From 3a37ebad404fd2febf8af950cb59ca56a63d3b3f Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Wed, 8 Jan 2020 01:38:07 +0000 Subject: iptables bridge and server update --- core/conf/iptables/ipt-bridge.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'core/conf/iptables/ipt-bridge.sh') diff --git a/core/conf/iptables/ipt-bridge.sh b/core/conf/iptables/ipt-bridge.sh index 67b5053..961f05a 100644 --- a/core/conf/iptables/ipt-bridge.sh +++ b/core/conf/iptables/ipt-bridge.sh @@ -43,6 +43,7 @@ $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 0.0.0.0 -d 255.255.255.255 -j srv_dhc ## allow output from BR_NET to external $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${BR_NET} -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.5 -j ACCEPT $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${DNS} -d ${PUB_IP} -j cli_dns_in $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in @@ -77,10 +78,14 @@ $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_https_in +$IPT -A INPUT -i ${BR_IF} -j cli_http_in $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_git_in $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_ssh_in $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j srv_ntp +# let radio get in +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp --dport 1024:65535 --sport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT + #$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${WIFI_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_icmp #$IPT -A INPUT -i ${WIFI_IF} -d ${PUB_IP} -s ${WIFI_NET} -j srv_dns_in #$IPT -A INPUT -i ${BR_IF} -s ${GW} -d ${PUB_IP} -j srv_dhcp @@ -114,9 +119,12 @@ $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_http_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_https_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_git_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_http_out +$IPT -A OUTPUT -j cli_http_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j srv_ntp +# let radio and other stuff out +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 1024:65535 --sport 1024:65535 -j ACCEPT + #$IPT -A OUTPUT -o ${WIFI_IF} -d ${DNS} -j cli_dns_out #$IPT -A OUTPUT -o ${WIFI_IF} -d ${WIFI_NET} -j srv_dns_out #$IPT -A OUTPUT -o ${WIFI_IF} -j srv_dns_out -- cgit 1.4.1-2-gfad0 From 36ef4944b852eaf9ef54154c3cccef6c2eb41292 Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Mon, 17 Feb 2020 05:08:15 +0000 Subject: configuration files fix --- core/conf/iptables/blockedip | 182 +++++++++ core/conf/iptables/ipt-bridge.sh | 177 +++------ core/conf/iptables/ipt-client.sh | 20 +- core/conf/iptables/ipt-conf.sh | 17 +- core/conf/iptables/ipt-firewall.sh | 50 ++- core/conf/iptables/ipt-server.sh | 29 +- core/conf/iptables/server.v4 | 790 +++++++++++++++++++++++++++++++++++-- tools/conf/etc/logrotate.conf | 13 +- tools/conf/etc/skel/.vimrc | 14 +- tools/conf/etc/syslog-ng.conf | 7 +- tools/postgresql.html | 4 +- 11 files changed, 1099 insertions(+), 204 deletions(-) create mode 100644 core/conf/iptables/blockedip (limited to 'core/conf/iptables/ipt-bridge.sh') diff --git a/core/conf/iptables/blockedip b/core/conf/iptables/blockedip new file mode 100644 index 0000000..714403a --- /dev/null +++ b/core/conf/iptables/blockedip @@ -0,0 +1,182 @@ +52.0.0.0/8 +54.0.0.0/8 +13.48.203.206 +2.21.169.41 +13.115.174.176 +18.182.0.0/16 +23.10.69.56 +104.89.189.238 +195.8.22.40 +195.8.22.41 +2.16.65.168 +2.16.65.152 +88.221.64.239 +195.8.22.138 +195.8.22.152 +23.10.74.160 +195.8.15.224 +195.8.15.209 +23.10.76.42 +88.221.65.114 +195.8.22.40 +195.8.22.48 +2.16.65.147 +2.16.65.171 +88.221.65.13 +195.8.22.64 +195.8.22.40 +195.8.22.152 +195.8.22.138 +23.37.165.98 +23.39.84.7 +23.37.165.98 +195.8.15.224 +195.8.15.209 +2.16.65.152 +2.16.65.168 +13.225.241.27 +13.225.241.212 +13.225.241.199 +13.225.241.79 +18.197.26.211 +3.120.59.84 +18.197.83.103 +3.120.65.125 +3.120.50.86 +18.197.76.109 +3.120.165.77 +18.197.222.92 +35.156.254.127 +35.157.9.106 +35.156.192.89 +35.158.207.255 +3.124.153.99 +3.123.92.221 +35.156.224.167 +35.157.45.201 +54.93.153.201 +35.156.103.70 +18.196.78.8 +35.157.20.203 +18.195.110.84 +18.195.82.208 +18.194.31.225 +52.58.105.233 +3.120.241.69 +52.28.195.9 +13.225.241.212 +13.225.241.79 +13.225.241.27 +13.225.241.199 +13.225.241.79 +13.225.241.199 +13.225.241.212 +13.225.241.79 +13.225.241.199 +13.225.241.79 +13.225.241.27 +13.225.241.199 +13.225.241.79 +13.225.241.199 +13.225.241.27 +13.225.241.212 +18.194.111.172 +18.195.232.16 +18.195.34.196 +18.185.187.153 +18.184.201.126 +18.194.82.205 +18.185.150.188 +18.185.156.16 +13.225.13.61 +72.21.195.65 +13.225.13.61 +52.46.145.112 +52.46.141.49 +54.239.26.255 +54.71.96.255 +34.214.185.21 +52.32.14.1 +35.166.250.92 +54.200.12.154 +52.37.114.192 +13.225.245.72 +13.225.245.65 +13.225.245.18 +13.225.245.33 +35.160.240.60 +52.10.136.27 +54.71.96.255 +54.200.12.154 +52.32.14.1 +34.214.185.21 +35.166.250.92 +35.160.240.60 +13.225.245.65 +13.225.245.33 +13.225.245.72 +13.225.245.18 +18.197.26.211 +3.120.59.84 +18.197.83.103 +3.120.65.125 +3.120.50.86 +18.197.76.109 +3.120.165.77 +18.197.222.92 +35.156.254.127 +35.157.9.106 +35.156.192.89 +35.158.207.255 +3.124.153.99 +3.123.92.221 +35.156.224.167 +35.157.45.201 +54.93.153.201 +35.156.103.70 +18.196.78.8 +35.157.20.203 +18.195.110.84 +18.195.82.208 +18.194.31.225 +52.58.105.233 +3.120.241.69 +52.28.195.9 +13.225.245.65 +13.225.245.33 +13.225.245.72 +13.225.245.18 +54.200.12.154 +52.32.14.1 +34.214.185.21 +35.166.250.92 +54.71.96.255 +54.148.24.227 +52.41.41.102 +13.225.245.18 +13.225.245.65 +13.225.245.72 +13.225.245.33 +13.225.245.18 +13.225.245.33 +13.225.245.72 +13.225.245.65 +54.200.12.154 +34.214.185.21 +52.32.14.1 +54.148.24.227 +54.71.96.255 +35.166.250.92 +35.166.120.35 +13.225.245.18 +13.225.245.72 +13.225.245.65 +13.225.245.33 +18.194.111.172 +18.195.232.16 +18.195.34.196 +18.185.187.153 +18.184.201.126 +18.194.82.205 +18.185.150.188 +18.185.156.16 diff --git a/core/conf/iptables/ipt-bridge.sh b/core/conf/iptables/ipt-bridge.sh index 961f05a..c4b2a00 100644 --- a/core/conf/iptables/ipt-bridge.sh +++ b/core/conf/iptables/ipt-bridge.sh @@ -1,7 +1,7 @@ #!/bin/bash echo "setting bridge network..." -source ipt-conf.sh -source ipt-firewall.sh +source /etc/iptables/ipt-conf.sh +source /etc/iptables/ipt-firewall.sh ipt_clear ipt_tables @@ -11,140 +11,83 @@ $IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT $IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT $IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT -######## NAT Prerouting Chain ###### -#$IPT -t nat -A PREROUTING -i ${WIFI_IF} -p udp --dport 53 --sport 1024:65535 -j DNAT --to 10.0.0.254:53 -##$IPT -t nat -A PREROUTING -i ${WIFI_IF} -p tcp --dport 53 --sport 1024:65535 -j DNAT --to 10.0.0.254:53 -#$IPT -t nat -A PREROUTING -i ${WIFI_IF} -p tcp --dport 443 --sport 1024:65535 -j DNAT --to 10.0.0.4:443 -##$IPT -t nat -A PREROUTING -j LOG --log-level 7 --log-prefix "iptables: PREROUTING: " +######################################################################### +# FORWARD +######################################################################### -######## Forward Chain ###### -#$IPT -A FORWARD -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -#$IPT -A FORWARD -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -# -## Allow all for BR_NET +$IPT -A FORWARD -j blocker +$IPT -A FORWARD -j blockip_in +$IPT -A FORWARD -j blockip_out $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${BR_NET} -d ${BR_NET} -j ACCEPT - -## DHCP +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -p udp --dport 520 --sport 520 -j DROP $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 0.0.0.0 -d 255.255.255.255 -j srv_dhcp - -## Allow access from bridge to gateway wifi interface -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j cli_http_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j cli_http_out -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j cli_https_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j cli_https_out -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j cli_ftp_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j cli_ftp_out - -##$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j srv_dns_in -##$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j srv_dns_out -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j srv_https_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j srv_https_out - -## allow output from BR_NET to external -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${BR_NET} -j ACCEPT - -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.5 -j ACCEPT -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${DNS} -d ${PUB_IP} -j cli_dns_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 50.23.197.95 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 50.23.197.94 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 50.23.197.94 -j ACCEPT + +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 50.23.197.95 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 50.23.197.94 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 50.23.197.94 -j ACCEPT + +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-in tap1 --physdev-out ${PUB_IF} -s 10.0.0.3 -j cli_https_out +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-in tap1 --physdev-out ${PUB_IF} -s 10.0.0.3 -j cli_http_out +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-out tap1 --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_https_in +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-out tap1 --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_http_in +#####Server $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ssh_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_ssh_out $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_git_in $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ntp -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -j ACCEPT - -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_http_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.3 -p tcp --dport 1024:65535 --sport 1024:65535 -j ACCEPT $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j cli_http_in -##Less noise -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -p udp --dport 519 --sport 520 -j DROP -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -p udp --dport 520 --sport 520 -j DROP +#####HTTP Server +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in -######## Input Chain ###### +######################################################################### +# INPUT +######################################################################### $IPT -A INPUT -j blocker - -##Less noise -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp --sport 3030 --dport 1024:65535 -j DROP -#$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -p udp --sport 137 --dport 137 -j ACCEPT -#$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -p udp --sport 137 --dport 137 -j ACCEPT -#$IPT -A INPUT -i ${BR_IF} -s ${BR_NET} -d 10.255.255.255 -p udp --sport 520 --dport 520 -j ACCEPT -#$IPT -A INPUT -i ${WIFI_IF} -p udp --sport 137 --dport 137 -j ACCEPT -#$IPT -A INPUT -i ${WIFI_IF} -p udp --sport 138 --dport 138 -j ACCEPT - -$IPT -A INPUT -i ${BR_IF} -j srv_dhcp -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_dns_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_icmp -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in +$IPT -A INPUT -j blockip_in +$IPT -A INPUT -i ${BR_IF} -p udp --dport 520 --sport 520 -j DROP +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp --sport 3030 -j DROP $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_https_in -$IPT -A INPUT -i ${BR_IF} -j cli_http_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_git_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_ssh_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j srv_ntp - -# let radio get in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp --dport 1024:65535 --sport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT - -#$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${WIFI_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_icmp -#$IPT -A INPUT -i ${WIFI_IF} -d ${PUB_IP} -s ${WIFI_NET} -j srv_dns_in -#$IPT -A INPUT -i ${BR_IF} -s ${GW} -d ${PUB_IP} -j srv_dhcp -#$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_http_in -#$IPT -A INPUT -i ${WIFI_IF} -s ${DNS} -j cli_dns_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_https_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_http_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_git_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_ssh_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in tap2 -s ${BR_NET} -d ${PUB_IP} -j cli_http_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -j cli_http_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -j cli_https_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in tap2 -j cli_https_in +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_ssh_in +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s 10.0.0.4 -j cli_git_in +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_dns_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -j srv_dhcp +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${BR_NET} -j srv_dhcp -## PXE server -#$IPT -A INPUT -i ${BR_IF} -p udp -d ${PUB_IP} -s ${BR_NET} --dport 69 --sport 1024:65535 -j ACCEPT -#$IPT -A INPUT -i ${BR_IF} -p udp -d ${PUB_IP} -s ${BR_NET} --dport 1024:65535 --sport 1024:65535 -j ACCEPT +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in +#$IPT -A INPUT -j LOG -######## Output Chain ###### +$IPT -A OUTPUT -o ${BR_IF} -p udp --dport 520 --sport 520 -j DROP -##Less noise -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 3030 --sport 1024:65535 -j DROP +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 3030 -j DROP +$IPT -A OUTPUT -o blockip_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j srv_dhcp +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${DNS} -j cli_dns_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j srv_dns_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j srv_ssh_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j srv_git_out -$IPT -A OUTPUT -o ${BR_IF} -j srv_icmp -#$IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp - -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${DNS} -j cli_dns_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_git_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_http_out - +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${GW} -j cli_http_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_https_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_git_out -$IPT -A OUTPUT -j cli_http_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j srv_ntp - -# let radio and other stuff out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 1024:65535 --sport 1024:65535 -j ACCEPT - -#$IPT -A OUTPUT -o ${WIFI_IF} -d ${DNS} -j cli_dns_out -#$IPT -A OUTPUT -o ${WIFI_IF} -d ${WIFI_NET} -j srv_dns_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j srv_dns_out - -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_ssh_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_git_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_https_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_http_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j srv_icmp - -## PXE Server -#$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -p udp --dport 1024:65535 --sport 1024:65535 -j ACCEPT - -######## PostRouting Chain ###### -##Less noise -##$IPT -t nat -A POSTROUTING -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -##$IPT -t nat -A POSTROUTING -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -##$IPT -t nat -A POSTROUTING -o ${BR_IF} -s ${PUB_IP} -d ${DNS} -p udp --dport 53 --sport 1024:65535 -j ACCEPT -#$IPT -t nat -A POSTROUTING -o ${WIFI_IF} -j MASQUERADE -##$IPT -t nat -A POSTROUTING -j LOG --log-level 7 --log-prefix "iptables: POSTROUTING: " +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_out +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d 10.0.0.4 -j cli_git_out +$IPT -A OUTPUT -o ${BR_IF} -d ${BR_NET} -j srv_dhcp +$IPT -A OUTPUT -o ${BR_IF} -d ${BR_NET} -j srv_icmp ## log everything else and drop ipt_log diff --git a/core/conf/iptables/ipt-client.sh b/core/conf/iptables/ipt-client.sh index 77de218..65df9e4 100644 --- a/core/conf/iptables/ipt-client.sh +++ b/core/conf/iptables/ipt-client.sh @@ -19,21 +19,13 @@ $IPT -A INPUT -i ${PUB_IF} -j cli_https_in $IPT -A INPUT -i ${PUB_IF} -j cli_git_in $IPT -A INPUT -i ${PUB_IF} -j cli_ssh_in $IPT -A INPUT -i ${PUB_IF} -j srv_icmp -$IPT -A INPUT -i ${PUB_IF} -j srv_ntp $IPT -A INPUT -i ${PUB_IF} -j cli_pops_in $IPT -A INPUT -i ${PUB_IF} -j cli_smtps_in $IPT -A INPUT -i ${PUB_IF} -j cli_irc_in $IPT -A INPUT -i ${PUB_IF} -j cli_ftp_in $IPT -A INPUT -i ${PUB_IF} -j cli_gpg_in -$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j DROP +$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j ACCEPT -$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p udp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT - -# allow all established and related -$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p udp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p icmp -j ACCEPT ####### Output Chain ###### $IPT -A OUTPUT -j blocker @@ -44,20 +36,12 @@ $IPT -A OUTPUT -o ${PUB_IF} -j cli_ssh_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out $IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp -$IPT -A OUTPUT -o ${PUB_IF} -j srv_ntp $IPT -A OUTPUT -o ${PUB_IF} -j cli_pops_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_smtps_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_irc_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_ftp_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_gpg_out - -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1024:65535 -j ACCEPT - -# allow all out (make nmap and others happy) -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1:65535 -j ACCEPT -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1:65535 -j ACCEPT -$IPT -A OUTPUT -p icmp -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:655335 --dport 1024:65535 -j ACCEPT ## log everything else and drop ipt_log diff --git a/core/conf/iptables/ipt-conf.sh b/core/conf/iptables/ipt-conf.sh index dcea837..63b101f 100644 --- a/core/conf/iptables/ipt-conf.sh +++ b/core/conf/iptables/ipt-conf.sh @@ -2,26 +2,27 @@ IPT="/usr/sbin/iptables" -SPAMLIST="blockedip" -SPAMDROPMSG="BLOCKED IP DROP" +SPAMLIST="/etc/iptables/blockedip" +SPAMDROPMSG="BLOCKED IP: " # bridge interface with interface facing gateway -BR_IF="br0" +#BR_IF="br0" # bridge ip network address BR_NET="10.0.0.0/8" # network gateway GW="10.0.0.1" # external dns -DNS="212.55.154.174" +#DNS="212.55.154.174" +DNS="10.0.0.254" # static machine ip address -PUB_IP="10.0.0.254" +PUB_IP="10.0.0.4" # public interface facing gateway -PUB_IF="enp8s0" +PUB_IF="ens3" # wifi interface -WIFI_IF="wlp7s0" +#WIFI_IF="wlp7s0" # static wifi ip network address -WIFI_NET="10.0.0.0/8" +#WIFI_NET="10.0.0.0/8" diff --git a/core/conf/iptables/ipt-firewall.sh b/core/conf/iptables/ipt-firewall.sh index 086b864..0a947e6 100644 --- a/core/conf/iptables/ipt-firewall.sh +++ b/core/conf/iptables/ipt-firewall.sh @@ -14,6 +14,8 @@ ipt_clear () { iptables -t security -F iptables -t security -X iptables -N blocker + iptables -N blockip_in + iptables -N blockip_out iptables -N srv_dhcp iptables -N srv_rip @@ -25,6 +27,8 @@ ipt_clear () { iptables -N srv_http_out iptables -N srv_https_in iptables -N srv_https_out + iptables -N srv_smtp_in + iptables -N srv_smtp_out iptables -N srv_ssh_in iptables -N srv_ssh_out iptables -N srv_git_in @@ -70,6 +74,19 @@ ipt_log () { ipt_tables () { echo "start adding tables..." + # Filter out comments and blank lines + # store each ip or subnet in $ip + egrep -v "^#|^$" x | while IFS= read -r ip + do + # Append everything to droplist + echo "adding ${ip} to blockip" + $IPT -A blockip_in -s $ip -j LOG --log-prefix "${SPAMDROPMSG}" + $IPT -A blockip_in -s $ip -j DROP + $IPT -A blockip_out -d $ip -j LOG --log-prefix "${SPAMDROPMSG}" + $IPT -A blockip_out -d $ip -j DROP + done <"${SPAMLIST}" + + echo "blockip_in and blockip_out added" ####### blocker Chain ###### ## Block google dns @@ -103,6 +120,7 @@ ipt_tables () { #$IPT -A blocker -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP #$IPT -A blocker -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP #$IPT -A blocker -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP + ## Return to caller $IPT -A blocker -j RETURN @@ -123,6 +141,9 @@ ipt_tables () { $IPT -A srv_db_out -j RETURN ####### SSH Server + + $IPT -A srv_ssh_in -p tcp --dport 2222 -s ${BR_NET} -m state --state NEW -j ACCEPT + $IPT -A srv_ssh_in -p tcp --dport 2222 -m state --state NEW -j LOG --log-prefix "iptables: SSH NEW": $IPT -A srv_ssh_in -p tcp --dport 2222 -m state --state NEW -m recent --set --name SSH -j ACCEPT $IPT -A srv_ssh_in -p tcp --dport 2222 -m recent \ @@ -134,22 +155,30 @@ ipt_tables () { $IPT -A srv_ssh_in -p tcp --dport 2222 --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - $IPT -A srv_ssh_in -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT + #$IPT -A srv_ssh_in -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT - $IPT -A srv_ssh_in -p tcp --dport 22 -m recent \ - --update --seconds 60 --hitcount 4 --rttl \ - --name SSH -j LOG --log-prefix "${SPAMDROPMSG} SSH" + #$IPT -A srv_ssh_in -p tcp --dport 22 -m recent \ + # --update --seconds 60 --hitcount 4 --rttl \ + # --name SSH -j LOG --log-prefix "${SPAMDROPMSG} SSH" - $IPT -A srv_ssh_in -p tcp --dport 22 -m recent --update --seconds 60 \ - --hitcount 4 --rttl --name SSH -j DROP + #$IPT -A srv_ssh_in -p tcp --dport 22 -m recent --update --seconds 60 \ + # --hitcount 4 --rttl --name SSH -j DROP - $IPT -A srv_ssh_in -p tcp --dport 22 --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + #$IPT -A srv_ssh_in -p tcp --dport 22 --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A srv_ssh_in -j RETURN + $IPT -A srv_ssh_out -p tcp --sport 2222 --dport 1024:65535 -d ${BR_NET} -m state --state ESTABLISHED -j ACCEPT + $IPT -A srv_ssh_out -p tcp --tcp-flags SYN,ACK SYN,ACK --sport 2222 -j LOG --log-prefix "iptables: SSH OUT": $IPT -A srv_ssh_out -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - $IPT -A srv_ssh_out -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + #$IPT -A srv_ssh_out -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A srv_ssh_out -j RETURN + ####### smtp Server + $IPT -A srv_smtp_in -p tcp --dport 25 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + $IPT -A srv_smtp_in -j RETURN + $IPT -A srv_smtp_out -p tcp --sport 25 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT + $IPT -A srv_smtp_out -j RETURN + ####### HTTP Server $IPT -A srv_http_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A srv_http_in -j RETURN @@ -229,6 +258,9 @@ ipt_tables () { $IPT -A cli_ssh_in -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A cli_ssh_in -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A cli_ssh_in -j RETURN + + $IPT -A cli_ssh_out -p tcp -d ${BR_NET} --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + $IPT -A cli_ssh_out -p tcp --tcp-flags SYN,ACK SYN,ACK --dport 2222 -j LOG --log-prefix "iptables: SSH OUT": $IPT -A cli_ssh_out -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A cli_ssh_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A cli_ssh_out -j RETURN @@ -258,5 +290,3 @@ ipt_tables () { $IPT -A srv_ntp -j RETURN } - - diff --git a/core/conf/iptables/ipt-server.sh b/core/conf/iptables/ipt-server.sh index 784f044..6cd7175 100644 --- a/core/conf/iptables/ipt-server.sh +++ b/core/conf/iptables/ipt-server.sh @@ -1,51 +1,50 @@ echo "setting server iptables ..." -source ipt-conf.sh -source ipt-firewall.sh +source /etc/iptables/ipt-conf.sh +source /etc/iptables/ipt-firewall.sh ipt_clear ipt_tables # Unlimited on loopback $IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT $IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT -$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT +#$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT +#$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT ####### Input Chain ###### $IPT -A INPUT -j blocker +$IPT -A INPUT -i ${PUB_IF} -s ${BR_NET} -p udp --dport 520 -j DROP + $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_https_in + $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_https_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_git_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_ssh_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_smtp_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j cli_https_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j cli_http_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ssh_in + $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_https_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_http_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ssh_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_git_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ntp ####### Output Chain ###### $IPT -A OUTPUT -j blocker $IPT -A OUTPUT -o ${PUB_IF} -d ${DNS} -s ${PUB_IP} -j cli_dns_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j cli_http_out -$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j cli_ssh_out + $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_https_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_ssh_out +$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_smtp_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_git_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j cli_https_out -$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j cli_http_out - $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_https_out -$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_http_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_ssh_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_git_out -$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_ntp ## log everything else and drop ipt_log diff --git a/core/conf/iptables/server.v4 b/core/conf/iptables/server.v4 index 678800b..164f95b 100644 --- a/core/conf/iptables/server.v4 +++ b/core/conf/iptables/server.v4 @@ -1,39 +1,41 @@ -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 +# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 *security :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 +# Completed on Mon Feb 17 04:36:55 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 *raw :PREROUTING ACCEPT [0:0] -:OUTPUT ACCEPT [1:132] +:OUTPUT ACCEPT [187:298268] COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 +# Completed on Mon Feb 17 04:36:55 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 +# Completed on Mon Feb 17 04:36:55 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 *mangle :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [1:132] +:OUTPUT ACCEPT [187:298268] :POSTROUTING ACCEPT [0:0] COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 +# Completed on Mon Feb 17 04:36:55 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :blocker - [0:0] +:blockip_in - [0:0] +:blockip_out - [0:0] :cli_dns_in - [0:0] :cli_dns_out - [0:0] :cli_ftp_in - [0:0] @@ -66,19 +68,24 @@ COMMIT :srv_https_in - [0:0] :srv_https_out - [0:0] :srv_icmp - [0:0] +:srv_ntp - [0:0] :srv_rip - [0:0] +:srv_smtp_in - [0:0] +:srv_smtp_out - [0:0] :srv_ssh_in - [0:0] :srv_ssh_out - [0:0] -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT -A INPUT -j blocker +-A INPUT -s 10.0.0.0/8 -i ens3 -p udp -m udp --dport 520 -j DROP -A INPUT -s 10.0.0.254/32 -d 10.0.0.4/32 -i ens3 -j cli_dns_in +-A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j cli_http_in +-A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j cli_https_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_https_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_ssh_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_git_in --A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j cli_http_in --A INPUT -d 10.0.0.4/32 -i ens3 -j srv_https_in +-A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_smtp_in -A INPUT -d 10.0.0.4/32 -i ens3 -j cli_https_in --A INPUT -d 10.0.0.4/32 -i ens3 -j cli_http_in +-A INPUT -d 10.0.0.4/32 -i ens3 -j srv_https_in -A INPUT -d 10.0.0.4/32 -i ens3 -j srv_ssh_in -A INPUT -d 10.0.0.4/32 -i ens3 -j srv_git_in -A INPUT -j LOG --log-prefix "iptables: INPUT: " --log-level 7 @@ -89,12 +96,12 @@ COMMIT -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j cli_http_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_https_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_ssh_out +-A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_smtp_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_git_out -A OUTPUT -s 10.0.0.4/32 -o ens3 -j cli_https_out --A OUTPUT -s 10.0.0.4/32 -o ens3 -j cli_http_out -A OUTPUT -s 10.0.0.4/32 -o ens3 -j srv_https_out --A OUTPUT -d 10.0.0.0/8 -o ens3 -j srv_ssh_out --A OUTPUT -d 10.0.0.0/8 -o ens3 -j srv_git_out +-A OUTPUT -s 10.0.0.4/32 -o ens3 -j srv_ssh_out +-A OUTPUT -s 10.0.0.4/32 -o ens3 -j srv_git_out -A OUTPUT -j LOG --log-prefix "iptables: OUTPUT: " --log-level 7 -A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop sync: " --log-level 7 -A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP @@ -112,6 +119,734 @@ COMMIT -A blocker -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP -A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP -A blocker -j RETURN +-A blockip_in -s 52.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.0.0.0/8 -j DROP +-A blockip_in -s 54.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.0.0.0/8 -j DROP +-A blockip_in -s 13.48.203.206/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.48.203.206/32 -j DROP +-A blockip_in -s 2.21.169.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.21.169.41/32 -j DROP +-A blockip_in -s 13.115.174.176/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.115.174.176/32 -j DROP +-A blockip_in -s 18.182.0.0/16 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.182.0.0/16 -j DROP +-A blockip_in -s 23.10.69.56/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.69.56/32 -j DROP +-A blockip_in -s 104.89.189.238/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 104.89.189.238/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.41/32 -j DROP +-A blockip_in -s 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.168/32 -j DROP +-A blockip_in -s 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.152/32 -j DROP +-A blockip_in -s 88.221.64.239/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.64.239/32 -j DROP +-A blockip_in -s 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.138/32 -j DROP +-A blockip_in -s 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.152/32 -j DROP +-A blockip_in -s 23.10.74.160/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.74.160/32 -j DROP +-A blockip_in -s 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.224/32 -j DROP +-A blockip_in -s 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.209/32 -j DROP +-A blockip_in -s 23.10.76.42/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.76.42/32 -j DROP +-A blockip_in -s 88.221.65.114/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.65.114/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.48/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.48/32 -j DROP +-A blockip_in -s 2.16.65.147/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.147/32 -j DROP +-A blockip_in -s 2.16.65.171/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.171/32 -j DROP +-A blockip_in -s 88.221.65.13/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.65.13/32 -j DROP +-A blockip_in -s 195.8.22.64/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.64/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.152/32 -j DROP +-A blockip_in -s 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.138/32 -j DROP +-A blockip_in -s 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.37.165.98/32 -j DROP +-A blockip_in -s 23.39.84.7/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.39.84.7/32 -j DROP +-A blockip_in -s 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.37.165.98/32 -j DROP +-A blockip_in -s 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.224/32 -j DROP +-A blockip_in -s 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.209/32 -j DROP +-A blockip_in -s 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.152/32 -j DROP +-A blockip_in -s 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.168/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.26.211/32 -j DROP +-A blockip_in -s 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.59.84/32 -j DROP +-A blockip_in -s 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.83.103/32 -j DROP +-A blockip_in -s 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.65.125/32 -j DROP +-A blockip_in -s 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.50.86/32 -j DROP +-A blockip_in -s 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.76.109/32 -j DROP +-A blockip_in -s 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.165.77/32 -j DROP +-A blockip_in -s 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.222.92/32 -j DROP +-A blockip_in -s 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.254.127/32 -j DROP +-A blockip_in -s 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.9.106/32 -j DROP +-A blockip_in -s 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.192.89/32 -j DROP +-A blockip_in -s 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.158.207.255/32 -j DROP +-A blockip_in -s 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.124.153.99/32 -j DROP +-A blockip_in -s 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.123.92.221/32 -j DROP +-A blockip_in -s 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.224.167/32 -j DROP +-A blockip_in -s 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.45.201/32 -j DROP +-A blockip_in -s 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.93.153.201/32 -j DROP +-A blockip_in -s 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.103.70/32 -j DROP +-A blockip_in -s 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.196.78.8/32 -j DROP +-A blockip_in -s 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.20.203/32 -j DROP +-A blockip_in -s 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.110.84/32 -j DROP +-A blockip_in -s 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.82.208/32 -j DROP +-A blockip_in -s 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.31.225/32 -j DROP +-A blockip_in -s 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.58.105.233/32 -j DROP +-A blockip_in -s 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.241.69/32 -j DROP +-A blockip_in -s 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.28.195.9/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.111.172/32 -j DROP +-A blockip_in -s 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.232.16/32 -j DROP +-A blockip_in -s 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.34.196/32 -j DROP +-A blockip_in -s 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.187.153/32 -j DROP +-A blockip_in -s 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.184.201.126/32 -j DROP +-A blockip_in -s 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.82.205/32 -j DROP +-A blockip_in -s 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.150.188/32 -j DROP +-A blockip_in -s 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.156.16/32 -j DROP +-A blockip_in -s 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.13.61/32 -j DROP +-A blockip_in -s 72.21.195.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 72.21.195.65/32 -j DROP +-A blockip_in -s 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.13.61/32 -j DROP +-A blockip_in -s 52.46.145.112/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.46.145.112/32 -j DROP +-A blockip_in -s 52.46.141.49/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.46.141.49/32 -j DROP +-A blockip_in -s 54.239.26.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.239.26.255/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.37.114.192/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.37.114.192/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.160.240.60/32 -j DROP +-A blockip_in -s 52.10.136.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.10.136.27/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.160.240.60/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.26.211/32 -j DROP +-A blockip_in -s 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.59.84/32 -j DROP +-A blockip_in -s 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.83.103/32 -j DROP +-A blockip_in -s 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.65.125/32 -j DROP +-A blockip_in -s 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.50.86/32 -j DROP +-A blockip_in -s 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.76.109/32 -j DROP +-A blockip_in -s 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.165.77/32 -j DROP +-A blockip_in -s 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.222.92/32 -j DROP +-A blockip_in -s 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.254.127/32 -j DROP +-A blockip_in -s 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.9.106/32 -j DROP +-A blockip_in -s 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.192.89/32 -j DROP +-A blockip_in -s 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.158.207.255/32 -j DROP +-A blockip_in -s 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.124.153.99/32 -j DROP +-A blockip_in -s 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.123.92.221/32 -j DROP +-A blockip_in -s 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.224.167/32 -j DROP +-A blockip_in -s 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.45.201/32 -j DROP +-A blockip_in -s 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.93.153.201/32 -j DROP +-A blockip_in -s 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.103.70/32 -j DROP +-A blockip_in -s 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.196.78.8/32 -j DROP +-A blockip_in -s 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.20.203/32 -j DROP +-A blockip_in -s 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.110.84/32 -j DROP +-A blockip_in -s 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.82.208/32 -j DROP +-A blockip_in -s 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.31.225/32 -j DROP +-A blockip_in -s 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.58.105.233/32 -j DROP +-A blockip_in -s 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.241.69/32 -j DROP +-A blockip_in -s 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.28.195.9/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.148.24.227/32 -j DROP +-A blockip_in -s 52.41.41.102/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.41.41.102/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.148.24.227/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 35.166.120.35/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.120.35/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.111.172/32 -j DROP +-A blockip_in -s 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.232.16/32 -j DROP +-A blockip_in -s 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.34.196/32 -j DROP +-A blockip_in -s 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.187.153/32 -j DROP +-A blockip_in -s 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.184.201.126/32 -j DROP +-A blockip_in -s 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.82.205/32 -j DROP +-A blockip_in -s 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.150.188/32 -j DROP +-A blockip_in -s 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.156.16/32 -j DROP +-A blockip_out -d 52.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.0.0.0/8 -j DROP +-A blockip_out -d 54.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.0.0.0/8 -j DROP +-A blockip_out -d 13.48.203.206/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.48.203.206/32 -j DROP +-A blockip_out -d 2.21.169.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.21.169.41/32 -j DROP +-A blockip_out -d 13.115.174.176/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.115.174.176/32 -j DROP +-A blockip_out -d 18.182.0.0/16 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.182.0.0/16 -j DROP +-A blockip_out -d 23.10.69.56/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.69.56/32 -j DROP +-A blockip_out -d 104.89.189.238/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 104.89.189.238/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.41/32 -j DROP +-A blockip_out -d 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.168/32 -j DROP +-A blockip_out -d 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.152/32 -j DROP +-A blockip_out -d 88.221.64.239/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.64.239/32 -j DROP +-A blockip_out -d 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.138/32 -j DROP +-A blockip_out -d 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.152/32 -j DROP +-A blockip_out -d 23.10.74.160/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.74.160/32 -j DROP +-A blockip_out -d 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.224/32 -j DROP +-A blockip_out -d 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.209/32 -j DROP +-A blockip_out -d 23.10.76.42/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.76.42/32 -j DROP +-A blockip_out -d 88.221.65.114/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.65.114/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.48/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.48/32 -j DROP +-A blockip_out -d 2.16.65.147/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.147/32 -j DROP +-A blockip_out -d 2.16.65.171/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.171/32 -j DROP +-A blockip_out -d 88.221.65.13/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.65.13/32 -j DROP +-A blockip_out -d 195.8.22.64/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.64/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.152/32 -j DROP +-A blockip_out -d 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.138/32 -j DROP +-A blockip_out -d 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.37.165.98/32 -j DROP +-A blockip_out -d 23.39.84.7/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.39.84.7/32 -j DROP +-A blockip_out -d 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.37.165.98/32 -j DROP +-A blockip_out -d 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.224/32 -j DROP +-A blockip_out -d 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.209/32 -j DROP +-A blockip_out -d 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.152/32 -j DROP +-A blockip_out -d 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.168/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.26.211/32 -j DROP +-A blockip_out -d 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.59.84/32 -j DROP +-A blockip_out -d 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.83.103/32 -j DROP +-A blockip_out -d 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.65.125/32 -j DROP +-A blockip_out -d 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.50.86/32 -j DROP +-A blockip_out -d 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.76.109/32 -j DROP +-A blockip_out -d 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.165.77/32 -j DROP +-A blockip_out -d 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.222.92/32 -j DROP +-A blockip_out -d 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.254.127/32 -j DROP +-A blockip_out -d 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.9.106/32 -j DROP +-A blockip_out -d 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.192.89/32 -j DROP +-A blockip_out -d 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.158.207.255/32 -j DROP +-A blockip_out -d 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.124.153.99/32 -j DROP +-A blockip_out -d 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.123.92.221/32 -j DROP +-A blockip_out -d 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.224.167/32 -j DROP +-A blockip_out -d 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.45.201/32 -j DROP +-A blockip_out -d 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.93.153.201/32 -j DROP +-A blockip_out -d 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.103.70/32 -j DROP +-A blockip_out -d 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.196.78.8/32 -j DROP +-A blockip_out -d 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.20.203/32 -j DROP +-A blockip_out -d 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.110.84/32 -j DROP +-A blockip_out -d 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.82.208/32 -j DROP +-A blockip_out -d 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.31.225/32 -j DROP +-A blockip_out -d 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.58.105.233/32 -j DROP +-A blockip_out -d 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.241.69/32 -j DROP +-A blockip_out -d 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.28.195.9/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.111.172/32 -j DROP +-A blockip_out -d 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.232.16/32 -j DROP +-A blockip_out -d 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.34.196/32 -j DROP +-A blockip_out -d 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.187.153/32 -j DROP +-A blockip_out -d 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.184.201.126/32 -j DROP +-A blockip_out -d 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.82.205/32 -j DROP +-A blockip_out -d 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.150.188/32 -j DROP +-A blockip_out -d 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.156.16/32 -j DROP +-A blockip_out -d 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.13.61/32 -j DROP +-A blockip_out -d 72.21.195.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 72.21.195.65/32 -j DROP +-A blockip_out -d 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.13.61/32 -j DROP +-A blockip_out -d 52.46.145.112/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.46.145.112/32 -j DROP +-A blockip_out -d 52.46.141.49/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.46.141.49/32 -j DROP +-A blockip_out -d 54.239.26.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.239.26.255/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.37.114.192/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.37.114.192/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.160.240.60/32 -j DROP +-A blockip_out -d 52.10.136.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.10.136.27/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.160.240.60/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.26.211/32 -j DROP +-A blockip_out -d 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.59.84/32 -j DROP +-A blockip_out -d 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.83.103/32 -j DROP +-A blockip_out -d 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.65.125/32 -j DROP +-A blockip_out -d 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.50.86/32 -j DROP +-A blockip_out -d 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.76.109/32 -j DROP +-A blockip_out -d 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.165.77/32 -j DROP +-A blockip_out -d 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.222.92/32 -j DROP +-A blockip_out -d 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.254.127/32 -j DROP +-A blockip_out -d 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.9.106/32 -j DROP +-A blockip_out -d 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.192.89/32 -j DROP +-A blockip_out -d 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.158.207.255/32 -j DROP +-A blockip_out -d 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.124.153.99/32 -j DROP +-A blockip_out -d 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.123.92.221/32 -j DROP +-A blockip_out -d 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.224.167/32 -j DROP +-A blockip_out -d 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.45.201/32 -j DROP +-A blockip_out -d 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.93.153.201/32 -j DROP +-A blockip_out -d 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.103.70/32 -j DROP +-A blockip_out -d 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.196.78.8/32 -j DROP +-A blockip_out -d 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.20.203/32 -j DROP +-A blockip_out -d 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.110.84/32 -j DROP +-A blockip_out -d 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.82.208/32 -j DROP +-A blockip_out -d 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.31.225/32 -j DROP +-A blockip_out -d 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.58.105.233/32 -j DROP +-A blockip_out -d 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.241.69/32 -j DROP +-A blockip_out -d 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.28.195.9/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.148.24.227/32 -j DROP +-A blockip_out -d 52.41.41.102/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.41.41.102/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.148.24.227/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 35.166.120.35/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.120.35/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.111.172/32 -j DROP +-A blockip_out -d 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.232.16/32 -j DROP +-A blockip_out -d 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.34.196/32 -j DROP +-A blockip_out -d 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.187.153/32 -j DROP +-A blockip_out -d 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.184.201.126/32 -j DROP +-A blockip_out -d 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.82.205/32 -j DROP +-A blockip_out -d 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.150.188/32 -j DROP +-A blockip_out -d 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.156.16/32 -j DROP -A cli_dns_in -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT -A cli_dns_in -j RETURN -A cli_dns_out -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT @@ -159,6 +894,8 @@ COMMIT -A cli_ssh_in -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A cli_ssh_in -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A cli_ssh_in -j RETURN +-A cli_ssh_out -d 10.0.0.0/8 -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT +-A cli_ssh_out -p tcp -m tcp --dport 2222 --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "iptables: SSH OUT:" -A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT -A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT -A cli_ssh_out -j RETURN @@ -190,19 +927,24 @@ COMMIT -A srv_https_out -j RETURN -A srv_icmp -p icmp -j ACCEPT -A srv_icmp -j RETURN +-A srv_ntp -p udp -m udp --sport 123 --dport 123 -j ACCEPT +-A srv_ntp -j RETURN -A srv_rip -p udp -m udp --sport 520 --dport 520 -j ACCEPT -A srv_rip -j RETURN +-A srv_smtp_in -p tcp -m tcp --sport 1024:65535 --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT +-A srv_smtp_in -j RETURN +-A srv_smtp_out -p tcp -m tcp --sport 25 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +-A srv_smtp_out -j RETURN +-A srv_ssh_in -s 10.0.0.0/8 -p tcp -m tcp --dport 2222 -m state --state NEW -j ACCEPT +-A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -j LOG --log-prefix "iptables: SSH NEW:" -A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" +-A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP: SSH" -A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP -A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP --A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state ESTABLISHED -j ACCEPT -A srv_ssh_in -j RETURN +-A srv_ssh_out -d 10.0.0.0/8 -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +-A srv_ssh_out -p tcp -m tcp --sport 2222 --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "iptables: SSH OUT:" -A srv_ssh_out -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_out -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A srv_ssh_out -j RETURN COMMIT -# Completed on Mon Jul 8 00:42:39 2019 +# Completed on Mon Feb 17 04:36:55 2020 diff --git a/tools/conf/etc/logrotate.conf b/tools/conf/etc/logrotate.conf index 636dffb..549bd7f 100644 --- a/tools/conf/etc/logrotate.conf +++ b/tools/conf/etc/logrotate.conf @@ -219,6 +219,15 @@ include /etc/logrotate.d endscript } +/var/log/ntpd { + # uncomment this if you want your log files compressed + delaycompress + compress + postrotate + /etc/rc.d/syslog-ng reload >/dev/null + endscript +} + /var/log/dnsmasq { # uncomment this if you want your log files compressed delaycompress @@ -295,7 +304,7 @@ include /etc/logrotate.d endscript } -/var/log/nginx/tribu_error.log { +/var/log/nginx/vhost_error { # uncomment this if you want your log files compressed delaycompress compress @@ -305,7 +314,7 @@ include /etc/logrotate.d endscript } -/var/log/nginx/tribu_access.log { +/var/log/nginx/vhost_access { # uncomment this if you want your log files compressed delaycompress compress diff --git a/tools/conf/etc/skel/.vimrc b/tools/conf/etc/skel/.vimrc index 0a3656d..fb4445f 100644 --- a/tools/conf/etc/skel/.vimrc +++ b/tools/conf/etc/skel/.vimrc @@ -34,12 +34,16 @@ set incsearch " do incremental searching " "" Switch syntax highlighting on, when the terminal has colors "" Also switch on highlighting the last used search pattern. + +" colorscheme desert +set t_Co=256 if &t_Co > 2 || has("gui_running") syntax on set hlsearch set background=dark colorscheme wombat256mod " colorscheme desert + :hi SpellBad ctermfg=Black guifg=Black endif @@ -110,12 +114,10 @@ map :tabprevious map :tabnext " "" Show Line Numbers -"" set nu -"" Show Relative Line Numbers set relativenumber -"set complete=.,b,u,] -"set wildmode=longest,list:longest -"set completeopt=menu,preview +set complete=.,b,u,] +set wildmode=longest,list:longest +set completeopt=menu,preview " "" Directories set backupdir=~/.vim/backup @@ -147,7 +149,7 @@ autocmd BufWinLeave * call clearmatches() "" Finally, if you want an indent to correspond to a single tab, you should also use: ""set shiftwidth=4 "" For indents that consist of 4 space characters but are entered with the tab key: -set tabstop=4 softtabstop=0 expandtab shiftwidth=4 smarttab +set tabstop=8 softtabstop=0 expandtab shiftwidth=4 smarttab "set list "" set past gives problems with tabs "" set paste diff --git a/tools/conf/etc/syslog-ng.conf b/tools/conf/etc/syslog-ng.conf index b6aa817..27c95ba 100644 --- a/tools/conf/etc/syslog-ng.conf +++ b/tools/conf/etc/syslog-ng.conf @@ -63,6 +63,7 @@ destination d_messages { file("/var/log/messages"); }; # Custom destinations destination d_shorewall_warn { file ("/var/log/shorewall/warn"); }; destination d_shorewall_info { file ("/var/log/shorewall/info"); }; +destination d_ntpd { file("/var/log/ntpd"); }; destination d_dnsmasq { file("/var/log/dnsmasq"); }; destination d_postgres { file("/var/log/pgsql"); }; destination d_mysql { file("/var/log/pgsql"); }; @@ -148,14 +149,15 @@ filter f_console { level(warn .. emerg); }; # custom filters -filter f_dnsmasq { program("^dnsmasq$"); }; +filter f_ntpd { facility(daemon) and program("^ntpd$"); }; +filter f_dnsmasq { facility(daemon) and program("^dnsmasq$"); }; filter f_postgres { facility(local0) and program("^postgresql$"); }; filter f_sshd { facility(auth) and program("^sshd$"); }; filter f_iptables { facility(kern) and match("iptables" value("MESSAGE")) }; filter f_shorewall_warn { level (warn) and match ("Shorewall" value("MESSAGE")); }; filter f_shorewall_info {level (info) and match ("Shorewall" value("MESSAGE")); }; -filter f_gitolite { program("^gitolite$"); }; +filter f_gitolite { facility(daemon) and program("^gitolite$"); }; filter f_git-daemon { program("^git-daemon$"); }; filter f_nginx_error { facility(daemon) and program("^nginx$"); }; filter f_nginx_vhost { facility(daemon) and program("^nginx_vhost$");}; @@ -164,6 +166,7 @@ filter f_php_fpm { facility(daemon) and program("^php-fpm$");}; filter f_php { facility(daemon) and program("^php$");}; # custom logs +log { source(s_src); filter(f_ntpd); destination(d_ntpd); }; log { source(s_src); filter(f_php_fpm); destination(d_php_fpm); }; log { source(s_src); filter(f_php); destination(d_php); }; log { source(s_src); filter(f_nginx_vhost); destination(d_nginx_vhost); }; diff --git a/tools/postgresql.html b/tools/postgresql.html index 141d6c2..f27b7d4 100644 --- a/tools/postgresql.html +++ b/tools/postgresql.html @@ -274,7 +274,7 @@

Deleting database with dropdb command;

-        sudo -u postgres dropdb db_name
+        sudo -u postgres dropdb -U postgres db_name

4.3. List databases

@@ -302,7 +302,7 @@

Restore a database;

-        $ cat db_name_dump | psql -U user_name -d db_name
+        $ psql -U user_name -d db_name -f db_name_dump

5. Psql

-- cgit 1.4.1-2-gfad0 From d9ddaa49950198fbdae3e18e95506b4451eb9fbc Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Mon, 17 Feb 2020 06:43:09 +0000 Subject: several configuration fix's --- core/conf/iptables/bridge.v4 | 852 ++++++++++++++++++++++++++++++++++--- core/conf/iptables/ipt-bridge.sh | 12 +- core/conf/iptables/ipt-conf.sh | 1 + core/conf/iptables/ipt-firewall.sh | 129 +++--- core/conf/iptables/ipt-server.sh | 2 + core/conf/iptables/server.v4 | 38 +- core/conf/rc.d/fcgiwrap | 41 ++ core/conf/rc.d/git-daemon | 43 ++ core/conf/rc.d/iptables | 80 ++-- core/conf/rc.d/postgresql | 16 + 10 files changed, 1033 insertions(+), 181 deletions(-) create mode 100755 core/conf/rc.d/fcgiwrap create mode 100755 core/conf/rc.d/git-daemon create mode 100755 core/conf/rc.d/postgresql (limited to 'core/conf/iptables/ipt-bridge.sh') diff --git a/core/conf/iptables/bridge.v4 b/core/conf/iptables/bridge.v4 index 7048bdb..bf0245a 100644 --- a/core/conf/iptables/bridge.v4 +++ b/core/conf/iptables/bridge.v4 @@ -1,39 +1,41 @@ -# Generated by iptables-save v1.8.3 on Thu Sep 12 14:45:57 2019 +# Generated by iptables-save v1.8.4 on Mon Feb 17 16:36:51 2020 *security :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] COMMIT -# Completed on Thu Sep 12 14:45:57 2019 -# Generated by iptables-save v1.8.3 on Thu Sep 12 14:45:57 2019 +# Completed on Mon Feb 17 16:36:51 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 16:36:51 2020 *raw :PREROUTING ACCEPT [0:0] -:OUTPUT ACCEPT [2:104] +:OUTPUT ACCEPT [187:272176] COMMIT -# Completed on Thu Sep 12 14:45:57 2019 -# Generated by iptables-save v1.8.3 on Thu Sep 12 14:45:57 2019 +# Completed on Mon Feb 17 16:36:51 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 16:36:51 2020 *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] COMMIT -# Completed on Thu Sep 12 14:45:57 2019 -# Generated by iptables-save v1.8.3 on Thu Sep 12 14:45:57 2019 +# Completed on Mon Feb 17 16:36:51 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 16:36:51 2020 *mangle :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [2:104] +:OUTPUT ACCEPT [187:272176] :POSTROUTING ACCEPT [0:0] COMMIT -# Completed on Thu Sep 12 14:45:57 2019 -# Generated by iptables-save v1.8.3 on Thu Sep 12 14:45:57 2019 +# Completed on Mon Feb 17 16:36:51 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 16:36:51 2020 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :blocker - [0:0] +:blockip_in - [0:0] +:blockip_out - [0:0] :cli_dns_in - [0:0] :cli_dns_out - [0:0] :cli_ftp_in - [0:0] @@ -68,59 +70,74 @@ COMMIT :srv_icmp - [0:0] :srv_ntp - [0:0] :srv_rip - [0:0] +:srv_smtp_in - [0:0] +:srv_smtp_out - [0:0] :srv_ssh_in - [0:0] :srv_ssh_out - [0:0] -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT -A INPUT -s 10.0.0.254/32 -d 10.0.0.254/32 -i lo -j ACCEPT -A INPUT -j blocker --A INPUT -d 10.0.0.254/32 -i br0 -p tcp -m tcp --sport 3030 --dport 1024:65535 -j DROP --A INPUT -i br0 -j srv_dhcp +-A INPUT -j blockip_in +-A INPUT -i br0 -p udp -m udp --sport 520 --dport 520 -j DROP +-A INPUT -d 10.0.0.254/32 -i br0 -p tcp -m tcp --sport 3030 -j DROP +-A INPUT -s 212.55.154.174/32 -d 10.0.0.254/32 -i br0 -j cli_dns_in +-A INPUT -s 10.0.0.0/8 -d 10.0.0.254/32 -i br0 -m physdev --physdev-in tap2 -j cli_http_in +-A INPUT -s 10.0.0.1/32 -i br0 -m physdev --physdev-in enp8s0 -j cli_http_in +-A INPUT -i br0 -m physdev --physdev-in enp8s0 -j cli_https_in +-A INPUT -i br0 -m physdev --physdev-in tap2 -j cli_https_in +-A INPUT -s 10.0.0.0/8 -d 10.0.0.254/32 -i br0 -j cli_ssh_in +-A INPUT -s 10.0.0.4/32 -d 10.0.0.254/32 -i br0 -j cli_git_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.254/32 -i br0 -j srv_dns_in --A INPUT -s 10.0.0.0/8 -d 10.0.0.254/32 -i br0 -j srv_icmp +-A INPUT -s 10.0.0.1/32 -i br0 -m physdev --physdev-in enp8s0 -j srv_dhcp +-A INPUT -s 10.0.0.0/8 -i br0 -m physdev --physdev-in enp8s0 -j srv_dhcp -A INPUT -s 10.0.0.0/8 -d 10.0.0.254/32 -i br0 -j srv_ssh_in --A INPUT -s 10.0.0.0/8 -d 10.0.0.254/32 -i br0 -j cli_http_in --A INPUT -s 212.55.154.174/32 -d 10.0.0.254/32 -i br0 -j cli_dns_in --A INPUT -d 10.0.0.254/32 -i br0 -j cli_https_in --A INPUT -i br0 -j cli_http_in --A INPUT -d 10.0.0.254/32 -i br0 -j cli_git_in --A INPUT -d 10.0.0.254/32 -i br0 -j cli_ssh_in --A INPUT -d 10.0.0.254/32 -i br0 -j srv_ntp --A INPUT -d 10.0.0.254/32 -i br0 -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -j LOG --log-prefix "iptables: INPUT: " --log-level 7 +-A FORWARD -j blocker +-A FORWARD -j blockip_in +-A FORWARD -j blockip_out -A FORWARD -s 10.0.0.0/8 -d 10.0.0.0/8 -i br0 -o br0 -j ACCEPT +-A FORWARD -i br0 -o br0 -p udp -m udp --sport 520 --dport 520 -j DROP -A FORWARD -s 0.0.0.0/32 -d 255.255.255.255/32 -i br0 -o br0 -j srv_dhcp --A FORWARD -s 10.0.0.0/8 -i br0 -o br0 -j ACCEPT --A FORWARD -d 10.0.0.5/32 -i br0 -o br0 -j ACCEPT --A FORWARD -s 212.55.154.174/32 -d 10.0.0.254/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j cli_dns_in --A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j srv_http_in --A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j srv_https_in +-A FORWARD -s 10.0.0.4/32 -d 212.55.154.174/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 10.0.0.4/32 -d 204.140.20.21/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 10.0.0.4/32 -d 50.23.197.95/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 10.0.0.4/32 -d 50.23.197.94/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 10.0.0.4/32 -d 212.55.154.174/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 10.0.0.4/32 -d 204.140.20.21/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 10.0.0.4/32 -d 50.23.197.94/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 212.55.154.174/32 -d 10.0.0.4/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 204.140.20.21/32 -d 10.0.0.4/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 50.23.197.95/32 -d 10.0.0.4/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 50.23.197.94/32 -d 10.0.0.4/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 212.55.154.174/32 -d 10.0.0.4/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 204.140.20.21/32 -d 10.0.0.4/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 50.23.197.94/32 -d 10.0.0.4/32 -i br0 -o br0 -j ACCEPT +-A FORWARD -s 10.0.0.3/32 -i br0 -m physdev --physdev-in tap1 --physdev-out enp8s0 -j cli_https_out +-A FORWARD -s 10.0.0.3/32 -i br0 -m physdev --physdev-in tap1 --physdev-out enp8s0 -j cli_http_out +-A FORWARD -d 10.0.0.3/32 -i br0 -m physdev --physdev-in enp8s0 --physdev-out tap1 -j cli_https_in +-A FORWARD -d 10.0.0.3/32 -i br0 -m physdev --physdev-in enp8s0 --physdev-out tap1 -j cli_http_in -A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j srv_ssh_in +-A FORWARD -s 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in tap2 -j srv_ssh_out -A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j srv_git_in --A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j srv_ntp --A FORWARD -i br0 -o br0 -p tcp -m physdev --physdev-in enp8s0 -m tcp --sport 443 --dport 1024:65535 -j ACCEPT --A FORWARD -d 10.0.0.3/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j cli_http_in --A FORWARD -d 10.0.0.3/32 -i br0 -o br0 -p tcp -m physdev --physdev-in enp8s0 -m tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT +-A FORWARD -s 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in tap2 -j srv_git_out -A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j cli_http_in --A FORWARD -i br0 -o br0 -p udp -m udp --sport 520 --dport 519 -j DROP --A FORWARD -i br0 -o br0 -p udp -m udp --sport 520 --dport 520 -j DROP +-A FORWARD -s 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in tap2 -j cli_http_out -A FORWARD -j LOG --log-prefix "iptables: FORWARD: " --log-level 7 -A OUTPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -o lo -j ACCEPT -A OUTPUT -s 10.0.0.254/32 -d 10.0.0.254/32 -o lo -j ACCEPT --A OUTPUT -s 10.0.0.254/32 -o br0 -p tcp -m tcp --sport 1024:65535 --dport 3030 -j DROP --A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j srv_dhcp +-A OUTPUT -o br0 -p udp -m udp --sport 520 --dport 520 -j DROP +-A OUTPUT -s 10.0.0.254/32 -o br0 -p tcp -m tcp --dport 3030 -j DROP +-A OUTPUT -o blockip_out +-A OUTPUT -s 10.0.0.254/32 -d 212.55.154.174/32 -o br0 -j cli_dns_out -A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j srv_dns_out -A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j srv_ssh_out --A OUTPUT -s 10.0.0.254/32 -o br0 -j srv_git_out --A OUTPUT -o br0 -j srv_icmp --A OUTPUT -s 10.0.0.254/32 -d 212.55.154.174/32 -o br0 -j cli_dns_out --A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j cli_ssh_out --A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j cli_git_out -A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j cli_http_out +-A OUTPUT -s 10.0.0.254/32 -d 10.0.0.1/32 -o br0 -j cli_http_out -A OUTPUT -s 10.0.0.254/32 -o br0 -j cli_https_out --A OUTPUT -s 10.0.0.254/32 -o br0 -j cli_git_out --A OUTPUT -j cli_http_out --A OUTPUT -s 10.0.0.254/32 -o br0 -j srv_ntp --A OUTPUT -s 10.0.0.254/32 -o br0 -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT +-A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j cli_ssh_out +-A OUTPUT -s 10.0.0.254/32 -d 10.0.0.4/32 -o br0 -j cli_git_out +-A OUTPUT -d 10.0.0.0/8 -o br0 -j srv_dhcp +-A OUTPUT -d 10.0.0.0/8 -o br0 -j srv_icmp -A OUTPUT -j LOG --log-prefix "iptables: OUTPUT: " --log-level 7 -A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop sync: " --log-level 7 -A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP @@ -138,6 +155,734 @@ COMMIT -A blocker -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP -A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP -A blocker -j RETURN +-A blockip_in -s 52.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.0.0.0/8 -j DROP +-A blockip_in -s 54.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.0.0.0/8 -j DROP +-A blockip_in -s 13.48.203.206/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.48.203.206/32 -j DROP +-A blockip_in -s 2.21.169.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.21.169.41/32 -j DROP +-A blockip_in -s 13.115.174.176/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.115.174.176/32 -j DROP +-A blockip_in -s 18.182.0.0/16 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.182.0.0/16 -j DROP +-A blockip_in -s 23.10.69.56/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.69.56/32 -j DROP +-A blockip_in -s 104.89.189.238/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 104.89.189.238/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.41/32 -j DROP +-A blockip_in -s 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.168/32 -j DROP +-A blockip_in -s 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.152/32 -j DROP +-A blockip_in -s 88.221.64.239/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.64.239/32 -j DROP +-A blockip_in -s 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.138/32 -j DROP +-A blockip_in -s 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.152/32 -j DROP +-A blockip_in -s 23.10.74.160/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.74.160/32 -j DROP +-A blockip_in -s 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.224/32 -j DROP +-A blockip_in -s 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.209/32 -j DROP +-A blockip_in -s 23.10.76.42/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.76.42/32 -j DROP +-A blockip_in -s 88.221.65.114/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.65.114/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.48/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.48/32 -j DROP +-A blockip_in -s 2.16.65.147/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.147/32 -j DROP +-A blockip_in -s 2.16.65.171/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.171/32 -j DROP +-A blockip_in -s 88.221.65.13/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.65.13/32 -j DROP +-A blockip_in -s 195.8.22.64/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.64/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.152/32 -j DROP +-A blockip_in -s 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.138/32 -j DROP +-A blockip_in -s 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.37.165.98/32 -j DROP +-A blockip_in -s 23.39.84.7/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.39.84.7/32 -j DROP +-A blockip_in -s 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.37.165.98/32 -j DROP +-A blockip_in -s 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.224/32 -j DROP +-A blockip_in -s 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.209/32 -j DROP +-A blockip_in -s 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.152/32 -j DROP +-A blockip_in -s 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.168/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.26.211/32 -j DROP +-A blockip_in -s 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.59.84/32 -j DROP +-A blockip_in -s 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.83.103/32 -j DROP +-A blockip_in -s 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.65.125/32 -j DROP +-A blockip_in -s 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.50.86/32 -j DROP +-A blockip_in -s 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.76.109/32 -j DROP +-A blockip_in -s 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.165.77/32 -j DROP +-A blockip_in -s 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.222.92/32 -j DROP +-A blockip_in -s 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.254.127/32 -j DROP +-A blockip_in -s 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.9.106/32 -j DROP +-A blockip_in -s 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.192.89/32 -j DROP +-A blockip_in -s 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.158.207.255/32 -j DROP +-A blockip_in -s 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.124.153.99/32 -j DROP +-A blockip_in -s 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.123.92.221/32 -j DROP +-A blockip_in -s 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.224.167/32 -j DROP +-A blockip_in -s 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.45.201/32 -j DROP +-A blockip_in -s 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.93.153.201/32 -j DROP +-A blockip_in -s 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.103.70/32 -j DROP +-A blockip_in -s 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.196.78.8/32 -j DROP +-A blockip_in -s 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.20.203/32 -j DROP +-A blockip_in -s 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.110.84/32 -j DROP +-A blockip_in -s 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.82.208/32 -j DROP +-A blockip_in -s 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.31.225/32 -j DROP +-A blockip_in -s 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.58.105.233/32 -j DROP +-A blockip_in -s 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.241.69/32 -j DROP +-A blockip_in -s 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.28.195.9/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.111.172/32 -j DROP +-A blockip_in -s 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.232.16/32 -j DROP +-A blockip_in -s 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.34.196/32 -j DROP +-A blockip_in -s 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.187.153/32 -j DROP +-A blockip_in -s 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.184.201.126/32 -j DROP +-A blockip_in -s 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.82.205/32 -j DROP +-A blockip_in -s 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.150.188/32 -j DROP +-A blockip_in -s 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.156.16/32 -j DROP +-A blockip_in -s 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.13.61/32 -j DROP +-A blockip_in -s 72.21.195.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 72.21.195.65/32 -j DROP +-A blockip_in -s 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.13.61/32 -j DROP +-A blockip_in -s 52.46.145.112/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.46.145.112/32 -j DROP +-A blockip_in -s 52.46.141.49/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.46.141.49/32 -j DROP +-A blockip_in -s 54.239.26.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.239.26.255/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.37.114.192/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.37.114.192/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.160.240.60/32 -j DROP +-A blockip_in -s 52.10.136.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.10.136.27/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.160.240.60/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.26.211/32 -j DROP +-A blockip_in -s 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.59.84/32 -j DROP +-A blockip_in -s 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.83.103/32 -j DROP +-A blockip_in -s 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.65.125/32 -j DROP +-A blockip_in -s 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.50.86/32 -j DROP +-A blockip_in -s 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.76.109/32 -j DROP +-A blockip_in -s 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.165.77/32 -j DROP +-A blockip_in -s 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.222.92/32 -j DROP +-A blockip_in -s 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.254.127/32 -j DROP +-A blockip_in -s 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.9.106/32 -j DROP +-A blockip_in -s 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.192.89/32 -j DROP +-A blockip_in -s 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.158.207.255/32 -j DROP +-A blockip_in -s 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.124.153.99/32 -j DROP +-A blockip_in -s 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.123.92.221/32 -j DROP +-A blockip_in -s 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.224.167/32 -j DROP +-A blockip_in -s 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.45.201/32 -j DROP +-A blockip_in -s 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.93.153.201/32 -j DROP +-A blockip_in -s 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.103.70/32 -j DROP +-A blockip_in -s 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.196.78.8/32 -j DROP +-A blockip_in -s 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.20.203/32 -j DROP +-A blockip_in -s 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.110.84/32 -j DROP +-A blockip_in -s 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.82.208/32 -j DROP +-A blockip_in -s 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.31.225/32 -j DROP +-A blockip_in -s 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.58.105.233/32 -j DROP +-A blockip_in -s 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.241.69/32 -j DROP +-A blockip_in -s 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.28.195.9/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.148.24.227/32 -j DROP +-A blockip_in -s 52.41.41.102/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.41.41.102/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.148.24.227/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 35.166.120.35/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.120.35/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.111.172/32 -j DROP +-A blockip_in -s 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.232.16/32 -j DROP +-A blockip_in -s 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.34.196/32 -j DROP +-A blockip_in -s 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.187.153/32 -j DROP +-A blockip_in -s 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.184.201.126/32 -j DROP +-A blockip_in -s 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.82.205/32 -j DROP +-A blockip_in -s 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.150.188/32 -j DROP +-A blockip_in -s 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.156.16/32 -j DROP +-A blockip_out -d 52.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.0.0.0/8 -j DROP +-A blockip_out -d 54.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.0.0.0/8 -j DROP +-A blockip_out -d 13.48.203.206/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.48.203.206/32 -j DROP +-A blockip_out -d 2.21.169.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.21.169.41/32 -j DROP +-A blockip_out -d 13.115.174.176/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.115.174.176/32 -j DROP +-A blockip_out -d 18.182.0.0/16 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.182.0.0/16 -j DROP +-A blockip_out -d 23.10.69.56/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.69.56/32 -j DROP +-A blockip_out -d 104.89.189.238/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 104.89.189.238/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.41/32 -j DROP +-A blockip_out -d 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.168/32 -j DROP +-A blockip_out -d 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.152/32 -j DROP +-A blockip_out -d 88.221.64.239/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.64.239/32 -j DROP +-A blockip_out -d 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.138/32 -j DROP +-A blockip_out -d 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.152/32 -j DROP +-A blockip_out -d 23.10.74.160/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.74.160/32 -j DROP +-A blockip_out -d 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.224/32 -j DROP +-A blockip_out -d 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.209/32 -j DROP +-A blockip_out -d 23.10.76.42/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.76.42/32 -j DROP +-A blockip_out -d 88.221.65.114/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.65.114/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.48/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.48/32 -j DROP +-A blockip_out -d 2.16.65.147/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.147/32 -j DROP +-A blockip_out -d 2.16.65.171/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.171/32 -j DROP +-A blockip_out -d 88.221.65.13/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.65.13/32 -j DROP +-A blockip_out -d 195.8.22.64/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.64/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.152/32 -j DROP +-A blockip_out -d 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.138/32 -j DROP +-A blockip_out -d 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.37.165.98/32 -j DROP +-A blockip_out -d 23.39.84.7/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.39.84.7/32 -j DROP +-A blockip_out -d 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.37.165.98/32 -j DROP +-A blockip_out -d 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.224/32 -j DROP +-A blockip_out -d 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.209/32 -j DROP +-A blockip_out -d 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.152/32 -j DROP +-A blockip_out -d 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.168/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.26.211/32 -j DROP +-A blockip_out -d 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.59.84/32 -j DROP +-A blockip_out -d 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.83.103/32 -j DROP +-A blockip_out -d 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.65.125/32 -j DROP +-A blockip_out -d 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.50.86/32 -j DROP +-A blockip_out -d 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.76.109/32 -j DROP +-A blockip_out -d 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.165.77/32 -j DROP +-A blockip_out -d 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.222.92/32 -j DROP +-A blockip_out -d 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.254.127/32 -j DROP +-A blockip_out -d 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.9.106/32 -j DROP +-A blockip_out -d 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.192.89/32 -j DROP +-A blockip_out -d 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.158.207.255/32 -j DROP +-A blockip_out -d 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.124.153.99/32 -j DROP +-A blockip_out -d 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.123.92.221/32 -j DROP +-A blockip_out -d 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.224.167/32 -j DROP +-A blockip_out -d 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.45.201/32 -j DROP +-A blockip_out -d 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.93.153.201/32 -j DROP +-A blockip_out -d 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.103.70/32 -j DROP +-A blockip_out -d 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.196.78.8/32 -j DROP +-A blockip_out -d 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.20.203/32 -j DROP +-A blockip_out -d 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.110.84/32 -j DROP +-A blockip_out -d 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.82.208/32 -j DROP +-A blockip_out -d 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.31.225/32 -j DROP +-A blockip_out -d 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.58.105.233/32 -j DROP +-A blockip_out -d 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.241.69/32 -j DROP +-A blockip_out -d 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.28.195.9/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.111.172/32 -j DROP +-A blockip_out -d 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.232.16/32 -j DROP +-A blockip_out -d 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.34.196/32 -j DROP +-A blockip_out -d 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.187.153/32 -j DROP +-A blockip_out -d 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.184.201.126/32 -j DROP +-A blockip_out -d 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.82.205/32 -j DROP +-A blockip_out -d 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.150.188/32 -j DROP +-A blockip_out -d 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.156.16/32 -j DROP +-A blockip_out -d 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.13.61/32 -j DROP +-A blockip_out -d 72.21.195.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 72.21.195.65/32 -j DROP +-A blockip_out -d 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.13.61/32 -j DROP +-A blockip_out -d 52.46.145.112/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.46.145.112/32 -j DROP +-A blockip_out -d 52.46.141.49/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.46.141.49/32 -j DROP +-A blockip_out -d 54.239.26.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.239.26.255/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.37.114.192/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.37.114.192/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.160.240.60/32 -j DROP +-A blockip_out -d 52.10.136.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.10.136.27/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.160.240.60/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.26.211/32 -j DROP +-A blockip_out -d 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.59.84/32 -j DROP +-A blockip_out -d 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.83.103/32 -j DROP +-A blockip_out -d 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.65.125/32 -j DROP +-A blockip_out -d 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.50.86/32 -j DROP +-A blockip_out -d 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.76.109/32 -j DROP +-A blockip_out -d 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.165.77/32 -j DROP +-A blockip_out -d 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.222.92/32 -j DROP +-A blockip_out -d 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.254.127/32 -j DROP +-A blockip_out -d 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.9.106/32 -j DROP +-A blockip_out -d 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.192.89/32 -j DROP +-A blockip_out -d 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.158.207.255/32 -j DROP +-A blockip_out -d 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.124.153.99/32 -j DROP +-A blockip_out -d 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.123.92.221/32 -j DROP +-A blockip_out -d 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.224.167/32 -j DROP +-A blockip_out -d 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.45.201/32 -j DROP +-A blockip_out -d 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.93.153.201/32 -j DROP +-A blockip_out -d 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.103.70/32 -j DROP +-A blockip_out -d 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.196.78.8/32 -j DROP +-A blockip_out -d 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.20.203/32 -j DROP +-A blockip_out -d 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.110.84/32 -j DROP +-A blockip_out -d 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.82.208/32 -j DROP +-A blockip_out -d 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.31.225/32 -j DROP +-A blockip_out -d 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.58.105.233/32 -j DROP +-A blockip_out -d 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.241.69/32 -j DROP +-A blockip_out -d 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.28.195.9/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.148.24.227/32 -j DROP +-A blockip_out -d 52.41.41.102/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.41.41.102/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.148.24.227/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 35.166.120.35/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.120.35/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.111.172/32 -j DROP +-A blockip_out -d 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.232.16/32 -j DROP +-A blockip_out -d 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.34.196/32 -j DROP +-A blockip_out -d 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.187.153/32 -j DROP +-A blockip_out -d 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.184.201.126/32 -j DROP +-A blockip_out -d 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.82.205/32 -j DROP +-A blockip_out -d 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.150.188/32 -j DROP +-A blockip_out -d 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.156.16/32 -j DROP -A cli_dns_in -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT -A cli_dns_in -j RETURN -A cli_dns_out -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT @@ -185,6 +930,8 @@ COMMIT -A cli_ssh_in -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A cli_ssh_in -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A cli_ssh_in -j RETURN +-A cli_ssh_out -d 10.0.0.0/8 -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT +-A cli_ssh_out -p tcp -m tcp --dport 2222 --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "iptables: SSH OUT:" -A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT -A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT -A cli_ssh_out -j RETURN @@ -220,17 +967,20 @@ COMMIT -A srv_ntp -j RETURN -A srv_rip -p udp -m udp --sport 520 --dport 520 -j ACCEPT -A srv_rip -j RETURN +-A srv_smtp_in -p tcp -m tcp --sport 1024:65535 --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT +-A srv_smtp_in -j RETURN +-A srv_smtp_out -p tcp -m tcp --sport 25 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +-A srv_smtp_out -j RETURN +-A srv_ssh_in -s 10.0.0.0/8 -p tcp -m tcp --dport 2222 -m state --state NEW -j ACCEPT +-A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -j LOG --log-prefix "iptables: SSH NEW:" -A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" +-A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP: SSH" -A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP -A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP --A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state ESTABLISHED -j ACCEPT -A srv_ssh_in -j RETURN +-A srv_ssh_out -d 10.0.0.0/8 -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +-A srv_ssh_out -p tcp -m tcp --sport 2222 --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "iptables: SSH OUT:" -A srv_ssh_out -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_out -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A srv_ssh_out -j RETURN COMMIT -# Completed on Thu Sep 12 14:45:57 2019 +# Completed on Mon Feb 17 16:36:51 2020 diff --git a/core/conf/iptables/ipt-bridge.sh b/core/conf/iptables/ipt-bridge.sh index c4b2a00..b329ea8 100644 --- a/core/conf/iptables/ipt-bridge.sh +++ b/core/conf/iptables/ipt-bridge.sh @@ -37,6 +37,7 @@ $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 212.55.154.174 -j ACCEPT $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 204.140.20.21 -j ACCEPT $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 50.23.197.94 -j ACCEPT + $IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-in tap1 --physdev-out ${PUB_IF} -s 10.0.0.3 -j cli_https_out $IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-in tap1 --physdev-out ${PUB_IF} -s 10.0.0.3 -j cli_http_out $IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-out tap1 --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_https_in @@ -45,11 +46,16 @@ $IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-out tap1 --physdev-in ${PUB_IF} $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ssh_in $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_ssh_out $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_git_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ntp +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_git_out +#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ntp + $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j cli_http_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j cli_http_out #####HTTP Server -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in +#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in +#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_http_out +#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in +#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_https_out ######################################################################### # INPUT diff --git a/core/conf/iptables/ipt-conf.sh b/core/conf/iptables/ipt-conf.sh index 63b101f..cc51f12 100644 --- a/core/conf/iptables/ipt-conf.sh +++ b/core/conf/iptables/ipt-conf.sh @@ -1,6 +1,7 @@ #!/bin/bash IPT="/usr/sbin/iptables" +IPT6="/usr/sbin/ip6tables" SPAMLIST="/etc/iptables/blockedip" SPAMDROPMSG="BLOCKED IP: " diff --git a/core/conf/iptables/ipt-firewall.sh b/core/conf/iptables/ipt-firewall.sh index 0a947e6..6dc4f4f 100644 --- a/core/conf/iptables/ipt-firewall.sh +++ b/core/conf/iptables/ipt-firewall.sh @@ -3,65 +3,75 @@ ipt_clear () { echo "clear all iptables tables" - iptables -F - iptables -X - iptables -t nat -F - iptables -t nat -X - iptables -t mangle -F - iptables -t mangle -X - iptables -t raw -F - iptables -t raw -X - iptables -t security -F - iptables -t security -X - iptables -N blocker - iptables -N blockip_in - iptables -N blockip_out - - iptables -N srv_dhcp - iptables -N srv_rip - iptables -N srv_icmp - iptables -N srv_ntp - iptables -N srv_dns_in - iptables -N srv_dns_out - iptables -N srv_http_in - iptables -N srv_http_out - iptables -N srv_https_in - iptables -N srv_https_out - iptables -N srv_smtp_in - iptables -N srv_smtp_out - iptables -N srv_ssh_in - iptables -N srv_ssh_out - iptables -N srv_git_in - iptables -N srv_git_out - iptables -N srv_db_in - iptables -N srv_db_out - - - iptables -N cli_dns_in - iptables -N cli_dns_out - iptables -N cli_http_in - iptables -N cli_http_out - iptables -N cli_https_in - iptables -N cli_https_out - iptables -N cli_ssh_in - iptables -N cli_ssh_out - iptables -N cli_pops_in - iptables -N cli_pops_out - iptables -N cli_smtps_in - iptables -N cli_smtps_out - iptables -N cli_irc_in - iptables -N cli_irc_out - iptables -N cli_ftp_in - iptables -N cli_ftp_out - iptables -N cli_git_in - iptables -N cli_git_out - iptables -N cli_gpg_in - iptables -N cli_gpg_out + $IPT -F + $IPT -X + $IPT6 -F + $IPT6 -X + $PIT4 -Z + $PIT6 -Z + $IPT -t nat -F + $IPT -t nat -X + $IPT -t mangle -F + $IPT -t mangle -X + $IPT -t raw -F + $IPT -t raw -X + $IPT -t security -F + $IPT -t security -X + $IPT -N blocker + $IPT -N blockip_in + $IPT -N blockip_out + + $IPT -N srv_dhcp + $IPT -N srv_rip + $IPT -N srv_icmp + $IPT -N srv_ntp + $IPT -N srv_dns_in + $IPT -N srv_dns_out + $IPT -N srv_http_in + $IPT -N srv_http_out + $IPT -N srv_https_in + $IPT -N srv_https_out + $IPT -N srv_smtp_in + $IPT -N srv_smtp_out + $IPT -N srv_ssh_in + $IPT -N srv_ssh_out + $IPT -N srv_git_in + $IPT -N srv_git_out + $IPT -N srv_db_in + $IPT -N srv_db_out + + + $IPT -N cli_dns_in + $IPT -N cli_dns_out + $IPT -N cli_http_in + $IPT -N cli_http_out + $IPT -N cli_https_in + $IPT -N cli_https_out + $IPT -N cli_ssh_in + $IPT -N cli_ssh_out + $IPT -N cli_pops_in + $IPT -N cli_pops_out + $IPT -N cli_smtps_in + $IPT -N cli_smtps_out + $IPT -N cli_irc_in + $IPT -N cli_irc_out + $IPT -N cli_ftp_in + $IPT -N cli_ftp_out + $IPT -N cli_git_in + $IPT -N cli_git_out + $IPT -N cli_gpg_in + $IPT -N cli_gpg_out # Set Default Rules - iptables -P INPUT DROP - iptables -P FORWARD DROP - iptables -P OUTPUT DROP + $IPT -P INPUT DROP + $IPT -P FORWARD DROP + $IPT -P OUTPUT DROP + + # Set Default Rules + $IPT6 -P INPUT DROP + $IPT6 -P FORWARD DROP + $IPT6 -P OUTPUT DROP + } ipt_log () { @@ -69,8 +79,11 @@ ipt_log () { $IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " $IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " $IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " -} + $IPT6 -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " + $IPT6 -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " + $IPT6 -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " +} ipt_tables () { echo "start adding tables..." diff --git a/core/conf/iptables/ipt-server.sh b/core/conf/iptables/ipt-server.sh index 6cd7175..7d2dbfc 100644 --- a/core/conf/iptables/ipt-server.sh +++ b/core/conf/iptables/ipt-server.sh @@ -19,6 +19,7 @@ $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_https_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_http_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_https_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_git_in @@ -37,6 +38,7 @@ $IPT -A OUTPUT -o ${PUB_IF} -d ${DNS} -s ${PUB_IP} -j cli_dns_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j cli_http_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_https_out +$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_http_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_ssh_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_smtp_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_git_out diff --git a/core/conf/iptables/server.v4 b/core/conf/iptables/server.v4 index 164f95b..1ab9aa2 100644 --- a/core/conf/iptables/server.v4 +++ b/core/conf/iptables/server.v4 @@ -1,34 +1,34 @@ -# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 15:16:01 2020 *security -:INPUT ACCEPT [0:0] +:INPUT ACCEPT [9:360] :FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [0:0] +:OUTPUT ACCEPT [3:12900] COMMIT -# Completed on Mon Feb 17 04:36:55 2020 -# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 +# Completed on Mon Feb 17 15:16:01 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 15:16:01 2020 *raw -:PREROUTING ACCEPT [0:0] -:OUTPUT ACCEPT [187:298268] +:PREROUTING ACCEPT [9:360] +:OUTPUT ACCEPT [190:294568] COMMIT -# Completed on Mon Feb 17 04:36:55 2020 -# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 +# Completed on Mon Feb 17 15:16:01 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 15:16:01 2020 *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] COMMIT -# Completed on Mon Feb 17 04:36:55 2020 -# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 +# Completed on Mon Feb 17 15:16:01 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 15:16:01 2020 *mangle -:PREROUTING ACCEPT [0:0] -:INPUT ACCEPT [0:0] +:PREROUTING ACCEPT [9:360] +:INPUT ACCEPT [9:360] :FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [187:298268] -:POSTROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [190:294568] +:POSTROUTING ACCEPT [3:12900] COMMIT -# Completed on Mon Feb 17 04:36:55 2020 -# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 +# Completed on Mon Feb 17 15:16:01 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 15:16:01 2020 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] @@ -80,6 +80,7 @@ COMMIT -A INPUT -s 10.0.0.254/32 -d 10.0.0.4/32 -i ens3 -j cli_dns_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j cli_http_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j cli_https_in +-A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_http_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_https_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_ssh_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_git_in @@ -95,6 +96,7 @@ COMMIT -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.254/32 -o ens3 -j cli_dns_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j cli_http_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_https_out +-A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_http_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_ssh_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_smtp_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_git_out @@ -947,4 +949,4 @@ COMMIT -A srv_ssh_out -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A srv_ssh_out -j RETURN COMMIT -# Completed on Mon Feb 17 04:36:55 2020 +# Completed on Mon Feb 17 15:16:01 2020 diff --git a/core/conf/rc.d/fcgiwrap b/core/conf/rc.d/fcgiwrap new file mode 100755 index 0000000..2059848 --- /dev/null +++ b/core/conf/rc.d/fcgiwrap @@ -0,0 +1,41 @@ +#!/bin/sh +# +# /etc/rc.d/bird: start/stop fcgiwrapper +# + +SSD=/sbin/start-stop-daemon +NAME=fcgiwrap +PROG=/usr/bin/spawn-fcgi +USER=www +GROUP=gitolite +PIDFILE=/var/run/spawn_${NAME}.pid +SOCKET=/var/run/fcgiwrap.sock +OPTS="-u $USER -g $GROUP -P $PIDFILE -M 0660 -s $SOCKET -- /usr/sbin/${NAME}" + + +case $1 in + start) + echo "Starting ${NAME}..." + $SSD --background --user $USER --quiet --start --pidfile $PIDFILE --exec $PROG -- $OPTS + ;; +stop) + echo "Stopping ${NAME}..." + $SSD --stop --remove-pidfile --retry 10 --pidfile $PIDFILE + ;; +restart) + echo "Restarting ${NAME}..." + $0 stop + $0 start + ;; +status) + $SSD --status --pidfile $PIDFILE + case $? in + 0) echo "$PROG is running with pid $(cat $PIDFILE )" ;; + 3) echo "$PROG is not running" ;; + 4) echo "Unable to determine the program status" ;; + esac + ;; +*) + echo "usage: $0 [start|stop|restart|status]" + ;; +esac diff --git a/core/conf/rc.d/git-daemon b/core/conf/rc.d/git-daemon new file mode 100755 index 0000000..41793eb --- /dev/null +++ b/core/conf/rc.d/git-daemon @@ -0,0 +1,43 @@ +#!/bin/sh + +SSD=/sbin/start-stop-daemon +NAME=git-daemon +PROG=$(git --exec-path)/${NAME} +USER=gitolite +GROUP=gitolite +PIDFILE=/var/run/git-daemon.pid +REPOS=/srv/gitolite/repositories +OPTS="--verbose --reuseaddr --base-path=${REPOS}" + +case $1 in + start) + echo "Starting ${NAME}..." + $SSD --start \ + --pidfile ${PIDFILE} \ + --exec ${PROG} -- ${OPTS} \ + --detach --pid-file=${PIDFILE} \ + --user=${USER} --group=${GROUP} + + ;; + stop) + echo "Stopping ${NAME}..." + $SSD --stop --quiet --name git-daemon \ + --pidfile ${PIDFILE} + ;; + restart) + echo "Restarting ${NAME}..." + $0 stop + $0 start + ;; + status) + $SSD --status --pidfile $PIDFILE + case $? in + 0) echo "$PROG is running with pid $(cat $PIDFILE )" ;; + 3) echo "$PROG is not running" ;; + 4) echo "Unable to determine the program status" ;; + esac + ;; + *) + echo "usage: $0 [start|stop|restart|status]" + ;; +esac diff --git a/core/conf/rc.d/iptables b/core/conf/rc.d/iptables index f8b7881..893b087 100644 --- a/core/conf/rc.d/iptables +++ b/core/conf/rc.d/iptables @@ -1,55 +1,46 @@ #!/bin/bash -IPT="/usr/sbin/iptables" -#TYPE=bridge +. /etc/iptables/ipt-conf.sh +. /etc/iptables/ipt-firewall.sh + +TYPE=bridge #TYPE=server -TYPE=open +#TYPE=open #TYPE=client -clear_ipt() { - - ${IPT} -F - ${IPT} -X - ${IPT} -t nat -F - ${IPT} -t nat -X - ${IPT} -t mangle -F - ${IPT} -t mangle -X - ${IPT} -t raw -F - ${IPT} -t raw -X - ${IPT} -t security -F - ${IPT} -t security -X - -} - case $1 in start) case $TYPE in bridge) - clear_ipt - echo "setting bridge network..." - echo 1 > /proc/sys/net/ipv4/ip_forward + #ipt_clear + echo "setting bridge network..." + echo 1 > /proc/sys/net/ipv4/ip_forward - ## load bridge configuration - iptables-restore /etc/iptables/bridge.v4 + ## load bridge configuration + #iptables-restore /etc/iptables/bridge.v4 + #iptables-restore /etc/iptables/bridge.v6 + bash /etc/iptables/ipt-bridge.sh ;; server) - clear_ipt - echo "setting server network..." - ## load server configuration - iptables-restore /etc/iptables/server.v4 - + #ipt_clear + echo "setting server network..." + ## load server configuration + #iptables-restore /etc/iptables/server.v4 + #iptables-restore /etc/iptables/server.v6 + bash /etc/iptables/ipt-server.sh ;; client) - clear_ipt - echo "setting client network..." - ## load client configuration - iptables-restore /etc/iptables/client.v4 + #ipt_clear + echo "setting client network..." + ## load client configuration + #iptables-restore /etc/iptables/client.v4 + bash /etc/iptables/ipt-client.sh ;; open) - clear_ipt - echo "setting open network..." - ## load client configuration + ipt_clear + echo "setting open network..." + ## load client configuration ${IPT} -P INPUT DROP ${IPT} -P FORWARD DROP @@ -65,29 +56,16 @@ case $1 in ${IPT} -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " ${IPT} -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " - #${IPT} -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " - - ;; esac ;; stop) echo "clear all iptables tables" - clear_ipt - # Set Default Rules - ${IPT} -P INPUT DROP - ${IPT} -P FORWARD DROP - ${IPT} -P OUTPUT DROP - - ${IPT} -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " - ${IPT} -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " - ${IPT} -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " - - + ipt_clear + ipt_tables ;; restart) - clear_ipt - $0 start + $0 start ;; status) ${IPT} -v diff --git a/core/conf/rc.d/postgresql b/core/conf/rc.d/postgresql new file mode 100755 index 0000000..5f0762a --- /dev/null +++ b/core/conf/rc.d/postgresql @@ -0,0 +1,16 @@ +# +# /etc/rc.d/postgresql: start, stop or restart PostgreSQL server postmaster +# + +PG_DATA=/srv/pgsql/data + +case "$1" in + start|stop|status|restart|reload) + sudo -u postgres pg_ctl -D "$PG_DATA" -l /var/log/postgresql "$1" + ;; + *) + echo "usage: $0 start|stop|restart|reload|status" + ;; +esac + +# End of file -- cgit 1.4.1-2-gfad0 From 581bdfbf84c80acfd43c56be09aea759a6d3dccd Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Wed, 26 Feb 2020 18:28:28 +0000 Subject: iptables update --- core/conf/iptables/client.v4 | 773 ++++++++++++++++++++++++++++++++++++- core/conf/iptables/ipt-bridge.sh | 8 +- core/conf/iptables/ipt-client.sh | 4 +- core/conf/iptables/ipt-conf.sh | 36 +- core/conf/iptables/ipt-firewall.sh | 6 +- core/conf/iptables/ipt-server.sh | 6 +- core/conf/rc.d/iptables | 6 - 7 files changed, 800 insertions(+), 39 deletions(-) (limited to 'core/conf/iptables/ipt-bridge.sh') diff --git a/core/conf/iptables/client.v4 b/core/conf/iptables/client.v4 index 91b564d..5a29ce7 100644 --- a/core/conf/iptables/client.v4 +++ b/core/conf/iptables/client.v4 @@ -1,25 +1,25 @@ -# Generated by iptables-save v1.8.3 on Thu Jun 20 20:34:21 2019 +# Generated by iptables-save v1.8.4 on Tue Feb 18 19:13:36 2020 *security :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] COMMIT -# Completed on Thu Jun 20 20:34:21 2019 -# Generated by iptables-save v1.8.3 on Thu Jun 20 20:34:21 2019 +# Completed on Tue Feb 18 19:13:36 2020 +# Generated by iptables-save v1.8.4 on Tue Feb 18 19:13:36 2020 *raw :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] COMMIT -# Completed on Thu Jun 20 20:34:21 2019 -# Generated by iptables-save v1.8.3 on Thu Jun 20 20:34:21 2019 +# Completed on Tue Feb 18 19:13:36 2020 +# Generated by iptables-save v1.8.4 on Tue Feb 18 19:13:36 2020 *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] COMMIT -# Completed on Thu Jun 20 20:34:21 2019 -# Generated by iptables-save v1.8.3 on Thu Jun 20 20:34:21 2019 +# Completed on Tue Feb 18 19:13:36 2020 +# Generated by iptables-save v1.8.4 on Tue Feb 18 19:13:36 2020 *mangle :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] @@ -27,13 +27,15 @@ COMMIT :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] COMMIT -# Completed on Thu Jun 20 20:34:21 2019 -# Generated by iptables-save v1.8.3 on Thu Jun 20 20:34:21 2019 +# Completed on Tue Feb 18 19:13:36 2020 +# Generated by iptables-save v1.8.4 on Tue Feb 18 19:13:36 2020 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :blocker - [0:0] +:blockip_in - [0:0] +:blockip_out - [0:0] :cli_dns_in - [0:0] :cli_dns_out - [0:0] :cli_ftp_in - [0:0] @@ -66,7 +68,10 @@ COMMIT :srv_https_in - [0:0] :srv_https_out - [0:0] :srv_icmp - [0:0] +:srv_ntp - [0:0] :srv_rip - [0:0] +:srv_smtp_in - [0:0] +:srv_smtp_out - [0:0] :srv_ssh_in - [0:0] :srv_ssh_out - [0:0] -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT @@ -82,6 +87,7 @@ COMMIT -A INPUT -i wlp9s0 -j cli_irc_in -A INPUT -i wlp9s0 -j cli_ftp_in -A INPUT -i wlp9s0 -j cli_gpg_in +-A INPUT -i wlp9s0 -p udp -m udp --sport 520 --dport 520 -j ACCEPT -A INPUT -j LOG --log-prefix "iptables: INPUT: " --log-level 7 -A FORWARD -j LOG --log-prefix "iptables: FORWARD: " --log-level 7 -A OUTPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -o lo -j ACCEPT @@ -115,6 +121,734 @@ COMMIT -A blocker -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP -A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP -A blocker -j RETURN +-A blockip_in -s 52.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.0.0.0/8 -j DROP +-A blockip_in -s 54.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.0.0.0/8 -j DROP +-A blockip_in -s 13.48.203.206/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.48.203.206/32 -j DROP +-A blockip_in -s 2.21.169.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.21.169.41/32 -j DROP +-A blockip_in -s 13.115.174.176/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.115.174.176/32 -j DROP +-A blockip_in -s 18.182.0.0/16 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.182.0.0/16 -j DROP +-A blockip_in -s 23.10.69.56/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.69.56/32 -j DROP +-A blockip_in -s 104.89.189.238/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 104.89.189.238/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.41/32 -j DROP +-A blockip_in -s 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.168/32 -j DROP +-A blockip_in -s 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.152/32 -j DROP +-A blockip_in -s 88.221.64.239/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.64.239/32 -j DROP +-A blockip_in -s 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.138/32 -j DROP +-A blockip_in -s 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.152/32 -j DROP +-A blockip_in -s 23.10.74.160/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.74.160/32 -j DROP +-A blockip_in -s 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.224/32 -j DROP +-A blockip_in -s 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.209/32 -j DROP +-A blockip_in -s 23.10.76.42/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.76.42/32 -j DROP +-A blockip_in -s 88.221.65.114/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.65.114/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.48/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.48/32 -j DROP +-A blockip_in -s 2.16.65.147/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.147/32 -j DROP +-A blockip_in -s 2.16.65.171/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.171/32 -j DROP +-A blockip_in -s 88.221.65.13/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.65.13/32 -j DROP +-A blockip_in -s 195.8.22.64/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.64/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.152/32 -j DROP +-A blockip_in -s 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.138/32 -j DROP +-A blockip_in -s 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.37.165.98/32 -j DROP +-A blockip_in -s 23.39.84.7/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.39.84.7/32 -j DROP +-A blockip_in -s 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.37.165.98/32 -j DROP +-A blockip_in -s 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.224/32 -j DROP +-A blockip_in -s 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.209/32 -j DROP +-A blockip_in -s 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.152/32 -j DROP +-A blockip_in -s 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.168/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.26.211/32 -j DROP +-A blockip_in -s 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.59.84/32 -j DROP +-A blockip_in -s 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.83.103/32 -j DROP +-A blockip_in -s 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.65.125/32 -j DROP +-A blockip_in -s 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.50.86/32 -j DROP +-A blockip_in -s 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.76.109/32 -j DROP +-A blockip_in -s 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.165.77/32 -j DROP +-A blockip_in -s 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.222.92/32 -j DROP +-A blockip_in -s 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.254.127/32 -j DROP +-A blockip_in -s 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.9.106/32 -j DROP +-A blockip_in -s 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.192.89/32 -j DROP +-A blockip_in -s 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.158.207.255/32 -j DROP +-A blockip_in -s 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.124.153.99/32 -j DROP +-A blockip_in -s 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.123.92.221/32 -j DROP +-A blockip_in -s 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.224.167/32 -j DROP +-A blockip_in -s 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.45.201/32 -j DROP +-A blockip_in -s 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.93.153.201/32 -j DROP +-A blockip_in -s 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.103.70/32 -j DROP +-A blockip_in -s 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.196.78.8/32 -j DROP +-A blockip_in -s 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.20.203/32 -j DROP +-A blockip_in -s 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.110.84/32 -j DROP +-A blockip_in -s 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.82.208/32 -j DROP +-A blockip_in -s 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.31.225/32 -j DROP +-A blockip_in -s 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.58.105.233/32 -j DROP +-A blockip_in -s 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.241.69/32 -j DROP +-A blockip_in -s 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.28.195.9/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.111.172/32 -j DROP +-A blockip_in -s 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.232.16/32 -j DROP +-A blockip_in -s 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.34.196/32 -j DROP +-A blockip_in -s 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.187.153/32 -j DROP +-A blockip_in -s 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.184.201.126/32 -j DROP +-A blockip_in -s 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.82.205/32 -j DROP +-A blockip_in -s 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.150.188/32 -j DROP +-A blockip_in -s 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.156.16/32 -j DROP +-A blockip_in -s 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.13.61/32 -j DROP +-A blockip_in -s 72.21.195.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 72.21.195.65/32 -j DROP +-A blockip_in -s 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.13.61/32 -j DROP +-A blockip_in -s 52.46.145.112/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.46.145.112/32 -j DROP +-A blockip_in -s 52.46.141.49/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.46.141.49/32 -j DROP +-A blockip_in -s 54.239.26.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.239.26.255/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.37.114.192/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.37.114.192/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.160.240.60/32 -j DROP +-A blockip_in -s 52.10.136.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.10.136.27/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.160.240.60/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.26.211/32 -j DROP +-A blockip_in -s 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.59.84/32 -j DROP +-A blockip_in -s 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.83.103/32 -j DROP +-A blockip_in -s 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.65.125/32 -j DROP +-A blockip_in -s 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.50.86/32 -j DROP +-A blockip_in -s 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.76.109/32 -j DROP +-A blockip_in -s 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.165.77/32 -j DROP +-A blockip_in -s 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.222.92/32 -j DROP +-A blockip_in -s 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.254.127/32 -j DROP +-A blockip_in -s 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.9.106/32 -j DROP +-A blockip_in -s 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.192.89/32 -j DROP +-A blockip_in -s 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.158.207.255/32 -j DROP +-A blockip_in -s 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.124.153.99/32 -j DROP +-A blockip_in -s 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.123.92.221/32 -j DROP +-A blockip_in -s 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.224.167/32 -j DROP +-A blockip_in -s 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.45.201/32 -j DROP +-A blockip_in -s 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.93.153.201/32 -j DROP +-A blockip_in -s 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.103.70/32 -j DROP +-A blockip_in -s 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.196.78.8/32 -j DROP +-A blockip_in -s 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.20.203/32 -j DROP +-A blockip_in -s 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.110.84/32 -j DROP +-A blockip_in -s 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.82.208/32 -j DROP +-A blockip_in -s 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.31.225/32 -j DROP +-A blockip_in -s 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.58.105.233/32 -j DROP +-A blockip_in -s 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.241.69/32 -j DROP +-A blockip_in -s 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.28.195.9/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.148.24.227/32 -j DROP +-A blockip_in -s 52.41.41.102/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.41.41.102/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.148.24.227/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 35.166.120.35/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.120.35/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.111.172/32 -j DROP +-A blockip_in -s 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.232.16/32 -j DROP +-A blockip_in -s 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.34.196/32 -j DROP +-A blockip_in -s 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.187.153/32 -j DROP +-A blockip_in -s 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.184.201.126/32 -j DROP +-A blockip_in -s 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.82.205/32 -j DROP +-A blockip_in -s 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.150.188/32 -j DROP +-A blockip_in -s 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.156.16/32 -j DROP +-A blockip_out -d 52.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.0.0.0/8 -j DROP +-A blockip_out -d 54.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.0.0.0/8 -j DROP +-A blockip_out -d 13.48.203.206/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.48.203.206/32 -j DROP +-A blockip_out -d 2.21.169.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.21.169.41/32 -j DROP +-A blockip_out -d 13.115.174.176/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.115.174.176/32 -j DROP +-A blockip_out -d 18.182.0.0/16 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.182.0.0/16 -j DROP +-A blockip_out -d 23.10.69.56/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.69.56/32 -j DROP +-A blockip_out -d 104.89.189.238/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 104.89.189.238/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.41/32 -j DROP +-A blockip_out -d 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.168/32 -j DROP +-A blockip_out -d 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.152/32 -j DROP +-A blockip_out -d 88.221.64.239/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.64.239/32 -j DROP +-A blockip_out -d 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.138/32 -j DROP +-A blockip_out -d 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.152/32 -j DROP +-A blockip_out -d 23.10.74.160/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.74.160/32 -j DROP +-A blockip_out -d 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.224/32 -j DROP +-A blockip_out -d 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.209/32 -j DROP +-A blockip_out -d 23.10.76.42/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.76.42/32 -j DROP +-A blockip_out -d 88.221.65.114/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.65.114/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.48/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.48/32 -j DROP +-A blockip_out -d 2.16.65.147/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.147/32 -j DROP +-A blockip_out -d 2.16.65.171/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.171/32 -j DROP +-A blockip_out -d 88.221.65.13/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.65.13/32 -j DROP +-A blockip_out -d 195.8.22.64/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.64/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.152/32 -j DROP +-A blockip_out -d 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.138/32 -j DROP +-A blockip_out -d 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.37.165.98/32 -j DROP +-A blockip_out -d 23.39.84.7/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.39.84.7/32 -j DROP +-A blockip_out -d 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.37.165.98/32 -j DROP +-A blockip_out -d 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.224/32 -j DROP +-A blockip_out -d 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.209/32 -j DROP +-A blockip_out -d 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.152/32 -j DROP +-A blockip_out -d 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.168/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.26.211/32 -j DROP +-A blockip_out -d 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.59.84/32 -j DROP +-A blockip_out -d 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.83.103/32 -j DROP +-A blockip_out -d 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.65.125/32 -j DROP +-A blockip_out -d 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.50.86/32 -j DROP +-A blockip_out -d 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.76.109/32 -j DROP +-A blockip_out -d 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.165.77/32 -j DROP +-A blockip_out -d 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.222.92/32 -j DROP +-A blockip_out -d 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.254.127/32 -j DROP +-A blockip_out -d 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.9.106/32 -j DROP +-A blockip_out -d 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.192.89/32 -j DROP +-A blockip_out -d 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.158.207.255/32 -j DROP +-A blockip_out -d 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.124.153.99/32 -j DROP +-A blockip_out -d 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.123.92.221/32 -j DROP +-A blockip_out -d 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.224.167/32 -j DROP +-A blockip_out -d 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.45.201/32 -j DROP +-A blockip_out -d 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.93.153.201/32 -j DROP +-A blockip_out -d 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.103.70/32 -j DROP +-A blockip_out -d 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.196.78.8/32 -j DROP +-A blockip_out -d 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.20.203/32 -j DROP +-A blockip_out -d 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.110.84/32 -j DROP +-A blockip_out -d 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.82.208/32 -j DROP +-A blockip_out -d 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.31.225/32 -j DROP +-A blockip_out -d 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.58.105.233/32 -j DROP +-A blockip_out -d 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.241.69/32 -j DROP +-A blockip_out -d 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.28.195.9/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.111.172/32 -j DROP +-A blockip_out -d 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.232.16/32 -j DROP +-A blockip_out -d 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.34.196/32 -j DROP +-A blockip_out -d 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.187.153/32 -j DROP +-A blockip_out -d 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.184.201.126/32 -j DROP +-A blockip_out -d 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.82.205/32 -j DROP +-A blockip_out -d 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.150.188/32 -j DROP +-A blockip_out -d 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.156.16/32 -j DROP +-A blockip_out -d 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.13.61/32 -j DROP +-A blockip_out -d 72.21.195.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 72.21.195.65/32 -j DROP +-A blockip_out -d 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.13.61/32 -j DROP +-A blockip_out -d 52.46.145.112/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.46.145.112/32 -j DROP +-A blockip_out -d 52.46.141.49/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.46.141.49/32 -j DROP +-A blockip_out -d 54.239.26.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.239.26.255/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.37.114.192/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.37.114.192/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.160.240.60/32 -j DROP +-A blockip_out -d 52.10.136.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.10.136.27/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.160.240.60/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.26.211/32 -j DROP +-A blockip_out -d 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.59.84/32 -j DROP +-A blockip_out -d 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.83.103/32 -j DROP +-A blockip_out -d 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.65.125/32 -j DROP +-A blockip_out -d 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.50.86/32 -j DROP +-A blockip_out -d 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.76.109/32 -j DROP +-A blockip_out -d 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.165.77/32 -j DROP +-A blockip_out -d 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.222.92/32 -j DROP +-A blockip_out -d 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.254.127/32 -j DROP +-A blockip_out -d 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.9.106/32 -j DROP +-A blockip_out -d 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.192.89/32 -j DROP +-A blockip_out -d 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.158.207.255/32 -j DROP +-A blockip_out -d 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.124.153.99/32 -j DROP +-A blockip_out -d 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.123.92.221/32 -j DROP +-A blockip_out -d 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.224.167/32 -j DROP +-A blockip_out -d 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.45.201/32 -j DROP +-A blockip_out -d 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.93.153.201/32 -j DROP +-A blockip_out -d 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.103.70/32 -j DROP +-A blockip_out -d 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.196.78.8/32 -j DROP +-A blockip_out -d 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.20.203/32 -j DROP +-A blockip_out -d 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.110.84/32 -j DROP +-A blockip_out -d 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.82.208/32 -j DROP +-A blockip_out -d 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.31.225/32 -j DROP +-A blockip_out -d 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.58.105.233/32 -j DROP +-A blockip_out -d 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.241.69/32 -j DROP +-A blockip_out -d 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.28.195.9/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.148.24.227/32 -j DROP +-A blockip_out -d 52.41.41.102/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.41.41.102/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.148.24.227/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 35.166.120.35/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.120.35/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.111.172/32 -j DROP +-A blockip_out -d 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.232.16/32 -j DROP +-A blockip_out -d 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.34.196/32 -j DROP +-A blockip_out -d 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.187.153/32 -j DROP +-A blockip_out -d 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.184.201.126/32 -j DROP +-A blockip_out -d 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.82.205/32 -j DROP +-A blockip_out -d 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.150.188/32 -j DROP +-A blockip_out -d 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.156.16/32 -j DROP -A cli_dns_in -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT -A cli_dns_in -j RETURN -A cli_dns_out -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT @@ -162,6 +896,8 @@ COMMIT -A cli_ssh_in -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A cli_ssh_in -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A cli_ssh_in -j RETURN +-A cli_ssh_out -d 10.0.0.0/8 -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT +-A cli_ssh_out -p tcp -m tcp --dport 2222 --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "iptables: SSH OUT:" -A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT -A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT -A cli_ssh_out -j RETURN @@ -193,19 +929,24 @@ COMMIT -A srv_https_out -j RETURN -A srv_icmp -p icmp -j ACCEPT -A srv_icmp -j RETURN +-A srv_ntp -p udp -m udp --sport 123 --dport 123 -j ACCEPT +-A srv_ntp -j RETURN -A srv_rip -p udp -m udp --sport 520 --dport 520 -j ACCEPT -A srv_rip -j RETURN +-A srv_smtp_in -p tcp -m tcp --sport 1024:65535 --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT +-A srv_smtp_in -j RETURN +-A srv_smtp_out -p tcp -m tcp --sport 25 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +-A srv_smtp_out -j RETURN +-A srv_ssh_in -s 10.0.0.0/8 -p tcp -m tcp --dport 2222 -m state --state NEW -j ACCEPT +-A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -j LOG --log-prefix "iptables: SSH NEW:" -A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" +-A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP: SSH" -A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP -A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP --A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state ESTABLISHED -j ACCEPT -A srv_ssh_in -j RETURN +-A srv_ssh_out -d 10.0.0.0/8 -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +-A srv_ssh_out -p tcp -m tcp --sport 2222 --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "iptables: SSH OUT:" -A srv_ssh_out -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_out -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A srv_ssh_out -j RETURN COMMIT -# Completed on Thu Jun 20 20:34:21 2019 +# Completed on Tue Feb 18 19:13:37 2020 diff --git a/core/conf/iptables/ipt-bridge.sh b/core/conf/iptables/ipt-bridge.sh index b329ea8..2042f8e 100644 --- a/core/conf/iptables/ipt-bridge.sh +++ b/core/conf/iptables/ipt-bridge.sh @@ -52,10 +52,10 @@ $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j cli_http_in $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j cli_http_out #####HTTP Server -#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in -#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_http_out -#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in -#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_https_out +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_http_out +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_https_out ######################################################################### # INPUT diff --git a/core/conf/iptables/ipt-client.sh b/core/conf/iptables/ipt-client.sh index 65df9e4..abead40 100644 --- a/core/conf/iptables/ipt-client.sh +++ b/core/conf/iptables/ipt-client.sh @@ -1,8 +1,8 @@ #!/bin/bash echo "setting client network..." -source ipt-conf.sh -source ipt-firewall.sh +source /etc/iptables/ipt-conf.sh +source /etc/iptables/ipt-firewall.sh ipt_clear ipt_tables diff --git a/core/conf/iptables/ipt-conf.sh b/core/conf/iptables/ipt-conf.sh index cc51f12..8d57f5f 100644 --- a/core/conf/iptables/ipt-conf.sh +++ b/core/conf/iptables/ipt-conf.sh @@ -6,24 +6,42 @@ IPT6="/usr/sbin/ip6tables" SPAMLIST="/etc/iptables/blockedip" SPAMDROPMSG="BLOCKED IP: " +#TYPE=bridge +#TYPE=server +#TYPE=open +TYPE=client + # bridge interface with interface facing gateway #BR_IF="br0" + # bridge ip network address BR_NET="10.0.0.0/8" +#BR_NET="192.0.0.0/8" +# static wifi ip network address +#WIFI_NET="10.0.0.0/8" + # network gateway -GW="10.0.0.1" -# external dns -#DNS="212.55.154.174" -DNS="10.0.0.254" +#GW="10.0.0.1" +GW=$(ip route | grep "default via" | cut -d " " -f 3) -# static machine ip address -PUB_IP="10.0.0.4" +# external dns +#DNS="10.0.0.254" +#DNS=$(grep -m 1 "nameserver " /etc/resolv.conf | cut -d " " -f 2) +DNS=$(grep -m 1 "^server=" /etc/dnsmasq.conf | cut -d "=" -f 2) # public interface facing gateway -PUB_IF="ens3" +#PUB_IF="wlp9s0" +PUB_IF="enp7s0" # wifi interface #WIFI_IF="wlp7s0" -# static wifi ip network address -#WIFI_NET="10.0.0.0/8" +# static machine ip address +#PUB_IP="10.0.0.4" +# deserve much better :( +PUB_IP=$(ifconfig ${PUB_IF} | grep -m 1 "addr:" | cut -d " " -f 12 | cut -d ":" -f 2) + +echo "GW: ${GW}" +echo "DNS: ${DNS}" +echo "PUB_IF: ${PUB_IF}" +echo "PUB_IP: ${PUB_IP}" diff --git a/core/conf/iptables/ipt-firewall.sh b/core/conf/iptables/ipt-firewall.sh index 6dc4f4f..c581e6e 100644 --- a/core/conf/iptables/ipt-firewall.sh +++ b/core/conf/iptables/ipt-firewall.sh @@ -1,5 +1,7 @@ #!/bin/bash +. /etc/iptables/ipt-conf.sh + ipt_clear () { echo "clear all iptables tables" @@ -92,7 +94,7 @@ ipt_tables () { egrep -v "^#|^$" x | while IFS= read -r ip do # Append everything to droplist - echo "adding ${ip} to blockip" + #echo "adding ${ip} to blockip" $IPT -A blockip_in -s $ip -j LOG --log-prefix "${SPAMDROPMSG}" $IPT -A blockip_in -s $ip -j DROP $IPT -A blockip_out -d $ip -j LOG --log-prefix "${SPAMDROPMSG}" @@ -242,8 +244,10 @@ ipt_tables () { $IPT -A cli_ftp_out -j RETURN ######## GIT client + $IPT -A cli_git_in -p tcp --sport 873 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A cli_git_in -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A cli_git_in -j RETURN + $IPT -A cli_git_out -p tcp --dport 873 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A cli_git_out -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A cli_git_out -j RETURN diff --git a/core/conf/iptables/ipt-server.sh b/core/conf/iptables/ipt-server.sh index 7d2dbfc..278c400 100644 --- a/core/conf/iptables/ipt-server.sh +++ b/core/conf/iptables/ipt-server.sh @@ -1,6 +1,7 @@ echo "setting server iptables ..." -source /etc/iptables/ipt-conf.sh + source /etc/iptables/ipt-firewall.sh + ipt_clear ipt_tables @@ -28,6 +29,7 @@ $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_smtp_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j cli_https_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_https_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_http_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ssh_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_git_in @@ -44,7 +46,9 @@ $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_smtp_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_git_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j cli_https_out + $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_https_out +$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_http_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_ssh_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_git_out diff --git a/core/conf/rc.d/iptables b/core/conf/rc.d/iptables index 893b087..a2ecaf2 100644 --- a/core/conf/rc.d/iptables +++ b/core/conf/rc.d/iptables @@ -1,13 +1,7 @@ #!/bin/bash -. /etc/iptables/ipt-conf.sh . /etc/iptables/ipt-firewall.sh -TYPE=bridge -#TYPE=server -#TYPE=open -#TYPE=client - case $1 in start) case $TYPE in -- cgit 1.4.1-2-gfad0 From a9baa2eedb483d413fbfd2f775d2e8dec3da728c Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Fri, 28 Feb 2020 02:44:43 +0000 Subject: iptables update --- core/conf/iptables/ipt-bridge.sh | 7 ----- core/conf/iptables/ipt-client.sh | 25 ++++++++++------ core/conf/iptables/ipt-firewall.sh | 4 +-- core/conf/iptables/ipt-open.sh | 17 +++++++++++ core/conf/iptables/ipt-server.sh | 11 ------- core/conf/iptables/ipt-start.sh | 34 ++++++++++++++++++++++ core/conf/iptables/ipt-stop.sh | 8 ++++++ core/conf/rc.d/iptables | 59 ++++---------------------------------- 8 files changed, 83 insertions(+), 82 deletions(-) create mode 100644 core/conf/iptables/ipt-open.sh create mode 100644 core/conf/iptables/ipt-start.sh create mode 100644 core/conf/iptables/ipt-stop.sh (limited to 'core/conf/iptables/ipt-bridge.sh') diff --git a/core/conf/iptables/ipt-bridge.sh b/core/conf/iptables/ipt-bridge.sh index 2042f8e..b0f7daa 100644 --- a/core/conf/iptables/ipt-bridge.sh +++ b/core/conf/iptables/ipt-bridge.sh @@ -1,13 +1,6 @@ #!/bin/bash -echo "setting bridge network..." -source /etc/iptables/ipt-conf.sh -source /etc/iptables/ipt-firewall.sh -ipt_clear -ipt_tables # Unlimited on loopback -$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT $IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT $IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT diff --git a/core/conf/iptables/ipt-client.sh b/core/conf/iptables/ipt-client.sh index abead40..d19a9dc 100644 --- a/core/conf/iptables/ipt-client.sh +++ b/core/conf/iptables/ipt-client.sh @@ -1,14 +1,23 @@ #!/bin/bash echo "setting client network..." -source /etc/iptables/ipt-conf.sh -source /etc/iptables/ipt-firewall.sh -ipt_clear -ipt_tables - -# Unlimited on loopback -$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT + +if [ "${GW}" == "" ]; then + + $IPT -A INPUT -j srv_icmp + $IPT -A OUTPUT -j srv_icmp + $IPT -A INPUT -j srv_dhcp + $IPT -A OUTPUT -j srv_dhcp + + echo "no gateway, wating for one..." + + while [ "${GW}" == "" ] + do + #we wait for a connection + sleep 2; + GW=$(ip route | grep "default via" | cut -d " " -f 3) + done +fi ####### Input Chain ###### $IPT -A INPUT -j blocker diff --git a/core/conf/iptables/ipt-firewall.sh b/core/conf/iptables/ipt-firewall.sh index c581e6e..a216fe3 100644 --- a/core/conf/iptables/ipt-firewall.sh +++ b/core/conf/iptables/ipt-firewall.sh @@ -9,8 +9,8 @@ ipt_clear () { $IPT -X $IPT6 -F $IPT6 -X - $PIT4 -Z - $PIT6 -Z + #$PIT4 -Z + #$PIT6 -Z $IPT -t nat -F $IPT -t nat -X $IPT -t mangle -F diff --git a/core/conf/iptables/ipt-open.sh b/core/conf/iptables/ipt-open.sh new file mode 100644 index 0000000..be2b86b --- /dev/null +++ b/core/conf/iptables/ipt-open.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +## load client configuration +${IPT} -P INPUT DROP +${IPT} -P FORWARD DROP +${IPT} -P OUTPUT ACCEPT + +${IPT} -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT +${IPT} -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT + +${IPT} -A INPUT -p tcp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT +${IPT} -A INPUT -p udp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT + +${IPT} -A OUTPUT -j ACCEPT + +${IPT} -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " +${IPT} -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " diff --git a/core/conf/iptables/ipt-server.sh b/core/conf/iptables/ipt-server.sh index 278c400..67f18f0 100644 --- a/core/conf/iptables/ipt-server.sh +++ b/core/conf/iptables/ipt-server.sh @@ -1,16 +1,5 @@ echo "setting server iptables ..." -source /etc/iptables/ipt-firewall.sh - -ipt_clear -ipt_tables - -# Unlimited on loopback -$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -#$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT -#$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT - ####### Input Chain ###### $IPT -A INPUT -j blocker diff --git a/core/conf/iptables/ipt-start.sh b/core/conf/iptables/ipt-start.sh new file mode 100644 index 0000000..b7af1fd --- /dev/null +++ b/core/conf/iptables/ipt-start.sh @@ -0,0 +1,34 @@ +#!/bin/bash + +echo "setting client network..." + +source /etc/iptables/ipt-firewall.sh + +ipt_clear +ipt_tables + +# Unlimited on loopback +$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT +$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT + +case $TYPE in + bridge) + #ipt_clear + echo 1 > /proc/sys/net/ipv4/ip_forward + source /etc/iptables/ipt-bridge.sh + exit 0 + ;; + server) + #ipt_clear + source /etc/iptables/ipt-server.sh + exit 0 + ;; + client) + source /etc/iptables/ipt-client.sh + exit 0 + ;; + open) + source /etc/iptables/ipt-open.sh + exit 0 + ;; +esac diff --git a/core/conf/iptables/ipt-stop.sh b/core/conf/iptables/ipt-stop.sh new file mode 100644 index 0000000..55af57c --- /dev/null +++ b/core/conf/iptables/ipt-stop.sh @@ -0,0 +1,8 @@ +#!/bin/bash + +echo "blocking network..." + +source /etc/iptables/ipt-firewall.sh + +ipt_clear +ipt_tables diff --git a/core/conf/rc.d/iptables b/core/conf/rc.d/iptables index a2ecaf2..c2061db 100644 --- a/core/conf/rc.d/iptables +++ b/core/conf/rc.d/iptables @@ -1,68 +1,19 @@ #!/bin/bash -. /etc/iptables/ipt-firewall.sh - case $1 in start) - case $TYPE in - bridge) - #ipt_clear - echo "setting bridge network..." - echo 1 > /proc/sys/net/ipv4/ip_forward - - ## load bridge configuration - #iptables-restore /etc/iptables/bridge.v4 - #iptables-restore /etc/iptables/bridge.v6 - bash /etc/iptables/ipt-bridge.sh - - ;; - server) - #ipt_clear - echo "setting server network..." - ## load server configuration - #iptables-restore /etc/iptables/server.v4 - #iptables-restore /etc/iptables/server.v6 - bash /etc/iptables/ipt-server.sh - ;; - client) - #ipt_clear - echo "setting client network..." - ## load client configuration - #iptables-restore /etc/iptables/client.v4 - bash /etc/iptables/ipt-client.sh - ;; - open) - ipt_clear - echo "setting open network..." - ## load client configuration - - ${IPT} -P INPUT DROP - ${IPT} -P FORWARD DROP - ${IPT} -P OUTPUT ACCEPT - - ${IPT} -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT - ${IPT} -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT - - ${IPT} -A INPUT -p tcp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT - ${IPT} -A INPUT -p udp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT - - ${IPT} -A OUTPUT -j ACCEPT - - ${IPT} -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " - ${IPT} -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " - ;; - esac + echo "clear all iptables tables" + bash /etc/iptables/ipt-start.sh ;; stop) - echo "clear all iptables tables" - ipt_clear - ipt_tables + echo "clear all iptables tables" + bash /etc/iptables/ipt-stop.sh ;; restart) $0 start ;; status) - ${IPT} -v + /usr/sbin/iptables -v ;; *) echo "Usage: $0 [start|stop]" -- cgit 1.4.1-2-gfad0