Attachment 781210 Details for Bug 1105821

new ruleset

ruleset.txt (text/plain), 5.82 KB, created by Jiri Slaby on 2018-08-29 15:05:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jiri Slaby

Created: 2018-08-29 15:05:29 UTC

Size: 5.82 KB

patch

obsolete

>table inet firewalld {
>	chain raw_PREROUTING {
>		type filter hook prerouting priority -290; policy accept;
>		icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
>		meta nfproto ipv6 fib saddr . iif oif missing log prefix "rpfilter_DROP: "
>		meta nfproto ipv6 fib saddr . iif oif missing drop
>		jump raw_PREROUTING_ZONES_SOURCE
>		jump raw_PREROUTING_ZONES
>	}
>
>	chain raw_PREROUTING_ZONES_SOURCE {
>	}
>
>	chain raw_PREROUTING_ZONES {
>		iifname "eth1" jump raw_PRE_drop
>		jump raw_PRE_drop
>	}
>
>	chain mangle_PREROUTING {
>		type filter hook prerouting priority -140; policy accept;
>		jump mangle_PREROUTING_ZONES_SOURCE
>		jump mangle_PREROUTING_ZONES
>	}
>
>	chain mangle_PREROUTING_ZONES_SOURCE {
>	}
>
>	chain mangle_PREROUTING_ZONES {
>		iifname "eth1" jump mangle_PRE_drop
>		jump mangle_PRE_drop
>	}
>
>	chain filter_INPUT {
>		type filter hook input priority 10; policy accept;
>		ct state established,related accept
>		iifname "lo" accept
>		jump filter_INPUT_ZONES_SOURCE
>		jump filter_INPUT_ZONES
>		ct state invalid log prefix "STATE_INVALID_DROP: "
>		ct state invalid drop
>		log prefix "FINAL_REJECT: "
>		reject with icmpx type admin-prohibited
>	}
>
>	chain filter_FORWARD {
>		type filter hook forward priority 10; policy accept;
>		ct state established,related accept
>		iifname "lo" accept
>		jump filter_FORWARD_IN_ZONES_SOURCE
>		jump filter_FORWARD_IN_ZONES
>		jump filter_FORWARD_OUT_ZONES_SOURCE
>		jump filter_FORWARD_OUT_ZONES
>		ct state invalid log prefix "STATE_INVALID_DROP: "
>		ct state invalid drop
>		log prefix "FINAL_REJECT: "
>		reject with icmpx type admin-prohibited
>	}
>
>	chain filter_INPUT_ZONES_SOURCE {
>	}
>
>	chain filter_INPUT_ZONES {
>		iifname "eth1" jump filter_IN_drop
>		jump filter_IN_drop
>	}
>
>	chain filter_FORWARD_IN_ZONES_SOURCE {
>	}
>
>	chain filter_FORWARD_IN_ZONES {
>		iifname "eth1" jump filter_FWDI_drop
>		jump filter_FWDI_drop
>	}
>
>	chain filter_FORWARD_OUT_ZONES_SOURCE {
>	}
>
>	chain filter_FORWARD_OUT_ZONES {
>		oifname "eth1" jump filter_FWDO_drop
>		jump filter_FWDO_drop
>	}
>
>	chain raw_PRE_drop {
>		jump raw_PRE_drop_log
>		jump raw_PRE_drop_deny
>		jump raw_PRE_drop_allow
>	}
>
>	chain raw_PRE_drop_log {
>	}
>
>	chain raw_PRE_drop_deny {
>	}
>
>	chain raw_PRE_drop_allow {
>		udp dport netbios-ns ct helper "netbios-ns"
>		udp dport tftp ct helper "tftp"
>	}
>
>	chain filter_IN_drop {
>		jump filter_IN_drop_log
>		jump filter_IN_drop_deny
>		jump filter_IN_drop_allow
>		drop
>	}
>
>	chain filter_IN_drop_log {
>	}
>
>	chain filter_IN_drop_deny {
>	}
>
>	chain filter_IN_drop_allow {
>		tcp dport ssh ct state new accept
>		ip6 daddr fe80::/64 udp dport dhcpv6-client ct state new accept
>		tcp dport 8200 ct state new accept
>		udp dport 1900 ct state new accept
>		udp dport netbios-ns ct state new accept
>		udp dport netbios-dgm ct state new accept
>		tcp dport netbios-ssn ct state new accept
>		tcp dport microsoft-ds ct state new accept
>		ip6 daddr ff02::fb udp dport mdns ct state new accept
>		udp dport tftp ct state new accept
>		tcp dport 60000-65000 ct state new accept
>		udp dport 60000-65000 ct state new accept
>		tcp dport 1716 ct state new accept
>		udp dport 1716 ct state new accept
>		meta l4proto icmp ct state new accept
>		meta l4proto igmp ct state new accept
>		meta l4proto ipv6-icmp ct state new counter packets 1 bytes 104 accept
>		meta l4proto ipv6-icmp counter packets 7 bytes 496 accept
>	}
>
>	chain mangle_PRE_drop {
>		jump mangle_PRE_drop_log
>		jump mangle_PRE_drop_deny
>		jump mangle_PRE_drop_allow
>	}
>
>	chain mangle_PRE_drop_log {
>	}
>
>	chain mangle_PRE_drop_deny {
>	}
>
>	chain mangle_PRE_drop_allow {
>	}
>
>	chain filter_FWDI_drop {
>		jump filter_FWDI_drop_log
>		jump filter_FWDI_drop_deny
>		jump filter_FWDI_drop_allow
>		drop
>	}
>
>	chain filter_FWDI_drop_log {
>	}
>
>	chain filter_FWDI_drop_deny {
>	}
>
>	chain filter_FWDI_drop_allow {
>	}
>
>	chain filter_FWDO_drop {
>		jump filter_FWDO_drop_log
>		jump filter_FWDO_drop_deny
>		jump filter_FWDO_drop_allow
>		drop
>	}
>
>	chain filter_FWDO_drop_log {
>	}
>
>	chain filter_FWDO_drop_deny {
>	}
>
>	chain filter_FWDO_drop_allow {
>	}
>}
>table ip firewalld {
>	chain nat_PREROUTING {
>		type nat hook prerouting priority -90; policy accept;
>		jump nat_PREROUTING_ZONES_SOURCE
>		jump nat_PREROUTING_ZONES
>	}
>
>	chain nat_PREROUTING_ZONES_SOURCE {
>	}
>
>	chain nat_PREROUTING_ZONES {
>		iifname "eth1" jump nat_PRE_drop
>		jump nat_PRE_drop
>	}
>
>	chain nat_POSTROUTING {
>		type nat hook postrouting priority 110; policy accept;
>		jump nat_POSTROUTING_ZONES_SOURCE
>		jump nat_POSTROUTING_ZONES
>	}
>
>	chain nat_POSTROUTING_ZONES_SOURCE {
>	}
>
>	chain nat_POSTROUTING_ZONES {
>		oifname "eth1" jump nat_POST_drop
>		jump nat_POST_drop
>	}
>
>	chain nat_PRE_drop {
>		jump nat_PRE_drop_log
>		jump nat_PRE_drop_deny
>		jump nat_PRE_drop_allow
>	}
>
>	chain nat_PRE_drop_log {
>	}
>
>	chain nat_PRE_drop_deny {
>	}
>
>	chain nat_PRE_drop_allow {
>	}
>
>	chain nat_POST_drop {
>		jump nat_POST_drop_log
>		jump nat_POST_drop_deny
>		jump nat_POST_drop_allow
>	}
>
>	chain nat_POST_drop_log {
>	}
>
>	chain nat_POST_drop_deny {
>	}
>
>	chain nat_POST_drop_allow {
>	}
>}
>table ip6 firewalld {
>	chain nat_PREROUTING {
>		type nat hook prerouting priority -90; policy accept;
>		jump nat_PREROUTING_ZONES_SOURCE
>		jump nat_PREROUTING_ZONES
>	}
>
>	chain nat_PREROUTING_ZONES_SOURCE {
>	}
>
>	chain nat_PREROUTING_ZONES {
>		iifname "eth1" jump nat_PRE_drop
>		jump nat_PRE_drop
>	}
>
>	chain nat_POSTROUTING {
>		type nat hook postrouting priority 110; policy accept;
>		jump nat_POSTROUTING_ZONES_SOURCE
>		jump nat_POSTROUTING_ZONES
>	}
>
>	chain nat_POSTROUTING_ZONES_SOURCE {
>	}
>
>	chain nat_POSTROUTING_ZONES {
>		oifname "eth1" jump nat_POST_drop
>		jump nat_POST_drop
>	}
>
>	chain nat_PRE_drop {
>		jump nat_PRE_drop_log
>		jump nat_PRE_drop_deny
>		jump nat_PRE_drop_allow
>	}
>
>	chain nat_PRE_drop_log {
>	}
>
>	chain nat_PRE_drop_deny {
>	}
>
>	chain nat_PRE_drop_allow {
>	}
>
>	chain nat_POST_drop {
>		jump nat_POST_drop_log
>		jump nat_POST_drop_deny
>		jump nat_POST_drop_allow
>	}
>
>	chain nat_POST_drop_log {
>	}
>
>	chain nat_POST_drop_deny {
>	}
>
>	chain nat_POST_drop_allow {
>	}
>}

Actions: View

Attachments on bug 1105821: 780614 | 781210