iptables-save
# Generated by iptables-save v1.4.2 on Thu Aug 11 10:38:50 2011
*nat
:PREROUTING ACCEPT [5050:296636]
:POSTROUTING ACCEPT [2047:131298]
:OUTPUT ACCEPT [1814:119114]
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 21 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d a.a.a.a/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 10000 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 22 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 143 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 110 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 587 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 993 -j DNAT --to-destination 192.168.0.150
-A PREROUTING -d b.b.b.b/32 -p tcp -m tcp --dport 995 -j DNAT --to-destination 192.168.0.150
-A POSTROUTING -m mark --mark 0xa -j MASQUERADE
-A POSTROUTING -m mark --mark 0xb -j MASQUERADE
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 21 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d a.a.a.a/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 10000 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 22 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 143 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 110 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 587 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 993 -j DNAT --to-destination 192.168.0.150
-A OUTPUT -d b.b.b.b/32 -p tcp -m tcp --dport 995 -j DNAT --to-destination 192.168.0.150
COMMIT
# Completed on Thu Aug 11 10:38:50 2011
# Generated by iptables-save v1.4.2 on Thu Aug 11 10:38:50 2011
*mangle
:PREROUTING ACCEPT [65251:20345421]
:INPUT ACCEPT [41767:9078826]
:FORWARD ACCEPT [23385:11263761]
:OUTPUT ACCEPT [39629:8353184]
:POSTROUTING ACCEPT [63004:19610585]
-A PREROUTING -s 192.168.0.150/32 -d ! 192.168.0.0/16 -j MARK --set-xmark 0xb/0xffffffff
-A PREROUTING -s 192.168.0.0/24 -d ! 192.168.0.0/16 -j MARK --set-xmark 0xa/0xffffffff
COMMIT
# Completed on Thu Aug 11 10:38:50 2011
# Generated by iptables-save v1.4.2 on Thu Aug 11 10:38:50 2011
*filter
:INPUT DROP [66:3595]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1741:108600]
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 5900 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 10000 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A INPUT -s 192.168.0.0/16 -i vmbr0 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 25 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth0 -p tcp -m tcp --dport 53 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 53 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 110 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 143 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 587 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 993 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 995 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -d 192.168.0.150/32 -i eth1 -p tcp -m tcp --dport 10000 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A FORWARD -s 192.168.0.0/16 -m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -m state --state INVALID -j DROP
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
-A OUTPUT -d 192.168.0.0/16 -o vmbr0 -m state --state NEW -j ACCEPT
COMMIT
# Completed on Thu Aug 11 10:38:50 2011
Тема: IPTABLES закрыт порт (Прочитано 2131 раз)
