Attachment 875039 Details for Bug 1074427 – iptables with different versions of firewalld

iptables with different versions of firewalld

firewall-report.txt (text/plain), 20.78 KB, created by Mitch Davis on 2014-03-16 04:30:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mitch Davis

Created: 2014-03-16 04:30:11 UTC

Size: 20.78 KB

patch

obsolete

>[root@green ~]# cat /etc/fedora-release 
>Fedora release 19 (SchrÃ¶dingerâs Cat)
>[root@green ~]# uname -r
>3.11.6-x86_64-linode35
>[root@green ~]# rpm -q firewalld iptables
>firewalld-0.3.3-2.fc19.noarch
>iptables-1.4.18-1.fc19.x86_64
>[root@green ~]# rpm -V firewalld iptables
>[root@green ~]# iptables-save
># Generated by iptables-save v1.4.18 on Sun Mar 16 12:40:22 2014
>*security
>:INPUT ACCEPT [244:58738]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [237:146984]
>COMMIT
># Completed on Sun Mar 16 12:40:22 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 12:40:22 2014
>*raw
>:PREROUTING ACCEPT [246:58818]
>:OUTPUT ACCEPT [237:146984]
>COMMIT
># Completed on Sun Mar 16 12:40:22 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 12:40:22 2014
>*nat
>:PREROUTING ACCEPT [8:480]
>:INPUT ACCEPT [8:480]
>:OUTPUT ACCEPT [20:1412]
>:POSTROUTING ACCEPT [20:1412]
>:OUTPUT_direct - [0:0]
>:POSTROUTING_ZONES - [0:0]
>:POSTROUTING_direct - [0:0]
>:POST_ZONE_external - [0:0]
>:POST_ZONE_external_allow - [0:0]
>:POST_ZONE_external_deny - [0:0]
>:POST_ZONE_external_log - [0:0]
>:POST_ZONE_public - [0:0]
>:POST_ZONE_public_allow - [0:0]
>:POST_ZONE_public_deny - [0:0]
>:POST_ZONE_public_log - [0:0]
>:PREROUTING_ZONES - [0:0]
>:PREROUTING_direct - [0:0]
>:PRE_ZONE_public - [0:0]
>:PRE_ZONE_public_allow - [0:0]
>:PRE_ZONE_public_deny - [0:0]
>:PRE_ZONE_public_log - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A PREROUTING -j PREROUTING_ZONES
>-A OUTPUT -j OUTPUT_direct
>-A POSTROUTING -j POSTROUTING_direct
>-A POSTROUTING -j POSTROUTING_ZONES
>-A POSTROUTING_ZONES -g POST_ZONE_public
>-A POST_ZONE_external -j POST_ZONE_external_log
>-A POST_ZONE_external -j POST_ZONE_external_deny
>-A POST_ZONE_external -j POST_ZONE_external_allow
>-A POST_ZONE_external_allow ! -i lo -j MASQUERADE
>-A POST_ZONE_public -j POST_ZONE_public_log
>-A POST_ZONE_public -j POST_ZONE_public_deny
>-A POST_ZONE_public -j POST_ZONE_public_allow
>-A PREROUTING_ZONES -g PRE_ZONE_public
>-A PRE_ZONE_public -j PRE_ZONE_public_log
>-A PRE_ZONE_public -j PRE_ZONE_public_deny
>-A PRE_ZONE_public -j PRE_ZONE_public_allow
>COMMIT
># Completed on Sun Mar 16 12:40:22 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 12:40:22 2014
>*mangle
>:PREROUTING ACCEPT [237:57329]
>:INPUT ACCEPT [237:57329]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [226:145412]
>:POSTROUTING ACCEPT [226:145412]
>:FORWARD_direct - [0:0]
>:INPUT_direct - [0:0]
>:OUTPUT_direct - [0:0]
>:POSTROUTING_direct - [0:0]
>:PREROUTING_ZONES - [0:0]
>:PREROUTING_direct - [0:0]
>:PRE_ZONE_public - [0:0]
>:PRE_ZONE_public_allow - [0:0]
>:PRE_ZONE_public_deny - [0:0]
>:PRE_ZONE_public_log - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A PREROUTING -j PREROUTING_ZONES
>-A INPUT -j INPUT_direct
>-A FORWARD -j FORWARD_direct
>-A OUTPUT -j OUTPUT_direct
>-A POSTROUTING -j POSTROUTING_direct
>-A PREROUTING_ZONES -g PRE_ZONE_public
>-A PRE_ZONE_public -j PRE_ZONE_public_log
>-A PRE_ZONE_public -j PRE_ZONE_public_deny
>-A PRE_ZONE_public -j PRE_ZONE_public_allow
>COMMIT
># Completed on Sun Mar 16 12:40:22 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 12:40:22 2014
>*filter
>:INPUT ACCEPT [0:0]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [226:145412]
>:FORWARD_IN_ZONES - [0:0]
>:FORWARD_OUT_ZONES - [0:0]
>:FORWARD_direct - [0:0]
>:FWDI_ZONE_public - [0:0]
>:FWDI_ZONE_public_allow - [0:0]
>:FWDI_ZONE_public_deny - [0:0]
>:FWDI_ZONE_public_log - [0:0]
>:FWDO_ZONE_external - [0:0]
>:FWDO_ZONE_external_allow - [0:0]
>:FWDO_ZONE_external_deny - [0:0]
>:FWDO_ZONE_external_log - [0:0]
>:FWDO_ZONE_public - [0:0]
>:FWDO_ZONE_public_allow - [0:0]
>:FWDO_ZONE_public_deny - [0:0]
>:FWDO_ZONE_public_log - [0:0]
>:INPUT_ZONES - [0:0]
>:INPUT_direct - [0:0]
>:IN_ZONE_dmz - [0:0]
>:IN_ZONE_dmz_allow - [0:0]
>:IN_ZONE_dmz_deny - [0:0]
>:IN_ZONE_dmz_log - [0:0]
>:IN_ZONE_external - [0:0]
>:IN_ZONE_external_allow - [0:0]
>:IN_ZONE_external_deny - [0:0]
>:IN_ZONE_external_log - [0:0]
>:IN_ZONE_home - [0:0]
>:IN_ZONE_home_allow - [0:0]
>:IN_ZONE_home_deny - [0:0]
>:IN_ZONE_home_log - [0:0]
>:IN_ZONE_internal - [0:0]
>:IN_ZONE_internal_allow - [0:0]
>:IN_ZONE_internal_deny - [0:0]
>:IN_ZONE_internal_log - [0:0]
>:IN_ZONE_public - [0:0]
>:IN_ZONE_public_allow - [0:0]
>:IN_ZONE_public_deny - [0:0]
>:IN_ZONE_public_log - [0:0]
>:IN_ZONE_work - [0:0]
>:IN_ZONE_work_allow - [0:0]
>:IN_ZONE_work_deny - [0:0]
>:IN_ZONE_work_log - [0:0]
>:OUTPUT_direct - [0:0]
>-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>-A INPUT -i lo -j ACCEPT
>-A INPUT -j INPUT_direct
>-A INPUT -j INPUT_ZONES
>-A INPUT -p icmp -j ACCEPT
>-A INPUT -j REJECT --reject-with icmp-host-prohibited
>-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>-A FORWARD -i lo -j ACCEPT
>-A FORWARD -j FORWARD_direct
>-A FORWARD -j FORWARD_IN_ZONES
>-A FORWARD -j FORWARD_OUT_ZONES
>-A FORWARD -p icmp -j ACCEPT
>-A FORWARD -j REJECT --reject-with icmp-host-prohibited
>-A OUTPUT -j OUTPUT_direct
>-A FORWARD_IN_ZONES -g FWDI_ZONE_public
>-A FORWARD_OUT_ZONES -g FWDO_ZONE_public
>-A FWDI_ZONE_public -j FWDI_ZONE_public_log
>-A FWDI_ZONE_public -j FWDI_ZONE_public_deny
>-A FWDI_ZONE_public -j FWDI_ZONE_public_allow
>-A FWDO_ZONE_external -j FWDO_ZONE_external_log
>-A FWDO_ZONE_external -j FWDO_ZONE_external_deny
>-A FWDO_ZONE_external -j FWDO_ZONE_external_allow
>-A FWDO_ZONE_external_allow -j ACCEPT
>-A FWDO_ZONE_public -j FWDO_ZONE_public_log
>-A FWDO_ZONE_public -j FWDO_ZONE_public_deny
>-A FWDO_ZONE_public -j FWDO_ZONE_public_allow
>-A INPUT_ZONES -g IN_ZONE_public
>-A IN_ZONE_dmz -j IN_ZONE_dmz_log
>-A IN_ZONE_dmz -j IN_ZONE_dmz_deny
>-A IN_ZONE_dmz -j IN_ZONE_dmz_allow
>-A IN_ZONE_dmz_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_external -j IN_ZONE_external_log
>-A IN_ZONE_external -j IN_ZONE_external_deny
>-A IN_ZONE_external -j IN_ZONE_external_allow
>-A IN_ZONE_external_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_home -j IN_ZONE_home_log
>-A IN_ZONE_home -j IN_ZONE_home_deny
>-A IN_ZONE_home -j IN_ZONE_home_allow
>-A IN_ZONE_home_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_home_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_home_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_internal -j IN_ZONE_internal_log
>-A IN_ZONE_internal -j IN_ZONE_internal_deny
>-A IN_ZONE_internal -j IN_ZONE_internal_allow
>-A IN_ZONE_internal_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_internal_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_internal_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_public -j IN_ZONE_public_log
>-A IN_ZONE_public -j IN_ZONE_public_deny
>-A IN_ZONE_public -j IN_ZONE_public_allow
>-A IN_ZONE_public_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_public_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_public_allow -p tcp -m tcp --dport 25 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_public_allow -p tcp -m tcp --dport 25565 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_work -j IN_ZONE_work_log
>-A IN_ZONE_work -j IN_ZONE_work_deny
>-A IN_ZONE_work -j IN_ZONE_work_allow
>-A IN_ZONE_work_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_work_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_work_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j ACCEPT
>COMMIT
># Completed on Sun Mar 16 12:40:22 2014
>[root@green ~]# > /var/log/firewalld 
>[root@green ~]# yum update firewalld
>updates/19/x86_64/metalink                               |  14 kB     00:00     
>updates                                                  | 4.7 kB     00:00     
>Resolving Dependencies
>--> Running transaction check
>---> Package firewalld.noarch 0:0.3.3-2.fc19 will be updated
>---> Package firewalld.noarch 0:0.3.9.3-1.fc19 will be an update
>--> Finished Dependency Resolution
>
>Dependencies Resolved
>
>================================================================================
> Package           Arch           Version                 Repository       Size
>================================================================================
>Updating:
> firewalld         noarch         0.3.9.3-1.fc19          updates         470 k
>
>Transaction Summary
>================================================================================
>Upgrade  1 Package
>
>Total download size: 470 k
>Is this ok [y/d/N]: y
>Downloading packages:
>Not downloading deltainfo for updates, MD is 2.2 M and rpms are 470 k
>firewalld-0.3.9.3-1.fc19.noarch.rpm                        | 470 kB   00:01     
>Running transaction check
>Running transaction test
>Transaction test succeeded
>Running transaction
>  Updating   : firewalld-0.3.9.3-1.fc19.noarch                              1/2 
>  Cleanup    : firewalld-0.3.3-2.fc19.noarch                                2/2 
>  Verifying  : firewalld-0.3.9.3-1.fc19.noarch                              1/2 
>  Verifying  : firewalld-0.3.3-2.fc19.noarch                                2/2 
>
>Updated:
>  firewalld.noarch 0:0.3.9.3-1.fc19                                             
>
>Complete!
>[root@green ~]# 
>
>[root@green ~]# firewall-cmd --state
>not running
>[root@green ~]# 
>[root@green ~]# iptables-save 
># Generated by iptables-save v1.4.18 on Sun Mar 16 15:26:34 2014
>*security
>:INPUT ACCEPT [2738:475139]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [3831:496185]
>:FORWARD_direct - [0:0]
>:INPUT_direct - [0:0]
>:OUTPUT_direct - [0:0]
>-A INPUT -j INPUT_direct
>-A FORWARD -j FORWARD_direct
>-A OUTPUT -j OUTPUT_direct
>COMMIT
># Completed on Sun Mar 16 15:26:34 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 15:26:34 2014
>*raw
>:PREROUTING ACCEPT [2977:490247]
>:OUTPUT ACCEPT [3831:496185]
>:OUTPUT_direct - [0:0]
>:PREROUTING_direct - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A OUTPUT -j OUTPUT_direct
>COMMIT
># Completed on Sun Mar 16 15:26:34 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 15:26:34 2014
>*nat
>:PREROUTING ACCEPT [237:15028]
>:INPUT ACCEPT [0:0]
>:OUTPUT ACCEPT [510:30626]
>:POSTROUTING ACCEPT [510:30626]
>:OUTPUT_direct - [0:0]
>:POSTROUTING_ZONES - [0:0]
>:POSTROUTING_ZONES_SOURCE - [0:0]
>:POSTROUTING_direct - [0:0]
>:PREROUTING_ZONES - [0:0]
>:PREROUTING_ZONES_SOURCE - [0:0]
>:PREROUTING_direct - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A PREROUTING -j PREROUTING_ZONES_SOURCE
>-A PREROUTING -j PREROUTING_ZONES
>-A OUTPUT -j OUTPUT_direct
>-A POSTROUTING -j POSTROUTING_direct
>-A POSTROUTING -j POSTROUTING_ZONES_SOURCE
>-A POSTROUTING -j POSTROUTING_ZONES
>COMMIT
># Completed on Sun Mar 16 15:26:34 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 15:26:34 2014
>*mangle
>:PREROUTING ACCEPT [2977:490247]
>:INPUT ACCEPT [2977:490247]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [3831:496185]
>:POSTROUTING ACCEPT [3831:496185]
>:FORWARD_direct - [0:0]
>:INPUT_direct - [0:0]
>:OUTPUT_direct - [0:0]
>:POSTROUTING_direct - [0:0]
>:PREROUTING_ZONES - [0:0]
>:PREROUTING_ZONES_SOURCE - [0:0]
>:PREROUTING_direct - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A PREROUTING -j PREROUTING_ZONES_SOURCE
>-A PREROUTING -j PREROUTING_ZONES
>-A INPUT -j INPUT_direct
>-A FORWARD -j FORWARD_direct
>-A OUTPUT -j OUTPUT_direct
>-A POSTROUTING -j POSTROUTING_direct
>COMMIT
># Completed on Sun Mar 16 15:26:34 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 15:26:34 2014
>*filter
>:INPUT ACCEPT [0:0]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [3831:496185]
>:FORWARD_IN_ZONES - [0:0]
>:FORWARD_IN_ZONES_SOURCE - [0:0]
>:FORWARD_OUT_ZONES - [0:0]
>:FORWARD_OUT_ZONES_SOURCE - [0:0]
>:FORWARD_direct - [0:0]
>:INPUT_ZONES - [0:0]
>:INPUT_ZONES_SOURCE - [0:0]
>:INPUT_direct - [0:0]
>:OUTPUT_direct - [0:0]
>-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>-A INPUT -i lo -j ACCEPT
>-A INPUT -j INPUT_direct
>-A INPUT -j INPUT_ZONES_SOURCE
>-A INPUT -j INPUT_ZONES
>-A INPUT -p icmp -j ACCEPT
>-A INPUT -j REJECT --reject-with icmp-host-prohibited
>-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>-A FORWARD -i lo -j ACCEPT
>-A FORWARD -j FORWARD_direct
>-A FORWARD -j FORWARD_IN_ZONES_SOURCE
>-A FORWARD -j FORWARD_IN_ZONES
>-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
>-A FORWARD -j FORWARD_OUT_ZONES
>-A FORWARD -p icmp -j ACCEPT
>-A FORWARD -j REJECT --reject-with icmp-host-prohibited
>-A OUTPUT -j OUTPUT_direct
>COMMIT
># Completed on Sun Mar 16 15:26:34 2014
>[root@green ~]# 
>[root@green ~]# yum downgrade firewalld
>Resolving Dependencies
>--> Running transaction check
>---> Package firewalld.noarch 0:0.3.3-2.fc19 will be a downgrade
>---> Package firewalld.noarch 0:0.3.9.3-1.fc19 will be erased
>--> Finished Dependency Resolution
>
>Dependencies Resolved
>
>================================================================================
> Package            Arch            Version               Repository       Size
>================================================================================
>Downgrading:
> firewalld          noarch          0.3.3-2.fc19          fedora          313 k
>
>Transaction Summary
>================================================================================
>Downgrade  1 Package
>
>Total download size: 313 k
>Is this ok [y/d/N]: y
>Downloading packages:
>firewalld-0.3.3-2.fc19.noarch.rpm                          | 313 kB   00:00     
>Running transaction check
>Running transaction test
>Transaction test succeeded
>Running transaction
>  Installing : firewalld-0.3.3-2.fc19.noarch                                1/2 
>  Cleanup    : firewalld-0.3.9.3-1.fc19.noarch                              2/2 
>  Verifying  : firewalld-0.3.3-2.fc19.noarch                                1/2 
>  Verifying  : firewalld-0.3.9.3-1.fc19.noarch                              2/2 
>
>Removed:
>  firewalld.noarch 0:0.3.9.3-1.fc19                                             
>
>Installed:
>  firewalld.noarch 0:0.3.3-2.fc19                                               
>
>Complete!
>[root@green ~]# iptables-save 
># Generated by iptables-save v1.4.18 on Sun Mar 16 15:28:51 2014
>*security
>:INPUT ACCEPT [165:32458]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [134:112333]
>COMMIT
># Completed on Sun Mar 16 15:28:51 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 15:28:51 2014
>*raw
>:PREROUTING ACCEPT [166:32510]
>:OUTPUT ACCEPT [134:112333]
>COMMIT
># Completed on Sun Mar 16 15:28:51 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 15:28:51 2014
>*nat
>:PREROUTING ACCEPT [6:360]
>:INPUT ACCEPT [6:360]
>:OUTPUT ACCEPT [10:616]
>:POSTROUTING ACCEPT [10:616]
>:OUTPUT_direct - [0:0]
>:POSTROUTING_ZONES - [0:0]
>:POSTROUTING_direct - [0:0]
>:POST_ZONE_external - [0:0]
>:POST_ZONE_external_allow - [0:0]
>:POST_ZONE_external_deny - [0:0]
>:POST_ZONE_external_log - [0:0]
>:POST_ZONE_public - [0:0]
>:POST_ZONE_public_allow - [0:0]
>:POST_ZONE_public_deny - [0:0]
>:POST_ZONE_public_log - [0:0]
>:PREROUTING_ZONES - [0:0]
>:PREROUTING_direct - [0:0]
>:PRE_ZONE_public - [0:0]
>:PRE_ZONE_public_allow - [0:0]
>:PRE_ZONE_public_deny - [0:0]
>:PRE_ZONE_public_log - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A PREROUTING -j PREROUTING_ZONES
>-A OUTPUT -j OUTPUT_direct
>-A POSTROUTING -j POSTROUTING_direct
>-A POSTROUTING -j POSTROUTING_ZONES
>-A POSTROUTING_ZONES -g POST_ZONE_public
>-A POST_ZONE_external -j POST_ZONE_external_log
>-A POST_ZONE_external -j POST_ZONE_external_deny
>-A POST_ZONE_external -j POST_ZONE_external_allow
>-A POST_ZONE_external_allow ! -i lo -j MASQUERADE
>-A POST_ZONE_public -j POST_ZONE_public_log
>-A POST_ZONE_public -j POST_ZONE_public_deny
>-A POST_ZONE_public -j POST_ZONE_public_allow
>-A PREROUTING_ZONES -g PRE_ZONE_public
>-A PRE_ZONE_public -j PRE_ZONE_public_log
>-A PRE_ZONE_public -j PRE_ZONE_public_deny
>-A PRE_ZONE_public -j PRE_ZONE_public_allow
>COMMIT
># Completed on Sun Mar 16 15:28:51 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 15:28:51 2014
>*mangle
>:PREROUTING ACCEPT [165:32458]
>:INPUT ACCEPT [165:32458]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [133:112253]
>:POSTROUTING ACCEPT [133:112253]
>:FORWARD_direct - [0:0]
>:INPUT_direct - [0:0]
>:OUTPUT_direct - [0:0]
>:POSTROUTING_direct - [0:0]
>:PREROUTING_ZONES - [0:0]
>:PREROUTING_direct - [0:0]
>:PRE_ZONE_public - [0:0]
>:PRE_ZONE_public_allow - [0:0]
>:PRE_ZONE_public_deny - [0:0]
>:PRE_ZONE_public_log - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A PREROUTING -j PREROUTING_ZONES
>-A INPUT -j INPUT_direct
>-A FORWARD -j FORWARD_direct
>-A OUTPUT -j OUTPUT_direct
>-A POSTROUTING -j POSTROUTING_direct
>-A PREROUTING_ZONES -g PRE_ZONE_public
>-A PRE_ZONE_public -j PRE_ZONE_public_log
>-A PRE_ZONE_public -j PRE_ZONE_public_deny
>-A PRE_ZONE_public -j PRE_ZONE_public_allow
>COMMIT
># Completed on Sun Mar 16 15:28:51 2014
># Generated by iptables-save v1.4.18 on Sun Mar 16 15:28:51 2014
>*filter
>:INPUT ACCEPT [0:0]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [133:112253]
>:FORWARD_IN_ZONES - [0:0]
>:FORWARD_OUT_ZONES - [0:0]
>:FORWARD_direct - [0:0]
>:FWDI_ZONE_public - [0:0]
>:FWDI_ZONE_public_allow - [0:0]
>:FWDI_ZONE_public_deny - [0:0]
>:FWDI_ZONE_public_log - [0:0]
>:FWDO_ZONE_external - [0:0]
>:FWDO_ZONE_external_allow - [0:0]
>:FWDO_ZONE_external_deny - [0:0]
>:FWDO_ZONE_external_log - [0:0]
>:FWDO_ZONE_public - [0:0]
>:FWDO_ZONE_public_allow - [0:0]
>:FWDO_ZONE_public_deny - [0:0]
>:FWDO_ZONE_public_log - [0:0]
>:INPUT_ZONES - [0:0]
>:INPUT_direct - [0:0]
>:IN_ZONE_dmz - [0:0]
>:IN_ZONE_dmz_allow - [0:0]
>:IN_ZONE_dmz_deny - [0:0]
>:IN_ZONE_dmz_log - [0:0]
>:IN_ZONE_external - [0:0]
>:IN_ZONE_external_allow - [0:0]
>:IN_ZONE_external_deny - [0:0]
>:IN_ZONE_external_log - [0:0]
>:IN_ZONE_home - [0:0]
>:IN_ZONE_home_allow - [0:0]
>:IN_ZONE_home_deny - [0:0]
>:IN_ZONE_home_log - [0:0]
>:IN_ZONE_internal - [0:0]
>:IN_ZONE_internal_allow - [0:0]
>:IN_ZONE_internal_deny - [0:0]
>:IN_ZONE_internal_log - [0:0]
>:IN_ZONE_public - [0:0]
>:IN_ZONE_public_allow - [0:0]
>:IN_ZONE_public_deny - [0:0]
>:IN_ZONE_public_log - [0:0]
>:IN_ZONE_work - [0:0]
>:IN_ZONE_work_allow - [0:0]
>:IN_ZONE_work_deny - [0:0]
>:IN_ZONE_work_log - [0:0]
>:OUTPUT_direct - [0:0]
>-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>-A INPUT -i lo -j ACCEPT
>-A INPUT -j INPUT_direct
>-A INPUT -j INPUT_ZONES
>-A INPUT -p icmp -j ACCEPT
>-A INPUT -j REJECT --reject-with icmp-host-prohibited
>-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>-A FORWARD -i lo -j ACCEPT
>-A FORWARD -j FORWARD_direct
>-A FORWARD -j FORWARD_IN_ZONES
>-A FORWARD -j FORWARD_OUT_ZONES
>-A FORWARD -p icmp -j ACCEPT
>-A FORWARD -j REJECT --reject-with icmp-host-prohibited
>-A OUTPUT -j OUTPUT_direct
>-A FORWARD_IN_ZONES -g FWDI_ZONE_public
>-A FORWARD_OUT_ZONES -g FWDO_ZONE_public
>-A FWDI_ZONE_public -j FWDI_ZONE_public_log
>-A FWDI_ZONE_public -j FWDI_ZONE_public_deny
>-A FWDI_ZONE_public -j FWDI_ZONE_public_allow
>-A FWDO_ZONE_external -j FWDO_ZONE_external_log
>-A FWDO_ZONE_external -j FWDO_ZONE_external_deny
>-A FWDO_ZONE_external -j FWDO_ZONE_external_allow
>-A FWDO_ZONE_external_allow -j ACCEPT
>-A FWDO_ZONE_public -j FWDO_ZONE_public_log
>-A FWDO_ZONE_public -j FWDO_ZONE_public_deny
>-A FWDO_ZONE_public -j FWDO_ZONE_public_allow
>-A INPUT_ZONES -g IN_ZONE_public
>-A IN_ZONE_dmz -j IN_ZONE_dmz_log
>-A IN_ZONE_dmz -j IN_ZONE_dmz_deny
>-A IN_ZONE_dmz -j IN_ZONE_dmz_allow
>-A IN_ZONE_dmz_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_external -j IN_ZONE_external_log
>-A IN_ZONE_external -j IN_ZONE_external_deny
>-A IN_ZONE_external -j IN_ZONE_external_allow
>-A IN_ZONE_external_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_home -j IN_ZONE_home_log
>-A IN_ZONE_home -j IN_ZONE_home_deny
>-A IN_ZONE_home -j IN_ZONE_home_allow
>-A IN_ZONE_home_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_home_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_home_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_internal -j IN_ZONE_internal_log
>-A IN_ZONE_internal -j IN_ZONE_internal_deny
>-A IN_ZONE_internal -j IN_ZONE_internal_allow
>-A IN_ZONE_internal_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_internal_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_internal_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_public -j IN_ZONE_public_log
>-A IN_ZONE_public -j IN_ZONE_public_deny
>-A IN_ZONE_public -j IN_ZONE_public_allow
>-A IN_ZONE_public_allow -p tcp -m tcp --dport 25 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_public_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_public_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_public_allow -p tcp -m tcp --dport 25565 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_work -j IN_ZONE_work_log
>-A IN_ZONE_work -j IN_ZONE_work_deny
>-A IN_ZONE_work -j IN_ZONE_work_allow
>-A IN_ZONE_work_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_work_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_ZONE_work_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j ACCEPT
>COMMIT
># Completed on Sun Mar 16 15:28:51 2014
>[root@green ~]#

Actions: View

Attachments on bug 1074427: 873264 | 873265 | 875039 | 875051