Attachment 876342 Details for Bug 1076857 – Output of iptables-save with firewalld-0.3.8-1.fc19

Output of iptables-save with firewalld-0.3.8-1.fc19

iptables-save-0.3.8-1.fc19.txt (text/plain), 12.86 KB, created by Rok Mandeljc on 2014-03-19 13:20:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rok Mandeljc

Created: 2014-03-19 13:20:54 UTC

Size: 12.86 KB

patch

obsolete

># Generated by iptables-save v1.4.18 on Wed Mar 19 13:58:18 2014
>*nat
>:PREROUTING ACCEPT [310873:22705545]
>:INPUT ACCEPT [24331:3357278]
>:OUTPUT ACCEPT [11901:1292159]
>:POSTROUTING ACCEPT [0:0]
>:OUTPUT_direct - [0:0]
>:POSTROUTING_ZONES - [0:0]
>:POSTROUTING_ZONES_SOURCE - [0:0]
>:POSTROUTING_direct - [0:0]
>:POST_external - [0:0]
>:POST_external_allow - [0:0]
>:POST_external_deny - [0:0]
>:POST_external_log - [0:0]
>:POST_public - [0:0]
>:POST_public_allow - [0:0]
>:POST_public_deny - [0:0]
>:POST_public_log - [0:0]
>:POST_trusted - [0:0]
>:POST_trusted_allow - [0:0]
>:POST_trusted_deny - [0:0]
>:POST_trusted_log - [0:0]
>:POST_work - [0:0]
>:POST_work_allow - [0:0]
>:POST_work_deny - [0:0]
>:POST_work_log - [0:0]
>:PREROUTING_ZONES - [0:0]
>:PREROUTING_ZONES_SOURCE - [0:0]
>:PREROUTING_direct - [0:0]
>:PRE_public - [0:0]
>:PRE_public_allow - [0:0]
>:PRE_public_deny - [0:0]
>:PRE_public_log - [0:0]
>:PRE_trusted - [0:0]
>:PRE_trusted_allow - [0:0]
>:PRE_trusted_deny - [0:0]
>:PRE_trusted_log - [0:0]
>:PRE_work - [0:0]
>:PRE_work_allow - [0:0]
>:PRE_work_deny - [0:0]
>:PRE_work_log - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A PREROUTING -j PREROUTING_ZONES_SOURCE
>-A PREROUTING -j PREROUTING_ZONES
>-A OUTPUT -j OUTPUT_direct
>-A POSTROUTING -j POSTROUTING_direct
>-A POSTROUTING -j POSTROUTING_ZONES_SOURCE
>-A POSTROUTING -j POSTROUTING_ZONES
>-A POSTROUTING_ZONES -o ens256 -j POST_trusted
>-A POSTROUTING_ZONES -o ens224 -j POST_work
>-A POSTROUTING_ZONES -o ens192 -j POST_public
>-A POSTROUTING_ZONES -j POST_public
>-A POST_external -j POST_external_log
>-A POST_external -j POST_external_deny
>-A POST_external -j POST_external_allow
>-A POST_external_allow ! -i lo -j MASQUERADE
>-A POST_public -j POST_public_log
>-A POST_public -j POST_public_deny
>-A POST_public -j POST_public_allow
>-A POST_public_allow ! -i lo -j MASQUERADE
>-A POST_trusted -j POST_trusted_log
>-A POST_trusted -j POST_trusted_deny
>-A POST_trusted -j POST_trusted_allow
>-A POST_trusted -j ACCEPT
>-A POST_work -j POST_work_log
>-A POST_work -j POST_work_deny
>-A POST_work -j POST_work_allow
>-A PREROUTING_ZONES -i ens256 -j PRE_trusted
>-A PREROUTING_ZONES -i ens224 -j PRE_work
>-A PREROUTING_ZONES -i ens192 -j PRE_public
>-A PREROUTING_ZONES -j PRE_public
>-A PRE_public -j PRE_public_log
>-A PRE_public -j PRE_public_deny
>-A PRE_public -j PRE_public_allow
>-A PRE_public_allow -p tcp -m mark --mark 0x64 -j DNAT --to-destination 192.168.90.28:22
>-A PRE_public_allow -p tcp -m mark --mark 0x65 -j DNAT --to-destination 192.168.90.25:22
>-A PRE_public_allow -p tcp -m mark --mark 0x66 -j DNAT --to-destination :22
>-A PRE_public_allow -p tcp -m mark --mark 0x67 -j DNAT --to-destination 192.168.90.19:22
>-A PRE_trusted -j PRE_trusted_log
>-A PRE_trusted -j PRE_trusted_deny
>-A PRE_trusted -j PRE_trusted_allow
>-A PRE_trusted -j ACCEPT
>-A PRE_work -j PRE_work_log
>-A PRE_work -j PRE_work_deny
>-A PRE_work -j PRE_work_allow
>COMMIT
># Completed on Wed Mar 19 13:58:18 2014
># Generated by iptables-save v1.4.18 on Wed Mar 19 13:58:18 2014
>*mangle
>:PREROUTING ACCEPT [3088473:2363212498]
>:INPUT ACCEPT [1473109:1106000246]
>:FORWARD ACCEPT [1545180:1254831476]
>:OUTPUT ACCEPT [1054783:848830284]
>:POSTROUTING ACCEPT [2606472:2104848930]
>:FORWARD_direct - [0:0]
>:INPUT_direct - [0:0]
>:OUTPUT_direct - [0:0]
>:POSTROUTING_direct - [0:0]
>:PREROUTING_ZONES - [0:0]
>:PREROUTING_ZONES_SOURCE - [0:0]
>:PREROUTING_direct - [0:0]
>:PRE_public - [0:0]
>:PRE_public_allow - [0:0]
>:PRE_public_deny - [0:0]
>:PRE_public_log - [0:0]
>:PRE_trusted - [0:0]
>:PRE_trusted_allow - [0:0]
>:PRE_trusted_deny - [0:0]
>:PRE_trusted_log - [0:0]
>:PRE_work - [0:0]
>:PRE_work_allow - [0:0]
>:PRE_work_deny - [0:0]
>:PRE_work_log - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A PREROUTING -j PREROUTING_ZONES_SOURCE
>-A PREROUTING -j PREROUTING_ZONES
>-A INPUT -j INPUT_direct
>-A FORWARD -j FORWARD_direct
>-A OUTPUT -j OUTPUT_direct
>-A POSTROUTING -j POSTROUTING_direct
>-A PREROUTING_ZONES -i ens256 -j PRE_trusted
>-A PREROUTING_ZONES -i ens224 -j PRE_work
>-A PREROUTING_ZONES -i ens192 -j PRE_public
>-A PREROUTING_ZONES -j PRE_public
>-A PRE_public -j PRE_public_log
>-A PRE_public -j PRE_public_deny
>-A PRE_public -j PRE_public_allow
>-A PRE_public_allow -p tcp -m tcp --dport 9022 -j MARK --set-xmark 0x64/0xffffffff
>-A PRE_public_allow -p tcp -m tcp --dport 9024 -j MARK --set-xmark 0x65/0xffffffff
>-A PRE_public_allow -p tcp -m tcp --dport 6022 -j MARK --set-xmark 0x66/0xffffffff
>-A PRE_public_allow -p tcp -m tcp --dport 9023 -j MARK --set-xmark 0x67/0xffffffff
>-A PRE_trusted -j PRE_trusted_log
>-A PRE_trusted -j PRE_trusted_deny
>-A PRE_trusted -j PRE_trusted_allow
>-A PRE_trusted -j ACCEPT
>-A PRE_work -j PRE_work_log
>-A PRE_work -j PRE_work_deny
>-A PRE_work -j PRE_work_allow
>COMMIT
># Completed on Wed Mar 19 13:58:18 2014
># Generated by iptables-save v1.4.18 on Wed Mar 19 13:58:18 2014
>*security
>:INPUT ACCEPT [1261186:1090268248]
>:FORWARD ACCEPT [1545180:1254831476]
>:OUTPUT ACCEPT [1054790:848831572]
>:FORWARD_direct - [0:0]
>:INPUT_direct - [0:0]
>:OUTPUT_direct - [0:0]
>-A INPUT -j INPUT_direct
>-A FORWARD -j FORWARD_direct
>-A OUTPUT -j OUTPUT_direct
>COMMIT
># Completed on Wed Mar 19 13:58:18 2014
># Generated by iptables-save v1.4.18 on Wed Mar 19 13:58:18 2014
>*raw
>:PREROUTING ACCEPT [3105755:2366078108]
>:OUTPUT ACCEPT [1054790:848831572]
>:OUTPUT_direct - [0:0]
>:PREROUTING_direct - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A OUTPUT -j OUTPUT_direct
>COMMIT
># Completed on Wed Mar 19 13:58:18 2014
># Generated by iptables-save v1.4.18 on Wed Mar 19 13:58:18 2014
>*filter
>:INPUT ACCEPT [0:0]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [1054783:848830284]
>:FORWARD_IN_ZONES - [0:0]
>:FORWARD_IN_ZONES_SOURCE - [0:0]
>:FORWARD_OUT_ZONES - [0:0]
>:FORWARD_OUT_ZONES_SOURCE - [0:0]
>:FORWARD_direct - [0:0]
>:FWDI_public - [0:0]
>:FWDI_public_allow - [0:0]
>:FWDI_public_deny - [0:0]
>:FWDI_public_log - [0:0]
>:FWDI_trusted - [0:0]
>:FWDI_trusted_allow - [0:0]
>:FWDI_trusted_deny - [0:0]
>:FWDI_trusted_log - [0:0]
>:FWDI_work - [0:0]
>:FWDI_work_allow - [0:0]
>:FWDI_work_deny - [0:0]
>:FWDI_work_log - [0:0]
>:FWDO_external - [0:0]
>:FWDO_external_allow - [0:0]
>:FWDO_external_deny - [0:0]
>:FWDO_external_log - [0:0]
>:FWDO_public - [0:0]
>:FWDO_public_allow - [0:0]
>:FWDO_public_deny - [0:0]
>:FWDO_public_log - [0:0]
>:FWDO_trusted - [0:0]
>:FWDO_trusted_allow - [0:0]
>:FWDO_trusted_deny - [0:0]
>:FWDO_trusted_log - [0:0]
>:FWDO_work - [0:0]
>:FWDO_work_allow - [0:0]
>:FWDO_work_deny - [0:0]
>:FWDO_work_log - [0:0]
>:INPUT_ZONES - [0:0]
>:INPUT_ZONES_SOURCE - [0:0]
>:INPUT_direct - [0:0]
>:IN_dmz - [0:0]
>:IN_dmz_allow - [0:0]
>:IN_dmz_deny - [0:0]
>:IN_dmz_log - [0:0]
>:IN_external - [0:0]
>:IN_external_allow - [0:0]
>:IN_external_deny - [0:0]
>:IN_external_log - [0:0]
>:IN_home - [0:0]
>:IN_home_allow - [0:0]
>:IN_home_deny - [0:0]
>:IN_home_log - [0:0]
>:IN_internal - [0:0]
>:IN_internal_allow - [0:0]
>:IN_internal_deny - [0:0]
>:IN_internal_log - [0:0]
>:IN_public - [0:0]
>:IN_public_allow - [0:0]
>:IN_public_deny - [0:0]
>:IN_public_log - [0:0]
>:IN_trusted - [0:0]
>:IN_trusted_allow - [0:0]
>:IN_trusted_deny - [0:0]
>:IN_trusted_log - [0:0]
>:IN_work - [0:0]
>:IN_work_allow - [0:0]
>:IN_work_deny - [0:0]
>:IN_work_log - [0:0]
>:OUTPUT_direct - [0:0]
>-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>-A INPUT -i lo -j ACCEPT
>-A INPUT -j INPUT_direct
>-A INPUT -j INPUT_ZONES_SOURCE
>-A INPUT -j INPUT_ZONES
>-A INPUT -p icmp -j ACCEPT
>-A INPUT -j REJECT --reject-with icmp-host-prohibited
>-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>-A FORWARD -i lo -j ACCEPT
>-A FORWARD -j FORWARD_direct
>-A FORWARD -j FORWARD_IN_ZONES_SOURCE
>-A FORWARD -j FORWARD_IN_ZONES
>-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
>-A FORWARD -j FORWARD_OUT_ZONES
>-A FORWARD -p icmp -j ACCEPT
>-A FORWARD -j REJECT --reject-with icmp-host-prohibited
>-A OUTPUT -j OUTPUT_direct
>-A FORWARD_IN_ZONES -i ens256 -j FWDI_trusted
>-A FORWARD_IN_ZONES -i ens224 -j FWDI_work
>-A FORWARD_IN_ZONES -i ens192 -j FWDI_public
>-A FORWARD_IN_ZONES -j FWDI_public
>-A FORWARD_OUT_ZONES -o ens256 -j FWDO_trusted
>-A FORWARD_OUT_ZONES -o ens224 -j FWDO_work
>-A FORWARD_OUT_ZONES -o ens192 -j FWDO_public
>-A FORWARD_OUT_ZONES -j FWDO_public
>-A FWDI_public -j FWDI_public_log
>-A FWDI_public -j FWDI_public_deny
>-A FWDI_public -j FWDI_public_allow
>-A FWDI_public_allow -m conntrack --ctstate NEW -m mark --mark 0x64 -j ACCEPT
>-A FWDI_public_allow -m conntrack --ctstate NEW -m mark --mark 0x65 -j ACCEPT
>-A FWDI_public_allow -m conntrack --ctstate NEW -m mark --mark 0x67 -j ACCEPT
>-A FWDI_trusted -j FWDI_trusted_log
>-A FWDI_trusted -j FWDI_trusted_deny
>-A FWDI_trusted -j FWDI_trusted_allow
>-A FWDI_trusted -j ACCEPT
>-A FWDI_work -j FWDI_work_log
>-A FWDI_work -j FWDI_work_deny
>-A FWDI_work -j FWDI_work_allow
>-A FWDO_external -j FWDO_external_log
>-A FWDO_external -j FWDO_external_deny
>-A FWDO_external -j FWDO_external_allow
>-A FWDO_external_allow -j ACCEPT
>-A FWDO_public -j FWDO_public_log
>-A FWDO_public -j FWDO_public_deny
>-A FWDO_public -j FWDO_public_allow
>-A FWDO_public_allow -j ACCEPT
>-A FWDO_trusted -j FWDO_trusted_log
>-A FWDO_trusted -j FWDO_trusted_deny
>-A FWDO_trusted -j FWDO_trusted_allow
>-A FWDO_trusted -j ACCEPT
>-A FWDO_work -j FWDO_work_log
>-A FWDO_work -j FWDO_work_deny
>-A FWDO_work -j FWDO_work_allow
>-A INPUT_ZONES -i ens256 -j IN_trusted
>-A INPUT_ZONES -i ens224 -j IN_work
>-A INPUT_ZONES -i ens192 -j IN_public
>-A INPUT_ZONES -j IN_public
>-A IN_dmz -j IN_dmz_log
>-A IN_dmz -j IN_dmz_deny
>-A IN_dmz -j IN_dmz_allow
>-A IN_dmz_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_external -j IN_external_log
>-A IN_external -j IN_external_deny
>-A IN_external -j IN_external_allow
>-A IN_external_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_home -j IN_home_log
>-A IN_home -j IN_home_deny
>-A IN_home -j IN_home_allow
>-A IN_home_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_home_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_home_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_home_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_home_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_internal -j IN_internal_log
>-A IN_internal -j IN_internal_deny
>-A IN_internal -j IN_internal_allow
>-A IN_internal_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_internal_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_internal_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_internal_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_internal_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public -j IN_public_log
>-A IN_public -j IN_public_deny
>-A IN_public -j IN_public_allow
>-A IN_public_allow -m conntrack --ctstate NEW -m mark --mark 0x66 -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 1080 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 1143 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 1389 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 1110 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 1025 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 6021 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 11100:11200 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_trusted -j IN_trusted_log
>-A IN_trusted -j IN_trusted_deny
>-A IN_trusted -j IN_trusted_allow
>-A IN_trusted -j ACCEPT
>-A IN_work -j IN_work_log
>-A IN_work -j IN_work_deny
>-A IN_work -j IN_work_allow
>-A IN_work_allow -p tcp -m tcp --dport 6021 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 11100:11200 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 139 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 445 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 10320 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j ACCEPT
>COMMIT
># Completed on Wed Mar 19 13:58:18 2014

Actions: View

Attachments on bug 1076857: 876342 | 876343