcp -m tcp --sport 1024:65535 --dport 139 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_samba_s7 -p tcp -m tcp --sport 1024:65535 --dport 445 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_ssh_s9 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_time_s8 -p tcp -m tcp --sport 1024:65535 --dport 37 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_time_s8 -p udp -m udp --sport 1024:65535 --dport 37 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_internal_webmin_s13 -p tcp -m tcp --sport 1024:65535 --dport 10000 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_loopback -m state --state RELATED -j ACCEPT\r\n -A in_loopback -j ACCEPT\r\n -A in_outside -s 0.0.0.0\/254.0.0.0 -j RETURN\r\n -A in_outside -s 2.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 5.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 7.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 23.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 27.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 31.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 36.0.0.0\/254.0.0.0 -j RETURN\r\n -A in_outside -s 39.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 41.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 42.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 73.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 74.0.0.0\/254.0.0.0 -j RETURN\r\n -A in_outside -s 76.0.0.0\/252.0.0.0 -j RETURN\r\n -A in_outside -s 89.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 90.0.0.0\/254.0.0.0 -j RETURN\r\n -A in_outside -s 92.0.0.0\/252.0.0.0 -j RETURN\r\n -A in_outside -s 96.0.0.0\/224.0.0.0 -j RETURN\r\n -A in_outside -s 173.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 174.0.0.0\/254.0.0.0 -j RETURN\r\n -A in_outside -s 176.0.0.0\/248.0.0.0 -j RETURN\r\n -A in_outside -s 184.0.0.0\/252.0.0.0 -j RETURN\r\n -A in_outside -s 189.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 190.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 197.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 223.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 240.0.0.0\/240.0.0.0 -j RETURN\r\n -A in_outside -s 10.0.0.0\/255.0.0.0 -j RETURN\r\n -A in_outside -s 169.254.0.0\/255.255.0.0 -j RETURN\r\n -A in_outside -s 172.16.0.0\/255.240.0.0 -j RETURN\r\n -A in_outside -s 192.0.2.0\/255.255.255.0 -j RETURN\r\n -A in_outside -s 192.88.99.0\/255.255.255.0 -j RETURN\r\n -A in_outside -s 192.168.0.0\/255.255.0.0 -j RETURN\r\n -A in_outside -s 192.168.1.0\/255.255.255.0 -j RETURN\r\n -A in_outside -j in_outside_ICMP_s1\r\n -A in_outside -j in_outside_dns_s2\r\n -A in_outside -j in_outside_ftp_s3\r\n -A in_outside -j in_outside_http_s4\r\n -A in_outside -j in_outside_https_s5\r\n -A in_outside -j in_outside_ntp_s6\r\n -A in_outside -j in_outside_ssh_s7\r\n -A in_outside -j in_outside_webmin_s8\r\n -A in_outside -j in_outside_all_c9\r\n -A in_outside -j in_outside_irc_c10\r\n -A in_outside -j in_outside_ftp_c11\r\n -A in_outside -m state --state RELATED -j ACCEPT\r\n -A in_outside -m limit --limit 1\/sec -j LOG --log-prefix \"IN-outside:\"\r\n -A in_outside -j DROP\r\n -A in_outside_ICMP_s1 -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_all_c9 -m state --state ESTABLISHED -j ACCEPT\r\n -A in_outside_dns_s2 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_dns_s2 -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_ftp_c11 -p tcp -m tcp --sport 21 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT\r\n -A in_outside_ftp_c11 -p tcp -m tcp --sport 20 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n -A in_outside_ftp_c11 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT\r\n -A in_outside_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT\r\n -A in_outside_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n -A in_outside_http_s4 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_https_s5 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_irc_c10 -p tcp -m tcp --sport 6667 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT\r\n -A in_outside_ntp_s6 -p udp -m udp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_ntp_s6 -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_ntp_s6 -p tcp -m tcp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_ntp_s6 -p tcp -m tcp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_ssh_s7 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A in_outside_webmin_s8 -p tcp -m tcp --sport 1024:65535 --dport 10000 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A out_internal -j out_internal_ICMP_s1\r\n -A out_internal -j out_internal_dns_s2\r\n -A out_internal -j out_internal_ftp_s3\r\n -A out_internal -j out_internal_ident_s4\r\n -A out_internal -j out_internal_microsoft_ds_s5\r\n -A out_internal -j out_internal_mysql_s6\r\n -A out_internal -j out_internal_samba_s7\r\n -A out_internal -j out_internal_time_s8\r\n -A out_internal -j out_internal_ssh_s9\r\n -A out_internal -j out_internal_http_s10\r\n -A out_internal -j out_internal_https_s11\r\n -A out_internal -j out_internal_ntp_s12\r\n -A out_internal -j out_internal_webmin_s13\r\n -A out_internal -j out_internal_all_c14\r\n -A out_internal -j out_internal_irc_c15\r\n -A out_internal -j out_internal_ftp_c16\r\n -A out_internal -m state --state RELATED -j ACCEPT\r\n -A out_internal -m limit --limit 1\/sec -j LOG --log-prefix \"OUT-internal:\"\r\n -A out_internal -j DROP\r\n -A out_internal_ICMP_s1 -p icmp -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_all_c14 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A out_internal_dns_s2 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_dns_s2 -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_ftp_c16 -p tcp -m tcp --sport 1024:4999 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A out_internal_ftp_c16 -p tcp -m tcp --sport 1024:4999 --dport 20 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_ftp_c16 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n -A out_internal_ftp_s3 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_ftp_s3 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n -A out_internal_ftp_s3 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_http_s10 -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_https_s11 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_ident_s4 -p tcp -m tcp --sport 113 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_irc_c15 -p tcp -m tcp --sport 1024:4999 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A out_internal_microsoft_ds_s5 -p tcp -m tcp --sport 445 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_mysql_s6 -p tcp -m tcp --sport 3306 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_ntp_s12 -p udp -m udp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_ntp_s12 -p udp -m udp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_ntp_s12 -p tcp -m tcp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_ntp_s12 -p tcp -m tcp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_samba_s7 -p udp -m udp --sport 137 --dport 137 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A out_internal_samba_s7 -p udp -m udp --sport 137 --dport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A out_internal_samba_s7 -p udp -m udp --sport 138 --dport 138 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_samba_s7 -p udp -m udp --sport 138 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_samba_s7 -p tcp -m tcp --sport 139 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_samba_s7 -p tcp -m tcp --sport 445 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_ssh_s9 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_time_s8 -p tcp -m tcp --sport 37 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_time_s8 -p udp -m udp --sport 37 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_internal_webmin_s13 -p tcp -m tcp --sport 10000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_loopback -m state --state RELATED -j ACCEPT\r\n -A out_loopback -j ACCEPT\r\n -A out_outside -d 0.0.0.0\/254.0.0.0 -j RETURN\r\n -A out_outside -d 2.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 5.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 7.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 23.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 27.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 31.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 36.0.0.0\/254.0.0.0 -j RETURN\r\n -A out_outside -d 39.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 41.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 42.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 73.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 74.0.0.0\/254.0.0.0 -j RETURN\r\n -A out_outside -d 76.0.0.0\/252.0.0.0 -j RETURN\r\n -A out_outside -d 89.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 90.0.0.0\/254.0.0.0 -j RETURN\r\n -A out_outside -d 92.0.0.0\/252.0.0.0 -j RETURN\r\n -A out_outside -d 96.0.0.0\/224.0.0.0 -j RETURN\r\n -A out_outside -d 173.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 174.0.0.0\/254.0.0.0 -j RETURN\r\n -A out_outside -d 176.0.0.0\/248.0.0.0 -j RETURN\r\n -A out_outside -d 184.0.0.0\/252.0.0.0 -j RETURN\r\n -A out_outside -d 189.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 190.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 197.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 223.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 240.0.0.0\/240.0.0.0 -j RETURN\r\n -A out_outside -d 10.0.0.0\/255.0.0.0 -j RETURN\r\n -A out_outside -d 169.254.0.0\/255.255.0.0 -j RETURN\r\n -A out_outside -d 172.16.0.0\/255.240.0.0 -j RETURN\r\n -A out_outside -d 192.0.2.0\/255.255.255.0 -j RETURN\r\n -A out_outside -d 192.88.99.0\/255.255.255.0 -j RETURN\r\n -A out_outside -d 192.168.0.0\/255.255.0.0 -j RETURN\r\n -A out_outside -d 192.168.1.0\/255.255.255.0 -j RETURN\r\n -A out_outside -j out_outside_ICMP_s1\r\n -A out_outside -j out_outside_dns_s2\r\n -A out_outside -j out_outside_ftp_s3\r\n -A out_outside -j out_outside_http_s4\r\n -A out_outside -j out_outside_https_s5\r\n -A out_outside -j out_outside_ntp_s6\r\n -A out_outside -j out_outside_ssh_s7\r\n -A out_outside -j out_outside_webmin_s8\r\n -A out_outside -j out_outside_all_c9\r\n -A out_outside -j out_outside_irc_c10\r\n -A out_outside -j out_outside_ftp_c11\r\n -A out_outside -m state --state RELATED -j ACCEPT\r\n -A out_outside -m limit --limit 1\/sec -j LOG --log-prefix \"OUT-outside:\"\r\n -A out_outside -j DROP\r\n -A out_outside_ICMP_s1 -p icmp -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_all_c9 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A out_outside_dns_s2 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_dns_s2 -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_ftp_c11 -p tcp -m tcp --sport 1024:4999 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A out_outside_ftp_c11 -p tcp -m tcp --sport 1024:4999 --dport 20 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_ftp_c11 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n -A out_outside_ftp_s3 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_ftp_s3 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n -A out_outside_ftp_s3 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_http_s4 -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_https_s5 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_irc_c10 -p tcp -m tcp --sport 1024:4999 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT\r\n -A out_outside_ntp_s6 -p udp -m udp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_ntp_s6 -p udp -m udp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_ntp_s6 -p tcp -m tcp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_ntp_s6 -p tcp -m tcp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_ssh_s7 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n -A out_outside_webmin_s8 -p tcp -m tcp --sport 10000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\r\n COMMIT\r\n # Completed on Wed Dec 7 14:49:09 2005<\/pre>\n","protected":false},"excerpt":{"rendered":"