Chain INPUT (policy DROP)
target prot opt source destination
PRE-VRMR-INPUT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACC-eth0 all -- anywhere anywhere
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe ALL '
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe SYN-FIN '
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN
LOG tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe SYN-RST '
DROP tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST
LOG tcp -- anywhere anywhere tcp flags:FIN,RST/FIN,RST limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe FIN-RST '
DROP tcp -- anywhere anywhere tcp flags:FIN,RST/FIN,RST
LOG tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe FIN '
DROP tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN
LOG tcp -- anywhere anywhere tcp flags:PSH,ACK/PSH limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe PSH '
DROP tcp -- anywhere anywhere tcp flags:PSH,ACK/PSH
LOG tcp -- anywhere anywhere tcp flags:ACK,URG/URG limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe URG '
DROP tcp -- anywhere anywhere tcp flags:ACK,URG/URG
LOG tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP no SYN '
DROP tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
LOG all -f anywhere anywhere limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP FRAG '
DROP all -f anywhere anywhere
ESTRELNFQUEUE all -- anywhere anywhere state RELATED,ESTABLISHED CONNMARK match !0x0
ACCEPT all -- anywhere anywhere MARK match 0x0/0xff000000 state ESTABLISHED
NEWACCEPT all -- anywhere anywhere MARK match 0x0/0xff000000 state RELATED
QUEUE all -- anywhere anywhere MARK match 0x1000000/0xff000000 state ESTABLISHED
NEWQUEUE all -- anywhere anywhere MARK match 0x1000000/0xff000000 state RELATED
LOG all -- anywhere anywhere state INVALID limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP in INVALID '
DROP all -- anywhere anywhere state INVALID
BLOCKLIST all -- anywhere anywhere
ANTISPOOF all -- anywhere anywhere
LOG all -- 172.20.0.0/24 server.mydomain limit: avg 20/sec burst 40 state NEW LOG level info prefix `vrmr: ACCEPT '
NEWACCEPT all -- 172.20.0.0/24 server.mydomain state NEW
LOG all -- anywhere server.mydomain limit: avg 20/sec burst 40 state NEW LOG level info prefix `vrmr: DROP '
DROP all -- anywhere server.mydomain state NEW
LOG all -- anywhere anywhere limit: avg 20/sec burst 40 LOG level info prefix `vrmr: DROP in policy '
Chain FORWARD (policy DROP)
target prot opt source destination
PRE-VRMR-FORWARD all -- anywhere anywhere
ACC-eth0 all -- anywhere anywhere
ACC-eth0 all -- anywhere anywhere
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe ALL '
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe SYN-FIN '
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN
LOG tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe SYN-RST '
DROP tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST
LOG tcp -- anywhere anywhere tcp flags:FIN,RST/FIN,RST limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe FIN-RST '
DROP tcp -- anywhere anywhere tcp flags:FIN,RST/FIN,RST
LOG tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe FIN '
DROP tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN
LOG tcp -- anywhere anywhere tcp flags:PSH,ACK/PSH limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe PSH '
DROP tcp -- anywhere anywhere tcp flags:PSH,ACK/PSH
LOG tcp -- anywhere anywhere tcp flags:ACK,URG/URG limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe URG '
DROP tcp -- anywhere anywhere tcp flags:ACK,URG/URG
LOG tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP no SYN '
DROP tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
LOG all -f anywhere anywhere limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP FRAG '
DROP all -f anywhere anywhere
ESTRELNFQUEUE all -- anywhere anywhere state RELATED,ESTABLISHED CONNMARK match !0x0
ACCEPT all -- anywhere anywhere MARK match 0x0/0xff000000 state ESTABLISHED
NEWACCEPT all -- anywhere anywhere MARK match 0x0/0xff000000 state RELATED
QUEUE all -- anywhere anywhere MARK match 0x1000000/0xff000000 state ESTABLISHED
NEWQUEUE all -- anywhere anywhere MARK match 0x1000000/0xff000000 state RELATED
LOG all -- anywhere anywhere state INVALID limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP fw INVALID '
DROP all -- anywhere anywhere state INVALID
BLOCKLIST all -- anywhere anywhere
ANTISPOOF all -- anywhere anywhere
LOG all -- anywhere anywhere limit: avg 20/sec burst 40 LOG level info prefix `vrmr: DROP fw policy '
Chain OUTPUT (policy DROP)
target prot opt source destination
PRE-VRMR-OUTPUT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACC-eth0 all -- anywhere anywhere
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe ALL '
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe SYN-FIN '
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN
LOG tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe SYN-RST '
DROP tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST
LOG tcp -- anywhere anywhere tcp flags:FIN,RST/FIN,RST limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe FIN-RST '
DROP tcp -- anywhere anywhere tcp flags:FIN,RST/FIN,RST
LOG tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe FIN '
DROP tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN
LOG tcp -- anywhere anywhere tcp flags:PSH,ACK/PSH limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe PSH '
DROP tcp -- anywhere anywhere tcp flags:PSH,ACK/PSH
LOG tcp -- anywhere anywhere tcp flags:ACK,URG/URG limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP probe URG '
DROP tcp -- anywhere anywhere tcp flags:ACK,URG/URG
LOG tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP no SYN '
DROP tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
LOG all -f anywhere anywhere limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP FRAG '
DROP all -f anywhere anywhere
ESTRELNFQUEUE all -- anywhere anywhere state RELATED,ESTABLISHED CONNMARK match !0x0
ACCEPT all -- anywhere anywhere MARK match 0x0/0xff000000 state ESTABLISHED
NEWACCEPT all -- anywhere anywhere MARK match 0x0/0xff000000 state RELATED
QUEUE all -- anywhere anywhere MARK match 0x1000000/0xff000000 state ESTABLISHED
NEWQUEUE all -- anywhere anywhere MARK match 0x1000000/0xff000000 state RELATED
LOG all -- anywhere anywhere state INVALID limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP out INVALID '
DROP all -- anywhere anywhere state INVALID
BLOCKLIST all -- anywhere anywhere
ANTISPOOF all -- anywhere anywhere
LOG all -- server.mydomain 172.20.0.0/24 limit: avg 20/sec burst 40 state NEW LOG level info prefix `vrmr: ACCEPT '
NEWACCEPT all -- server.mydomain 172.20.0.0/24 state NEW
LOG all -- anywhere anywhere limit: avg 20/sec burst 40 LOG level info prefix `vrmr: DROP out policy '
Chain ACC-eth0 (4 references)
target prot opt source destination
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain ANTISPOOF (3 references)
target prot opt source destination
Chain BLOCK (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP BLOCKED '
DROP all -- anywhere anywhere
Chain BLOCKLIST (3 references)
target prot opt source destination
Chain ESTRELNFQUEUE (3 references)
target prot opt source destination
Chain NEWACCEPT (5 references)
target prot opt source destination
SYNLIMIT tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
UDPLIMIT udp -- anywhere anywhere state NEW
ACCEPT all -- anywhere anywhere
Chain NEWNFQUEUE (0 references)
target prot opt source destination
SYNLIMIT tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
UDPLIMIT udp -- anywhere anywhere state NEW,RELATED
Chain NEWQUEUE (3 references)
target prot opt source destination
SYNLIMIT tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
UDPLIMIT udp -- anywhere anywhere state NEW
QUEUE all -- anywhere anywhere
Chain PRE-VRMR-FORWARD (1 references)
target prot opt source destination
Chain PRE-VRMR-INPUT (1 references)
target prot opt source destination
Chain PRE-VRMR-OUTPUT (1 references)
target prot opt source destination
Chain SYNLIMIT (3 references)
target prot opt source destination
RETURN all -- anywhere anywhere limit: avg 15/sec burst 30
LOG all -- anywhere anywhere limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP SYNLIMIT reach. '
DROP all -- anywhere anywhere
Chain TCPRESET (0 references)
target prot opt source destination
REJECT tcp -- anywhere anywhere tcp reject-with tcp-reset
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain UDPLIMIT (3 references)
target prot opt source destination
RETURN all -- anywhere anywhere limit: avg 10/sec burst 60
LOG all -- anywhere anywhere limit: avg 1/sec burst 2 LOG level info prefix `vrmr: DROP UDPLIMIT reach. '
DROP all -- anywhere anywhere