# Generated by iptables-save v1.2.1a on Fri Jun  1 14:04:15 2001
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1531191:180073476]
:user_chain - [0:0]

# this should produce rule in the same chain
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 

# and these, too
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT 
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 

# unusual combination of states, creates custom service object. Also, since the same rule
# matches tcp service and custom service, branch will be created
-A INPUT -s 192.168.2.0/24 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT 

# this creates a branch, matching service in the main policy and
# ESTABLISHED,RELATE states in the branch
#
-A OUTPUT -d 21.21.21.21 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT 

# variant with a different action. New branch rule set should be created, different
# from the one created for the rule above.
#
-A OUTPUT -d 21.21.21.21 -p tcp -m tcp --dport 23 -m state --state RELATED,ESTABLISHED -j DROP

# more complex combination of states
-A FORWARD -s 1.1.1.0/24 -d 2.2.2.0/24 -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp ! --dport 80 -j ACCEPT

# this should be recognized as built-in rule
-A FORWARD -m state --state INVALID -j drop_invalid 

# this should be recognized as built-in rule
-A OUTPUT -m state --state INVALID -j drop_invalid 

# these go into INPUT chain, should end up with firewall object in DST
-A INPUT -i lo -j ACCEPT
-A INPUT -j user_chain
-A INPUT -j scan_checks_chain

# both -i intf and -o intf in the same rule. Crearing a branch
-A FORWARD -i eth0 -o eth1 -p udp --dport 1604 -j ACCEPT

# testing action REJECT with option. Trying all possible options and aliases
-A INPUT -p tcp --dport 0:8000 -j REJECT --reject-with tcp-reset

-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with icmp-net-unreachable
-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with net-unreach

-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with icmp-host-unreachable
-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with host-unreach

-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with icmp-proto-unreachable
-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with proto-unreach

-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with port-unreach

-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with icmp-net-prohibited
-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with net-prohib

-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with host-prohib

-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with icmp-admin-prohibited
-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with admin-prohib

#  was: bad --reject-with argument
-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with icmp-admin-prohibited
-A INPUT -p udp --dport 0:8000 -j REJECT --reject-with admin-prohib


# v2.1 does not support passing control to the same branch from
# several rules This rule will have action 'branch' but branch name
# will be 'user_chain1' This rule will have a comment explaining this
# and branch rule set will be emtpy
-A OUTPUT -j user_chain

# Tests for module iprange
-A FORWARD -m iprange --src-range 10.212.66.2-10.212.66.3 --dst-range 192.11.1.11-192.11.1.63 -j ACCEPT
-A FORWARD -m iprange -s 10.212.66.2 --dst-range 192.11.1.11-192.11.1.63 -j ACCEPT
-A FORWARD -m iprange --src-range 10.212.66.2-10.212.66.3 -d 192.11.1.11 -j ACCEPT

#
-A FORWARD -s 192.168.0.0/16 -m state --state NEW -j ACCEPT

# this should end up with action "Continue" and logging on
-A FORWARD -j LOG --log-prefix "FORWARD catch-all"

# should have icmp (-1,-1) in SRV -- should recognize this as icmp
# even though it is uppercased
-A user_chain -s 128.143.0.0/16 -p ICMP -j ACCEPT

# numeric protocol spec
-A user_chain -d 192.168.1.1 -i eth0 -p 47 -j ACCEPT

# target RETURN
-A user_chain -s 1.1.0.0/16 -p ICMP -j RETURN

# this should be reproduced using custom service object even though it
#  is in user-defined chain
#
-A user_chain -m state --state RELATED,ESTABLISHED -j ACCEPT

-A user_chain -s 192.168.19.0/24  -p tcp -m tcp --dport 5432 -m state --state NEW -j ACCEPT
-A user_chain -s 192.168.16.125  -p tcp -m tcp --dport 5432 -m state --state NEW -j ACCEPT
-A user_chain -s 192.168.0.0/16 -p tcp -m tcp --dport 873 -m state --state NEW -j ACCEPT
-A user_chain -s 192.168.0.0/16 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A user_chain -s 192.0.34.166 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A user_chain -s 192.168.19.0/24 -p tcp -m tcp --dport 137:139 -m state --state NEW -j ACCEPT


-A user_chain -s 192.168.19.0/24 -p tcp -m tcp --dport :1023 -m state --state NEW -j ACCEPT
-A user_chain -s 192.168.19.0/24 -p tcp -m tcp --dport 6000: -m state --state NEW -j ACCEPT

-A user_chain -s 192.168.0.0/16 -p udp --dport 137 -m state --state NEW -j ACCEPT
-A user_chain -s 192.168.0.0/16 -p udp --dport 138 -m state --state NEW -j ACCEPT
-A user_chain -s 192.168.0.0/16 -p tcp -m tcp --dport 139 -m state --state NEW -j ACCEPT
-A user_chain -s 192.168.0.0/16 -p tcp -m tcp --dport 445 -m state --state NEW -j ACCEPT
-A user_chain -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT

-A user_chain -s 192.168.0.0/16 -p tcp -m tcp --dport 8080 -m state --state NEW -j ACCEPT
-A user_chain -s 192.0.34.166 -p tcp -m tcp --dport 8080 -m state --state NEW -j ACCEPT

-A user_chain -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT

-A user_chain -s 127.0.0.1 -p tcp -m tcp --dport 631 -m state --state NEW -j ACCEPT
-A user_chain -s 127.0.0.1 -p tcp -m tcp --dport 515 -m state --state NEW -j ACCEPT

# different combinations of tcp flags in combination with some other
# options. Taken from a real policy.
#
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -m limit --limit 3/min -j LOG --log-prefix "Stealth XMAS scan: " --log-level 7 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -m limit --limit 3/min -j LOG --log-prefix "Stealth XMAS-PSH scan: " --log-level 7 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -m limit --limit 3/min -j LOG --log-prefix "Stealth XMAS-ALL scan: " --log-level 7 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -m limit --limit 3/min -j LOG --log-prefix "Stealth FIN scan: " --log-level 7 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 3/min -j LOG --log-prefix "Stealth SYN/RST scan: " --log-level 7 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 3/min -j LOG --log-prefix "Stealth SYN/FIN scan(?): " --log-level 7 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 3/min -j LOG --log-prefix "Stealth Null scan: " --log-level 7 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j DROP 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP 
-A scan_checks_chain -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP 
-A scan_checks_chain -i eth0 -p tcp -m tcp --syn  -j ACCEPT
-A scan_checks_chain -i eth0 -p tcp -m tcp ! --syn  -j ACCEPT


# was: bad port spec
-A user_chain -s 192.168.0.0/16 -p tcp -m tcp --dport 8088 -m state --state NEW -j ACCEPT

# Log prefix and log limit test
# Also need action Continue (or NOP)
-A user_chain -s ! 128.143.0.0/16 -m limit --limit 25/hour -j LOG --log-prefix user_chain_notlocal:

-A user_chain -s 128.143.0.0/16 -p tcp --dport 427 -j ACCEPT
-A user_chain -s 128.143.0.0/16 -p udp --dport 427 -j ACCEPT
-A user_chain -s 128.143.0.0/16 -p tcp --dport 548 -j ACCEPT
-A user_chain -s 128.143.0.0/16 -p tcp --dport 201 -j ACCEPT
-A user_chain -s 128.143.0.0/16 -p tcp --dport 202 -j ACCEPT
-A user_chain -s 128.143.0.0/16 -p tcp --dport 204 -j ACCEPT
-A user_chain -s 128.143.0.0/16 -p tcp --dport 206 -j ACCEPT

# --dports does not necessarily follow -m multiport
#
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --dports 548,201,202,204,206 -j ACCEPT

# there can be just one port with multiport
#
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --dports 2222 -j ACCEPT

# source ports with multiport
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --sports 548,201,202,204,206 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --sports 2222 -j ACCEPT

# --ports (source OR destination port)
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --ports 548,201,202,204,206 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --ports 2222 -j ACCEPT

# various port range cases
# it is unclear if multiport supports open-ended ranges such as ":1024" or "1024:"
#
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --dports 201:206,311 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --dports 548,201:206 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --dports 548,201:206,311:315 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --dports 201:206,311:315,548 -j ACCEPT

-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --sports 201:206,311 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --sports 548,201:206 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --sports 548,201:206,311:315 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --sports 201:206,311:315,548 -j ACCEPT

-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --ports 201:206,311 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --ports 548,201:206 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --ports 548,201:206,311:315 -j ACCEPT
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp --ports 201:206,311:315,548 -j ACCEPT

# now with negation
-A user_chain -m multiport -s 128.143.0.0/16 -p tcp ! --dports 548,201,202,204,206 -j ACCEPT


# icmp
-A user_chain -p icmp -s 128.143.0.0/16 --icmp-type any  -j ACCEPT
-A user_chain -p icmp -s 128.143.0.0/16 --icmp-type 3  -j ACCEPT
-A user_chain -p icmp -s 128.143.0.0/16 --icmp-type network-unknown  -j ACCEPT


# module length
-A user_chain -m length --length 400:65535 -j DROP

# Module recent
-A user_chain -m recent  --name badguy --rcheck --seconds 60  -j DROP
-A user_chain -p tcp -i eth0 --dport 139 -m recent --name badguy --set -j DROP

# combinations of a regular service and module or two modules 
#
-A user_chain  -s 128.143.0.0/16 -p tcp --dport 5190 -m mark --mark 0x11 -j DROP
-A user_chain  -s 128.143.0.0/16 -p tcp --dport 5190 -m length --length 400:1500 -j DROP
-A user_chain  -m mark --mark 0x11  -m length --length 400:1500 -j DROP

# this rule has negation in the mark match but no negation in port match
-A user_chain -p tcp -m mark ! --mark 0x4 -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG SYN -j MARK --set-mark 0x1

# negation with tcp match
-A user_chain -p tcp -m mark --mark 0x4 -m tcp ! --tcp-flags FIN,SYN,RST,PSH,ACK,URG SYN -j MARK --set-mark 0x1

# this rule has three matches which is not supported
-A user_chain -p tcp -m length --length 0:128 -m mark --mark 0x4 -m tcp --sport 53 -j ACCEPT
-A user_chain -p tcp -m length --length 0:128 -m mark ! --mark 0x4 -m tcp --sport 53 -j ACCEPT

# bug 1703, SF bug 3065435 
-A user_chain -m pkttype --pkt-type broadcast -j DROP

-A user_chain -j DROP

COMMIT

# mangle table
*mangle
:PREROUTING ACCEPT
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT

# mark in FORWARD
-A FORWARD -i eth1 -p tcp --dport smtp -j MARK --set-mark 16

# mark in FORWARD, argument is hex
-A FORWARD -i eth1 -p tcp --dport smtp -j MARK --set-mark 0xa
-A FORWARD -i eth1 -p tcp --dport smtp -j MARK --set-mark 0xB

# mark in PREROUTING (check option "ipt_mark_prerouting")
-A PREROUTING -i eth1 -p tcp --dport smtp -j MARK --set-mark 16

# option "ipt_mark_connections"
-A PREROUTING -j CONNMARK --restore-mark

# packets from me going out
-A POSTROUTING -o eth1 -p tcp --sport smtp -j MARK --set-mark 16
-A POSTROUTING -j CONNMARK --save-mark

# test ROUTE target
-A POSTROUTING -m mark --mark 1  -j ROUTE  --oif eth0 --continue
-A POSTROUTING -m mark --mark 2  -j ROUTE  --oif eth2 --continue

# test TOS target with parameters (unsupported, but parser
# should not crash on it)
-A POSTROUTING -d 192.168.1.1 -j TOS --set-tos Minimize-Delay
-A POSTROUTING -d 192.168.1.1 -j TOS --set-tos 0x10

-A POSTROUTING -s 192.168.1.0/24 -j CLASSIFY --set-class 0001:0010 
-A POSTROUTING -s 192.168.2.0/24 -j CLASSIFY --set-class 1:10

COMMIT

*nat
:PREROUTING ACCEPT [1502:275921]
:POSTROUTING ACCEPT [406:45653]
:OUTPUT ACCEPT [406:45653]

-A POSTROUTING -o eth1  -s 192.168.1.0/24 -j SNAT --to-source 222.222.222.222 
-A POSTROUTING -o eth0  -s 192.168.1.0/24 -j SNAT --to-source 192.168.1.1 
-A POSTROUTING -o eth+  -s 192.168.1.32/27 -j SNAT --to-source 222.222.222.10-222.222.222.100 
-A POSTROUTING -o eth+ -p tcp -m tcp  -s 192.168.1.0/24  -d 192.168.1.20 --dport 80 -j SNAT --to-source 192.168.1.1 
-A POSTROUTING -o eth+ -p tcp -m tcp  -s 192.168.1.0/24  -d 192.168.1.20 --dport 80 -j SNAT --to-source 192.168.1.1-192.168.1.10
-A POSTROUTING -o eth1 -p tcp -m tcp  -s 192.168.1.10 --sport 1000:1010  -j SNAT --to-source 222.222.222.222:1000-1010 

-A POSTROUTING -o eth2  -s 192.168.1.0/24 -j MASQUERADE  

-A POSTROUTING   -s 192.168.1.0/24 -j NETMAP --to 222.222.222.0/24 

-A PREROUTING  -p tcp -m tcp   -d 222.222.222.222 --dport 25 -j DNAT --to-destination 192.168.1.10:25 
-A PREROUTING  -p tcp -m tcp   -d 222.222.222.222 --dport 25 -j DNAT --to-destination 192.168.1.10:25-50
-A PREROUTING  -p icmp -m icmp   -d 222.222.222.222 --icmp-type 8/0  -j DNAT --to-destination 192.168.1.10 
-A PREROUTING  -p tcp -m tcp  --sport 1000:1010  -d 222.222.222.222 -j DNAT --to-destination 192.168.1.10 
-A PREROUTING  -p tcp -m tcp   -d 222.222.222.222 --dport 4000:4010 -j DNAT --to-destination 192.168.1.10:4000-4010 
-A PREROUTING  -p tcp -m tcp -m multiport   -d 222.222.222.222 --dports 6667,3128,113,53,21,80,119,25,22,23,540,70,13,2105,443 -j DNAT --to-destination 192.168.1.10 

-A PREROUTING -d 222.222.222.13/32 -p tcp -m multiport --dports 1720,3230:3243 -j DNAT --to-destination 192.168.1.212

# numeric protocol spec
-A PREROUTING -d 192.168.3.145 -i eth0 -p 47 -j DNAT --to-destination 1.1.1.1

# a "no nat" rule
-A POSTROUTING   -s 192.168.1.0/24 -d 192.168.2.0/24 -j ACCEPT  

# redirect rule
-A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 

# a couple of nat rules in chain OUTPUT
-A OUTPUT  -p tcp -m tcp   -d 192.168.1.22 --dport 80 -j DNAT --to-destination 192.168.2.10:80 
-A OUTPUT  -p icmp -m icmp   -d 22.22.22.23 --icmp-type 11/0  -j DNAT --to-destination 192.168.1.10 

COMMIT
