Attachment 876343 Details for Bug 1076857 – Output of iptables-save with firewalld-0.3.9.3-1.fc19

Output of iptables-save with firewalld-0.3.9.3-1.fc19

iptables-save-0.3.9.3-1.fc19.txt (text/plain), 10.44 KB, created by Rok Mandeljc on 2014-03-19 13:21:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rok Mandeljc

Created: 2014-03-19 13:21:23 UTC

Size: 10.44 KB

patch

obsolete

># Generated by iptables-save v1.4.18 on Wed Mar 19 14:00:37 2014
>*nat
>:PREROUTING ACCEPT [56:4428]
>:INPUT ACCEPT [8:735]
>:OUTPUT ACCEPT [0:0]
>:POSTROUTING ACCEPT [0:0]
>:OUTPUT_direct - [0:0]
>:POSTROUTING_ZONES - [0:0]
>:POSTROUTING_ZONES_SOURCE - [0:0]
>:POSTROUTING_direct - [0:0]
>:POST_public - [0:0]
>:POST_public_allow - [0:0]
>:POST_public_deny - [0:0]
>:POST_public_log - [0:0]
>:POST_trusted - [0:0]
>:POST_trusted_allow - [0:0]
>:POST_trusted_deny - [0:0]
>:POST_trusted_log - [0:0]
>:POST_work - [0:0]
>:POST_work_allow - [0:0]
>:POST_work_deny - [0:0]
>:POST_work_log - [0:0]
>:PREROUTING_ZONES - [0:0]
>:PREROUTING_ZONES_SOURCE - [0:0]
>:PREROUTING_direct - [0:0]
>:PRE_public - [0:0]
>:PRE_public_allow - [0:0]
>:PRE_public_deny - [0:0]
>:PRE_public_log - [0:0]
>:PRE_trusted - [0:0]
>:PRE_trusted_allow - [0:0]
>:PRE_trusted_deny - [0:0]
>:PRE_trusted_log - [0:0]
>:PRE_work - [0:0]
>:PRE_work_allow - [0:0]
>:PRE_work_deny - [0:0]
>:PRE_work_log - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A PREROUTING -j PREROUTING_ZONES_SOURCE
>-A PREROUTING -j PREROUTING_ZONES
>-A OUTPUT -j OUTPUT_direct
>-A POSTROUTING -j POSTROUTING_direct
>-A POSTROUTING -j POSTROUTING_ZONES_SOURCE
>-A POSTROUTING -j POSTROUTING_ZONES
>-A POSTROUTING_ZONES -o ens256 -j POST_trusted
>-A POSTROUTING_ZONES -o ens224 -g POST_work
>-A POSTROUTING_ZONES -o ens192 -g POST_public
>-A POSTROUTING_ZONES -g POST_public
>-A POST_public -j POST_public_log
>-A POST_public -j POST_public_deny
>-A POST_public -j POST_public_allow
>-A POST_public_allow ! -i lo -j MASQUERADE
>-A POST_trusted -j POST_trusted_log
>-A POST_trusted -j POST_trusted_deny
>-A POST_trusted -j POST_trusted_allow
>-A POST_work -j POST_work_log
>-A POST_work -j POST_work_deny
>-A POST_work -j POST_work_allow
>-A PREROUTING_ZONES -i ens256 -j PRE_trusted
>-A PREROUTING_ZONES -i ens224 -g PRE_work
>-A PREROUTING_ZONES -i ens192 -g PRE_public
>-A PREROUTING_ZONES -g PRE_public
>-A PRE_public -j PRE_public_log
>-A PRE_public -j PRE_public_deny
>-A PRE_public -j PRE_public_allow
>-A PRE_public_allow -p tcp -m mark --mark 0x64 -j DNAT --to-destination 192.168.90.28:22
>-A PRE_public_allow -p tcp -m mark --mark 0x65 -j DNAT --to-destination 192.168.90.25:22
>-A PRE_public_allow -p tcp -m mark --mark 0x66 -j DNAT --to-destination :22
>-A PRE_public_allow -p tcp -m mark --mark 0x67 -j DNAT --to-destination 192.168.90.19:22
>-A PRE_trusted -j PRE_trusted_log
>-A PRE_trusted -j PRE_trusted_deny
>-A PRE_trusted -j PRE_trusted_allow
>-A PRE_work -j PRE_work_log
>-A PRE_work -j PRE_work_deny
>-A PRE_work -j PRE_work_allow
>COMMIT
># Completed on Wed Mar 19 14:00:37 2014
># Generated by iptables-save v1.4.18 on Wed Mar 19 14:00:37 2014
>*mangle
>:PREROUTING ACCEPT [219:16401]
>:INPUT ACCEPT [206:15648]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [102:21704]
>:POSTROUTING ACCEPT [102:21704]
>:FORWARD_direct - [0:0]
>:INPUT_direct - [0:0]
>:OUTPUT_direct - [0:0]
>:POSTROUTING_direct - [0:0]
>:PREROUTING_ZONES - [0:0]
>:PREROUTING_ZONES_SOURCE - [0:0]
>:PREROUTING_direct - [0:0]
>:PRE_public - [0:0]
>:PRE_public_allow - [0:0]
>:PRE_public_deny - [0:0]
>:PRE_public_log - [0:0]
>:PRE_trusted - [0:0]
>:PRE_trusted_allow - [0:0]
>:PRE_trusted_deny - [0:0]
>:PRE_trusted_log - [0:0]
>:PRE_work - [0:0]
>:PRE_work_allow - [0:0]
>:PRE_work_deny - [0:0]
>:PRE_work_log - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A PREROUTING -j PREROUTING_ZONES_SOURCE
>-A PREROUTING -j PREROUTING_ZONES
>-A INPUT -j INPUT_direct
>-A FORWARD -j FORWARD_direct
>-A OUTPUT -j OUTPUT_direct
>-A POSTROUTING -j POSTROUTING_direct
>-A PREROUTING_ZONES -i ens256 -j PRE_trusted
>-A PREROUTING_ZONES -i ens224 -g PRE_work
>-A PREROUTING_ZONES -i ens192 -g PRE_public
>-A PREROUTING_ZONES -g PRE_public
>-A PRE_public -j PRE_public_log
>-A PRE_public -j PRE_public_deny
>-A PRE_public -j PRE_public_allow
>-A PRE_public_allow -p tcp -m tcp --dport 9022 -j MARK --set-xmark 0x64/0xffffffff
>-A PRE_public_allow -p tcp -m tcp --dport 9024 -j MARK --set-xmark 0x65/0xffffffff
>-A PRE_public_allow -p tcp -m tcp --dport 6022 -j MARK --set-xmark 0x66/0xffffffff
>-A PRE_public_allow -p tcp -m tcp --dport 9023 -j MARK --set-xmark 0x67/0xffffffff
>-A PRE_trusted -j PRE_trusted_log
>-A PRE_trusted -j PRE_trusted_deny
>-A PRE_trusted -j PRE_trusted_allow
>-A PRE_work -j PRE_work_log
>-A PRE_work -j PRE_work_deny
>-A PRE_work -j PRE_work_allow
>COMMIT
># Completed on Wed Mar 19 14:00:37 2014
># Generated by iptables-save v1.4.18 on Wed Mar 19 14:00:37 2014
>*security
>:INPUT ACCEPT [183:13332]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [114:23416]
>:FORWARD_direct - [0:0]
>:INPUT_direct - [0:0]
>:OUTPUT_direct - [0:0]
>-A INPUT -j INPUT_direct
>-A FORWARD -j FORWARD_direct
>-A OUTPUT -j OUTPUT_direct
>COMMIT
># Completed on Wed Mar 19 14:00:37 2014
># Generated by iptables-save v1.4.18 on Wed Mar 19 14:00:37 2014
>*raw
>:PREROUTING ACCEPT [236:17461]
>:OUTPUT ACCEPT [114:23416]
>:OUTPUT_direct - [0:0]
>:PREROUTING_direct - [0:0]
>-A PREROUTING -j PREROUTING_direct
>-A OUTPUT -j OUTPUT_direct
>COMMIT
># Completed on Wed Mar 19 14:00:37 2014
># Generated by iptables-save v1.4.18 on Wed Mar 19 14:00:37 2014
>*filter
>:INPUT ACCEPT [0:0]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [102:21704]
>:FORWARD_IN_ZONES - [0:0]
>:FORWARD_IN_ZONES_SOURCE - [0:0]
>:FORWARD_OUT_ZONES - [0:0]
>:FORWARD_OUT_ZONES_SOURCE - [0:0]
>:FORWARD_direct - [0:0]
>:FWDI_public - [0:0]
>:FWDI_public_allow - [0:0]
>:FWDI_public_deny - [0:0]
>:FWDI_public_log - [0:0]
>:FWDI_trusted - [0:0]
>:FWDI_trusted_allow - [0:0]
>:FWDI_trusted_deny - [0:0]
>:FWDI_trusted_log - [0:0]
>:FWDI_work - [0:0]
>:FWDI_work_allow - [0:0]
>:FWDI_work_deny - [0:0]
>:FWDI_work_log - [0:0]
>:FWDO_public - [0:0]
>:FWDO_public_allow - [0:0]
>:FWDO_public_deny - [0:0]
>:FWDO_public_log - [0:0]
>:FWDO_trusted - [0:0]
>:FWDO_trusted_allow - [0:0]
>:FWDO_trusted_deny - [0:0]
>:FWDO_trusted_log - [0:0]
>:FWDO_work - [0:0]
>:FWDO_work_allow - [0:0]
>:FWDO_work_deny - [0:0]
>:FWDO_work_log - [0:0]
>:INPUT_ZONES - [0:0]
>:INPUT_ZONES_SOURCE - [0:0]
>:INPUT_direct - [0:0]
>:IN_public - [0:0]
>:IN_public_allow - [0:0]
>:IN_public_deny - [0:0]
>:IN_public_log - [0:0]
>:IN_trusted - [0:0]
>:IN_trusted_allow - [0:0]
>:IN_trusted_deny - [0:0]
>:IN_trusted_log - [0:0]
>:IN_work - [0:0]
>:IN_work_allow - [0:0]
>:IN_work_deny - [0:0]
>:IN_work_log - [0:0]
>:OUTPUT_direct - [0:0]
>-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>-A INPUT -i lo -j ACCEPT
>-A INPUT -j INPUT_direct
>-A INPUT -j INPUT_ZONES_SOURCE
>-A INPUT -j INPUT_ZONES
>-A INPUT -p icmp -j ACCEPT
>-A INPUT -j REJECT --reject-with icmp-host-prohibited
>-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>-A FORWARD -i lo -j ACCEPT
>-A FORWARD -j FORWARD_direct
>-A FORWARD -j FORWARD_IN_ZONES_SOURCE
>-A FORWARD -j FORWARD_IN_ZONES
>-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
>-A FORWARD -j FORWARD_OUT_ZONES
>-A FORWARD -p icmp -j ACCEPT
>-A FORWARD -j REJECT --reject-with icmp-host-prohibited
>-A OUTPUT -j OUTPUT_direct
>-A FORWARD_IN_ZONES -i ens256 -j FWDI_trusted
>-A FORWARD_IN_ZONES -i ens224 -g FWDI_work
>-A FORWARD_IN_ZONES -i ens192 -g FWDI_public
>-A FORWARD_IN_ZONES -g FWDI_public
>-A FORWARD_OUT_ZONES -o ens256 -j FWDO_trusted
>-A FORWARD_OUT_ZONES -o ens224 -g FWDO_work
>-A FORWARD_OUT_ZONES -o ens192 -g FWDO_public
>-A FORWARD_OUT_ZONES -g FWDO_public
>-A FWDI_public -j FWDI_public_log
>-A FWDI_public -j FWDI_public_deny
>-A FWDI_public -j FWDI_public_allow
>-A FWDI_public_allow -m conntrack --ctstate NEW -m mark --mark 0x64 -j ACCEPT
>-A FWDI_public_allow -m conntrack --ctstate NEW -m mark --mark 0x65 -j ACCEPT
>-A FWDI_public_allow -m conntrack --ctstate NEW -m mark --mark 0x67 -j ACCEPT
>-A FWDI_trusted -j FWDI_trusted_log
>-A FWDI_trusted -j FWDI_trusted_deny
>-A FWDI_trusted -j FWDI_trusted_allow
>-A FWDI_trusted -j ACCEPT
>-A FWDI_work -j FWDI_work_log
>-A FWDI_work -j FWDI_work_deny
>-A FWDI_work -j FWDI_work_allow
>-A FWDO_public -j FWDO_public_log
>-A FWDO_public -j FWDO_public_deny
>-A FWDO_public -j FWDO_public_allow
>-A FWDO_public_allow -j ACCEPT
>-A FWDO_trusted -j FWDO_trusted_log
>-A FWDO_trusted -j FWDO_trusted_deny
>-A FWDO_trusted -j FWDO_trusted_allow
>-A FWDO_trusted -j ACCEPT
>-A FWDO_work -j FWDO_work_log
>-A FWDO_work -j FWDO_work_deny
>-A FWDO_work -j FWDO_work_allow
>-A INPUT_ZONES -i ens256 -j IN_trusted
>-A INPUT_ZONES -i ens224 -g IN_work
>-A INPUT_ZONES -i ens192 -g IN_public
>-A INPUT_ZONES -g IN_public
>-A IN_public -j IN_public_log
>-A IN_public -j IN_public_deny
>-A IN_public -j IN_public_allow
>-A IN_public_allow -p tcp -m tcp --dport 1080 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 1143 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 1389 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 1110 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 1025 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 6021 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 11100:11200 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_public_allow -m conntrack --ctstate NEW -m mark --mark 0x66 -j ACCEPT
>-A IN_trusted -j IN_trusted_log
>-A IN_trusted -j IN_trusted_deny
>-A IN_trusted -j IN_trusted_allow
>-A IN_trusted -j ACCEPT
>-A IN_work -j IN_work_log
>-A IN_work -j IN_work_deny
>-A IN_work -j IN_work_allow
>-A IN_work_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 139 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 445 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 6021 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 11100:11200 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 631 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 10320 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j ACCEPT
>-A IN_work_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j ACCEPT
>COMMIT
># Completed on Wed Mar 19 14:00:37 2014

Actions: View

Attachments on bug 1076857: 876342 | 876343