# Trouble getting iptables to work....

## Ctrl+Alt+Del

Hi Guys,

i am currently struggling with getting iptables to work on my server.

The Box runs ISPCP (webhost admin panel) which creates rules for traffic monitoring

Additionaly it is a Xen Dom0 routing traffic to its DomU

On Top of that i would like to incorporate a filter to block unwanted connections..

As a minor addon i have fail2ban running which i would like to use

I am running into some trouble to combine the wanted features into a single script...

The Pre Firewall Status is as follows:

```

# Generated by iptables-save v1.4.2 on Fri Feb 19 21:52:57 2010

*filter

:INPUT ACCEPT [1442299:1090032214]

:FORWARD ACCEPT [2016813:2054626499]

:OUTPUT ACCEPT [1301039:751708298]

:ISPCP_INPUT - [0:0]

:ISPCP_OUTPUT - [0:0]

:fail2ban-ssh - [0:0]

-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh 

-A INPUT -j ISPCP_INPUT 

-A FORWARD -s X8.X7.X9.XX/32 -m physdev --physdev-in vif1.0 -j ACCEPT 

-A FORWARD -p udp -m physdev --physdev-in vif1.0 -m udp --sport 68 --dport 67 -j ACCEPT 

-A OUTPUT -j ISPCP_OUTPUT 

-A ISPCP_INPUT -p tcp -m tcp --dport 993 

-A ISPCP_INPUT -p tcp -m tcp --dport 995 

-A ISPCP_INPUT -p tcp -m tcp --dport 587 

-A ISPCP_INPUT -p tcp -m tcp --dport 25 

-A ISPCP_INPUT -p tcp -m tcp --dport 143 

-A ISPCP_INPUT -p tcp -m tcp --dport 110 

-A ISPCP_INPUT -p tcp -m tcp --dport 443 

-A ISPCP_INPUT -p tcp -m tcp --dport 80 

-A ISPCP_INPUT -j RETURN 

-A ISPCP_OUTPUT -p tcp -m tcp --sport 993 

-A ISPCP_OUTPUT -p tcp -m tcp --sport 995 

-A ISPCP_OUTPUT -p tcp -m tcp --sport 587 

-A ISPCP_OUTPUT -p tcp -m tcp --sport 25 

-A ISPCP_OUTPUT -p tcp -m tcp --sport 143 

-A ISPCP_OUTPUT -p tcp -m tcp --sport 110 

-A ISPCP_OUTPUT -p tcp -m tcp --sport 443 

-A ISPCP_OUTPUT -p tcp -m tcp --sport 80 

-A ISPCP_OUTPUT -j RETURN 

-A fail2ban-ssh -j RETURN 

COMMIT

```

So i came up with the following script with stuff i shamelessly stole from across the web  :Smile: 

```

# iptables suchen

iptables=`which iptables`

 

# wenn iptables nicht installiert abbrechen

test -f $iptables || exit 0

 

case "$1" in

   start)

      echo "Starte Firewall..."

      #KeinBock das intelligenter zu machen , scheiss drauf es funzt

      /bin/sh /etc/init.d/fail2ban stop

      # alle Regeln l����schen

      $iptables -t nat -F

      $iptables -t filter -F

      $iptables -X

 

      # neue Regeln erzeugen

      $iptables -N garbage

      $iptables -I garbage -p TCP -j LOG --log-prefix="DROP TCP-Packet: " --log-level err

      $iptables -I garbage -p UDP -j LOG --log-prefix="DROP UDP-Packet: " --log-level err

      $iptables -I garbage -p ICMP -j LOG --log-prefix="DROP ICMP-Packet: " --log-level err

 

      # Default Policy

      $iptables -P INPUT DROP

      $iptables -P OUTPUT DROP

      $iptables -P FORWARD DROP

 

      # ����ber Loopback alles erlauben

      $iptables -I INPUT -i lo -j ACCEPT

      $iptables -I OUTPUT -o lo -j ACCEPT

      # Xen Routing a la Hetzner 

      $iptables -A FORWARD -s X8.X7.X9.XX/32 -m physdev --physdev-in vif1.0 -j ACCEPT 

      $iptables -A FORWARD -p udp -m physdev --physdev-in vif1.0 -m udp --sport 68 --dport 67 -j ACCEPT 

      

      #ISPCP Traffic Counter

      $iptables -A INPUT -j ISPCP_INPUT

      $iptables -A OUTPUT -j ISPCP_OUTPUT 

      $iptables -A ISPCP_INPUT -p tcp -m tcp --dport 993 

      $iptables -A ISPCP_INPUT -p tcp -m tcp --dport 995 

      $iptables -A ISPCP_INPUT -p tcp -m tcp --dport 587 

      $iptables -A ISPCP_INPUT -p tcp -m tcp --dport 25 

      $iptables -A ISPCP_INPUT -p tcp -m tcp --dport 143 

      $iptables -A ISPCP_INPUT -p tcp -m tcp --dport 110 

      $iptables -A ISPCP_INPUT -p tcp -m tcp --dport 443 

      $iptables -A ISPCP_INPUT -p tcp -m tcp --dport 80 

      $iptables -A ISPCP_INPUT -j RETURN 

      $iptables -A ISPCP_OUTPUT -p tcp -m tcp --sport 993 

      $iptables -A ISPCP_OUTPUT -p tcp -m tcp --sport 995 

      $iptables -A ISPCP_OUTPUT -p tcp -m tcp --sport 587 

      $iptables -A ISPCP_OUTPUT -p tcp -m tcp --sport 25 

      $iptables -A ISPCP_OUTPUT -p tcp -m tcp --sport 143 

      $iptables -A ISPCP_OUTPUT -p tcp -m tcp --sport 110 

      $iptables -A ISPCP_OUTPUT -p tcp -m tcp --sport 443 

      $iptables -A ISPCP_OUTPUT -p tcp -m tcp --sport 80 

      $iptables -A ISPCP_OUTPUT -j RETURN 

 

      #####################################################

      # ausgehende Verbindungen

      # Port 21

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 21 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 49152:65535 --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 20 --dport 49152:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 22

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 22 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 25

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 25 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 53

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 53 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p UDP --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p UDP --sport 53 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 80

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 80 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 110

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 110 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 110 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 143

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 143 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 143 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 443

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 443 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 465

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 465 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 465 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 993

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 993 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 995

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 995 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 995 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 3306

      $iptables -I OUTPUT -o eth0 -p TCP --sport 1024:65535 --dport 3306 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 3306 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # ICMP

      $iptables -I OUTPUT -o eth0 -p ICMP --icmp-type echo-reply -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p ICMP --icmp-type echo-reply -m state --state ESTABLISHED,RELATED -j ACCEPT

 

      #####################################################

      # eingehende Verbindungen

      # Port 21

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 21 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 40000:40500 -m state --state NEW -j ACCEPT

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 49152:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 20 --dport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      # Port 22

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 22 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 25

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 25 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 80

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 80 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 110

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 110 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 110 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 143

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 143 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 143 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 443

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 443 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 465

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 465 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 465 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 993

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 993 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Port 995

      $iptables -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 995 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p TCP --sport 995 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

      # ICMP

      $iptables -I INPUT -i eth0 -p ICMP --icmp-type echo-request -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

      $iptables -I OUTPUT -o eth0 -p ICMP --icmp-type echo-request -m state --state ESTABLISHED,RELATED -j ACCEPT

 

      #####################################################

      # SynFlood

      $iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

      # PortScan

      $iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

      # Ping-of-Death

      $iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

      

      #####################################################

      # bestehende Verbindungen akzeptieren

      $iptables -A OUTPUT -m state --state  ,RELATED -j ACCEPT

      $iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

 

      #####################################################

      # Garbage uebergeben wenn nicht erlaubt

      $iptables -A INPUT -m state --state NEW,INVALID -j garbage

 

      #####################################################

      # alles verbieten was bisher erlaubt war

      $iptables -A INPUT -j garbage

      $iptables -A OUTPUT -j garbage

      $iptables -A FORWARD -j garbage

      ;;

   stop)

   

      # KeinBock das intelligenter zu machen , scheiss drauf es funzt #2

      /bin/sh /etc/init.d/fail2ban start

      echo "Stoppe Firewall..."

      $iptables -t nat -F

      $iptables -t filter -F

      $iptables -X

      $iptables -P INPUT ACCEPT

      $iptables -P OUTPUT ACCEPT

      $iptables -P FORWARD ACCEPT

      ;;

   restart|reload|force-reload)

   $0 stop

   $0 start

      ;;

   *)

      echo "Usage: /etc/init.d/firewall (start|stop)"

      exit 1

      ;;

esac

exit 0

```

When launched the Script cuts of the DomU and the whole ISPCP Traffic gets ignored as it errors out with 

```
iptables v1.4.2: Couldn't load target `ISPCP_INPUT':/lib/xtables/libipt_ISPCP_INPUT.so: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.

iptables v1.4.2: Couldn't load target `ISPCP_OUTPUT':/lib/xtables/libipt_ISPCP_OUTPUT.so: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables: No chain/target/match by that name

iptables v1.4.2: Bad state `,RELATED'

Try `iptables -h' or 'iptables --help' for more information.

```

Would anyone be so kind to give me few pointers?

----------

## dirk_salewski

Well - "garbage" is not one of the standard iptables chains. In your script there's a line: 

```
$iptables -N garbage
```

I think this line makes iptables recognise "garbage" as rulechain it can jump to. 

The error message says: nobody told me that there ARE chains named ISPCP_something. Looks to me as if you populated nonexisting chains with rules. Probably the following lines would fix it: 

```
#ISPCP Traffic Counter

$iptables -N ISPCP_INPUT

$iptables -N ISPCP_OUTPUT

[the beautiful rest of the script]
```

----------

## Ctrl+Alt+Del

Thx for your reply  :Smile: 

You were right about the ISPCP Chains, they work now. The "iptables v1.4.2: Bad state `,RELATED' " is fixed as well, 

```
      #####################################################

      # bestehende Verbindungen akzeptieren

      $iptables -A OUTPUT -m state --state  ,RELATED -j ACCEPT 
```

 is now

```
      #####################################################

      # bestehende Verbindungen akzeptieren

      $iptables -A OUTPUT -m state --state  ESTABLISHED,RELATED -j ACCEPT 
```

So there's only one error left to go....Xen DomU Traffic

About your comment concerning garbage... doesn't -N create a new chain. I just learned that  :Smile: 

----------

## Hu

 *Ctrl+Alt+Del wrote:*   

> 
> 
> ```
> 
> # iptables suchen
> ...

 

Have you tested that fragment?  When which fails to find a tool, it produces no output.  Since you did not quote the argument to test -f, it succeeds.  Try:

```
iptables=`which nosuch`

test -f $iptables || echo Failed to find command
```

Compare that against the same snippet, but with $iptables quoted.

----------

## Ctrl+Alt+Del

iptables is installed and utilised

The generated rules look as follows

```
root@area51:~# iptables -L

Chain INPUT (policy DROP)

target     prot opt source               destination         

ACCEPT     icmp --  anywhere             anywhere            icmp echo-request state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:pop3s state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:imaps state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:ssmtp state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:https state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:imap2 state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:pop3 state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:www state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:smtp state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:ssh state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:ftp-data state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpts:40000:40500 state NEW 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:ftp state NEW,RELATED,ESTABLISHED 

ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:mysql dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:pop3s dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:imaps dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ssmtp dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:https dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:imap2 dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:pop3 dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:www dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     udp  --  anywhere             anywhere            udp spt:domain dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:domain dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:smtp dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ssh dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ftp-data dpts:49152:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ftp dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     all  --  anywhere             anywhere            

ISPCP_INPUT  all  --  anywhere             anywhere            

ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 

garbage    all  --  anywhere             anywhere            state INVALID,NEW 

garbage    all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)

target     prot opt source               destination         

ACCEPT     all  --  zimbra.sektor7g.net  anywhere            PHYSDEV match --physdev-in vif1.0 

ACCEPT     udp  --  anywhere             anywhere            PHYSDEV match --physdev-in vif1.0 udp spt:bootpc dpt:bootps 

ACCEPT     tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 1/sec burst 5 

ACCEPT     tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5 

ACCEPT     icmp --  anywhere             anywhere            icmp echo-request limit: avg 1/sec burst 5 

garbage    all  --  anywhere             anywhere            

Chain OUTPUT (policy DROP)

target     prot opt source               destination         

ACCEPT     icmp --  anywhere             anywhere            icmp echo-request state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:pop3s dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:imaps dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ssmtp dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:https dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:imap2 dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:pop3 dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:www dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:smtp dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ssh dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ftp-data dpts:1024:65535 state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:49152:65535 dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ftp dpts:1024:65535 state RELATED,ESTABLISHED 

ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:mysql state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:pop3s state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:imaps state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:ssmtp state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:https state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:imap2 state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:pop3 state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:www state NEW,RELATED,ESTABLISHED 

ACCEPT     udp  --  anywhere             anywhere            udp spts:1024:65535 dpt:domain state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:domain state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:smtp state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:ssh state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:49152:65535 dpt:ftp-data state NEW,RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpt:ftp state NEW,RELATED,ESTABLISHED 

ACCEPT     all  --  anywhere             anywhere            

ISPCP_OUTPUT  all  --  anywhere             anywhere            

ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 

garbage    all  --  anywhere             anywhere            

Chain ISPCP_INPUT (1 references)

target     prot opt source               destination         

           tcp  --  anywhere             anywhere            tcp dpt:imaps 

           tcp  --  anywhere             anywhere            tcp dpt:pop3s 

           tcp  --  anywhere             anywhere            tcp dpt:submission 

           tcp  --  anywhere             anywhere            tcp dpt:smtp 

           tcp  --  anywhere             anywhere            tcp dpt:imap2 

           tcp  --  anywhere             anywhere            tcp dpt:pop3 

           tcp  --  anywhere             anywhere            tcp dpt:https 

           tcp  --  anywhere             anywhere            tcp dpt:www 

RETURN     all  --  anywhere             anywhere            

Chain ISPCP_OUTPUT (1 references)

target     prot opt source               destination         

           tcp  --  anywhere             anywhere            tcp spt:imaps 

           tcp  --  anywhere             anywhere            tcp spt:pop3s 

           tcp  --  anywhere             anywhere            tcp spt:submission 

           tcp  --  anywhere             anywhere            tcp spt:smtp 

           tcp  --  anywhere             anywhere            tcp spt:imap2 

           tcp  --  anywhere             anywhere            tcp spt:pop3 

           tcp  --  anywhere             anywhere            tcp spt:https 

           tcp  --  anywhere             anywhere            tcp spt:www 

RETURN     all  --  anywhere             anywhere            

Chain garbage (4 references)

target     prot opt source               destination         

LOG        icmp --  anywhere             anywhere            LOG level error prefix `DROP ICMP-Packet: ' 

LOG        udp  --  anywhere             anywhere            LOG level error prefix `DROP UDP-Packet: ' 

LOG        tcp  --  anywhere             anywhere            LOG level error prefix `DROP TCP-Packet: ' 

```

----------

