From 36ef4944b852eaf9ef54154c3cccef6c2eb41292 Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Mon, 17 Feb 2020 05:08:15 +0000 Subject: configuration files fix --- core/conf/iptables/blockedip | 182 +++++++++ core/conf/iptables/ipt-bridge.sh | 177 +++------ core/conf/iptables/ipt-client.sh | 20 +- core/conf/iptables/ipt-conf.sh | 17 +- core/conf/iptables/ipt-firewall.sh | 50 ++- core/conf/iptables/ipt-server.sh | 29 +- core/conf/iptables/server.v4 | 790 +++++++++++++++++++++++++++++++++++-- 7 files changed, 1073 insertions(+), 192 deletions(-) create mode 100644 core/conf/iptables/blockedip (limited to 'core') diff --git a/core/conf/iptables/blockedip b/core/conf/iptables/blockedip new file mode 100644 index 0000000..714403a --- /dev/null +++ b/core/conf/iptables/blockedip @@ -0,0 +1,182 @@ +52.0.0.0/8 +54.0.0.0/8 +13.48.203.206 +2.21.169.41 +13.115.174.176 +18.182.0.0/16 +23.10.69.56 +104.89.189.238 +195.8.22.40 +195.8.22.41 +2.16.65.168 +2.16.65.152 +88.221.64.239 +195.8.22.138 +195.8.22.152 +23.10.74.160 +195.8.15.224 +195.8.15.209 +23.10.76.42 +88.221.65.114 +195.8.22.40 +195.8.22.48 +2.16.65.147 +2.16.65.171 +88.221.65.13 +195.8.22.64 +195.8.22.40 +195.8.22.152 +195.8.22.138 +23.37.165.98 +23.39.84.7 +23.37.165.98 +195.8.15.224 +195.8.15.209 +2.16.65.152 +2.16.65.168 +13.225.241.27 +13.225.241.212 +13.225.241.199 +13.225.241.79 +18.197.26.211 +3.120.59.84 +18.197.83.103 +3.120.65.125 +3.120.50.86 +18.197.76.109 +3.120.165.77 +18.197.222.92 +35.156.254.127 +35.157.9.106 +35.156.192.89 +35.158.207.255 +3.124.153.99 +3.123.92.221 +35.156.224.167 +35.157.45.201 +54.93.153.201 +35.156.103.70 +18.196.78.8 +35.157.20.203 +18.195.110.84 +18.195.82.208 +18.194.31.225 +52.58.105.233 +3.120.241.69 +52.28.195.9 +13.225.241.212 +13.225.241.79 +13.225.241.27 +13.225.241.199 +13.225.241.79 +13.225.241.199 +13.225.241.212 +13.225.241.79 +13.225.241.199 +13.225.241.79 +13.225.241.27 +13.225.241.199 +13.225.241.79 +13.225.241.199 +13.225.241.27 +13.225.241.212 +18.194.111.172 +18.195.232.16 +18.195.34.196 +18.185.187.153 +18.184.201.126 +18.194.82.205 +18.185.150.188 +18.185.156.16 +13.225.13.61 +72.21.195.65 +13.225.13.61 +52.46.145.112 +52.46.141.49 +54.239.26.255 +54.71.96.255 +34.214.185.21 +52.32.14.1 +35.166.250.92 +54.200.12.154 +52.37.114.192 +13.225.245.72 +13.225.245.65 +13.225.245.18 +13.225.245.33 +35.160.240.60 +52.10.136.27 +54.71.96.255 +54.200.12.154 +52.32.14.1 +34.214.185.21 +35.166.250.92 +35.160.240.60 +13.225.245.65 +13.225.245.33 +13.225.245.72 +13.225.245.18 +18.197.26.211 +3.120.59.84 +18.197.83.103 +3.120.65.125 +3.120.50.86 +18.197.76.109 +3.120.165.77 +18.197.222.92 +35.156.254.127 +35.157.9.106 +35.156.192.89 +35.158.207.255 +3.124.153.99 +3.123.92.221 +35.156.224.167 +35.157.45.201 +54.93.153.201 +35.156.103.70 +18.196.78.8 +35.157.20.203 +18.195.110.84 +18.195.82.208 +18.194.31.225 +52.58.105.233 +3.120.241.69 +52.28.195.9 +13.225.245.65 +13.225.245.33 +13.225.245.72 +13.225.245.18 +54.200.12.154 +52.32.14.1 +34.214.185.21 +35.166.250.92 +54.71.96.255 +54.148.24.227 +52.41.41.102 +13.225.245.18 +13.225.245.65 +13.225.245.72 +13.225.245.33 +13.225.245.18 +13.225.245.33 +13.225.245.72 +13.225.245.65 +54.200.12.154 +34.214.185.21 +52.32.14.1 +54.148.24.227 +54.71.96.255 +35.166.250.92 +35.166.120.35 +13.225.245.18 +13.225.245.72 +13.225.245.65 +13.225.245.33 +18.194.111.172 +18.195.232.16 +18.195.34.196 +18.185.187.153 +18.184.201.126 +18.194.82.205 +18.185.150.188 +18.185.156.16 diff --git a/core/conf/iptables/ipt-bridge.sh b/core/conf/iptables/ipt-bridge.sh index 961f05a..c4b2a00 100644 --- a/core/conf/iptables/ipt-bridge.sh +++ b/core/conf/iptables/ipt-bridge.sh @@ -1,7 +1,7 @@ #!/bin/bash echo "setting bridge network..." -source ipt-conf.sh -source ipt-firewall.sh +source /etc/iptables/ipt-conf.sh +source /etc/iptables/ipt-firewall.sh ipt_clear ipt_tables @@ -11,140 +11,83 @@ $IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT $IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT $IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT -######## NAT Prerouting Chain ###### -#$IPT -t nat -A PREROUTING -i ${WIFI_IF} -p udp --dport 53 --sport 1024:65535 -j DNAT --to 10.0.0.254:53 -##$IPT -t nat -A PREROUTING -i ${WIFI_IF} -p tcp --dport 53 --sport 1024:65535 -j DNAT --to 10.0.0.254:53 -#$IPT -t nat -A PREROUTING -i ${WIFI_IF} -p tcp --dport 443 --sport 1024:65535 -j DNAT --to 10.0.0.4:443 -##$IPT -t nat -A PREROUTING -j LOG --log-level 7 --log-prefix "iptables: PREROUTING: " +######################################################################### +# FORWARD +######################################################################### -######## Forward Chain ###### -#$IPT -A FORWARD -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -#$IPT -A FORWARD -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -# -## Allow all for BR_NET +$IPT -A FORWARD -j blocker +$IPT -A FORWARD -j blockip_in +$IPT -A FORWARD -j blockip_out $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${BR_NET} -d ${BR_NET} -j ACCEPT - -## DHCP +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -p udp --dport 520 --sport 520 -j DROP $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 0.0.0.0 -d 255.255.255.255 -j srv_dhcp - -## Allow access from bridge to gateway wifi interface -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j cli_http_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j cli_http_out -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j cli_https_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j cli_https_out -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j cli_ftp_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j cli_ftp_out - -##$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j srv_dns_in -##$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j srv_dns_out -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j srv_https_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j srv_https_out - -## allow output from BR_NET to external -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${BR_NET} -j ACCEPT - -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.5 -j ACCEPT -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${DNS} -d ${PUB_IP} -j cli_dns_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 50.23.197.95 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 50.23.197.94 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 50.23.197.94 -j ACCEPT + +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 50.23.197.95 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 50.23.197.94 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 50.23.197.94 -j ACCEPT + +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-in tap1 --physdev-out ${PUB_IF} -s 10.0.0.3 -j cli_https_out +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-in tap1 --physdev-out ${PUB_IF} -s 10.0.0.3 -j cli_http_out +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-out tap1 --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_https_in +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-out tap1 --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_http_in +#####Server $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ssh_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_ssh_out $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_git_in $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ntp -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -j ACCEPT - -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_http_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.3 -p tcp --dport 1024:65535 --sport 1024:65535 -j ACCEPT $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j cli_http_in -##Less noise -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -p udp --dport 519 --sport 520 -j DROP -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -p udp --dport 520 --sport 520 -j DROP +#####HTTP Server +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in -######## Input Chain ###### +######################################################################### +# INPUT +######################################################################### $IPT -A INPUT -j blocker - -##Less noise -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp --sport 3030 --dport 1024:65535 -j DROP -#$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -p udp --sport 137 --dport 137 -j ACCEPT -#$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -p udp --sport 137 --dport 137 -j ACCEPT -#$IPT -A INPUT -i ${BR_IF} -s ${BR_NET} -d 10.255.255.255 -p udp --sport 520 --dport 520 -j ACCEPT -#$IPT -A INPUT -i ${WIFI_IF} -p udp --sport 137 --dport 137 -j ACCEPT -#$IPT -A INPUT -i ${WIFI_IF} -p udp --sport 138 --dport 138 -j ACCEPT - -$IPT -A INPUT -i ${BR_IF} -j srv_dhcp -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_dns_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_icmp -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in +$IPT -A INPUT -j blockip_in +$IPT -A INPUT -i ${BR_IF} -p udp --dport 520 --sport 520 -j DROP +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp --sport 3030 -j DROP $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_https_in -$IPT -A INPUT -i ${BR_IF} -j cli_http_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_git_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_ssh_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j srv_ntp - -# let radio get in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp --dport 1024:65535 --sport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT - -#$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${WIFI_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_icmp -#$IPT -A INPUT -i ${WIFI_IF} -d ${PUB_IP} -s ${WIFI_NET} -j srv_dns_in -#$IPT -A INPUT -i ${BR_IF} -s ${GW} -d ${PUB_IP} -j srv_dhcp -#$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_http_in -#$IPT -A INPUT -i ${WIFI_IF} -s ${DNS} -j cli_dns_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_https_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_http_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_git_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_ssh_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in tap2 -s ${BR_NET} -d ${PUB_IP} -j cli_http_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -j cli_http_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -j cli_https_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in tap2 -j cli_https_in +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_ssh_in +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s 10.0.0.4 -j cli_git_in +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_dns_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -j srv_dhcp +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${BR_NET} -j srv_dhcp -## PXE server -#$IPT -A INPUT -i ${BR_IF} -p udp -d ${PUB_IP} -s ${BR_NET} --dport 69 --sport 1024:65535 -j ACCEPT -#$IPT -A INPUT -i ${BR_IF} -p udp -d ${PUB_IP} -s ${BR_NET} --dport 1024:65535 --sport 1024:65535 -j ACCEPT +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in +#$IPT -A INPUT -j LOG -######## Output Chain ###### +$IPT -A OUTPUT -o ${BR_IF} -p udp --dport 520 --sport 520 -j DROP -##Less noise -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 3030 --sport 1024:65535 -j DROP +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 3030 -j DROP +$IPT -A OUTPUT -o blockip_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j srv_dhcp +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${DNS} -j cli_dns_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j srv_dns_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j srv_ssh_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j srv_git_out -$IPT -A OUTPUT -o ${BR_IF} -j srv_icmp -#$IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp - -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${DNS} -j cli_dns_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_git_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_http_out - +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${GW} -j cli_http_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_https_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_git_out -$IPT -A OUTPUT -j cli_http_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j srv_ntp - -# let radio and other stuff out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 1024:65535 --sport 1024:65535 -j ACCEPT - -#$IPT -A OUTPUT -o ${WIFI_IF} -d ${DNS} -j cli_dns_out -#$IPT -A OUTPUT -o ${WIFI_IF} -d ${WIFI_NET} -j srv_dns_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j srv_dns_out - -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_ssh_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_git_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_https_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_http_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j srv_icmp - -## PXE Server -#$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -p udp --dport 1024:65535 --sport 1024:65535 -j ACCEPT - -######## PostRouting Chain ###### -##Less noise -##$IPT -t nat -A POSTROUTING -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -##$IPT -t nat -A POSTROUTING -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -##$IPT -t nat -A POSTROUTING -o ${BR_IF} -s ${PUB_IP} -d ${DNS} -p udp --dport 53 --sport 1024:65535 -j ACCEPT -#$IPT -t nat -A POSTROUTING -o ${WIFI_IF} -j MASQUERADE -##$IPT -t nat -A POSTROUTING -j LOG --log-level 7 --log-prefix "iptables: POSTROUTING: " +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_out +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d 10.0.0.4 -j cli_git_out +$IPT -A OUTPUT -o ${BR_IF} -d ${BR_NET} -j srv_dhcp +$IPT -A OUTPUT -o ${BR_IF} -d ${BR_NET} -j srv_icmp ## log everything else and drop ipt_log diff --git a/core/conf/iptables/ipt-client.sh b/core/conf/iptables/ipt-client.sh index 77de218..65df9e4 100644 --- a/core/conf/iptables/ipt-client.sh +++ b/core/conf/iptables/ipt-client.sh @@ -19,21 +19,13 @@ $IPT -A INPUT -i ${PUB_IF} -j cli_https_in $IPT -A INPUT -i ${PUB_IF} -j cli_git_in $IPT -A INPUT -i ${PUB_IF} -j cli_ssh_in $IPT -A INPUT -i ${PUB_IF} -j srv_icmp -$IPT -A INPUT -i ${PUB_IF} -j srv_ntp $IPT -A INPUT -i ${PUB_IF} -j cli_pops_in $IPT -A INPUT -i ${PUB_IF} -j cli_smtps_in $IPT -A INPUT -i ${PUB_IF} -j cli_irc_in $IPT -A INPUT -i ${PUB_IF} -j cli_ftp_in $IPT -A INPUT -i ${PUB_IF} -j cli_gpg_in -$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j DROP +$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j ACCEPT -$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p udp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT - -# allow all established and related -$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p udp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p icmp -j ACCEPT ####### Output Chain ###### $IPT -A OUTPUT -j blocker @@ -44,20 +36,12 @@ $IPT -A OUTPUT -o ${PUB_IF} -j cli_ssh_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out $IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp -$IPT -A OUTPUT -o ${PUB_IF} -j srv_ntp $IPT -A OUTPUT -o ${PUB_IF} -j cli_pops_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_smtps_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_irc_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_ftp_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_gpg_out - -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1024:65535 -j ACCEPT - -# allow all out (make nmap and others happy) -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1:65535 -j ACCEPT -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1:65535 -j ACCEPT -$IPT -A OUTPUT -p icmp -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:655335 --dport 1024:65535 -j ACCEPT ## log everything else and drop ipt_log diff --git a/core/conf/iptables/ipt-conf.sh b/core/conf/iptables/ipt-conf.sh index dcea837..63b101f 100644 --- a/core/conf/iptables/ipt-conf.sh +++ b/core/conf/iptables/ipt-conf.sh @@ -2,26 +2,27 @@ IPT="/usr/sbin/iptables" -SPAMLIST="blockedip" -SPAMDROPMSG="BLOCKED IP DROP" +SPAMLIST="/etc/iptables/blockedip" +SPAMDROPMSG="BLOCKED IP: " # bridge interface with interface facing gateway -BR_IF="br0" +#BR_IF="br0" # bridge ip network address BR_NET="10.0.0.0/8" # network gateway GW="10.0.0.1" # external dns -DNS="212.55.154.174" +#DNS="212.55.154.174" +DNS="10.0.0.254" # static machine ip address -PUB_IP="10.0.0.254" +PUB_IP="10.0.0.4" # public interface facing gateway -PUB_IF="enp8s0" +PUB_IF="ens3" # wifi interface -WIFI_IF="wlp7s0" +#WIFI_IF="wlp7s0" # static wifi ip network address -WIFI_NET="10.0.0.0/8" +#WIFI_NET="10.0.0.0/8" diff --git a/core/conf/iptables/ipt-firewall.sh b/core/conf/iptables/ipt-firewall.sh index 086b864..0a947e6 100644 --- a/core/conf/iptables/ipt-firewall.sh +++ b/core/conf/iptables/ipt-firewall.sh @@ -14,6 +14,8 @@ ipt_clear () { iptables -t security -F iptables -t security -X iptables -N blocker + iptables -N blockip_in + iptables -N blockip_out iptables -N srv_dhcp iptables -N srv_rip @@ -25,6 +27,8 @@ ipt_clear () { iptables -N srv_http_out iptables -N srv_https_in iptables -N srv_https_out + iptables -N srv_smtp_in + iptables -N srv_smtp_out iptables -N srv_ssh_in iptables -N srv_ssh_out iptables -N srv_git_in @@ -70,6 +74,19 @@ ipt_log () { ipt_tables () { echo "start adding tables..." + # Filter out comments and blank lines + # store each ip or subnet in $ip + egrep -v "^#|^$" x | while IFS= read -r ip + do + # Append everything to droplist + echo "adding ${ip} to blockip" + $IPT -A blockip_in -s $ip -j LOG --log-prefix "${SPAMDROPMSG}" + $IPT -A blockip_in -s $ip -j DROP + $IPT -A blockip_out -d $ip -j LOG --log-prefix "${SPAMDROPMSG}" + $IPT -A blockip_out -d $ip -j DROP + done <"${SPAMLIST}" + + echo "blockip_in and blockip_out added" ####### blocker Chain ###### ## Block google dns @@ -103,6 +120,7 @@ ipt_tables () { #$IPT -A blocker -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP #$IPT -A blocker -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP #$IPT -A blocker -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP + ## Return to caller $IPT -A blocker -j RETURN @@ -123,6 +141,9 @@ ipt_tables () { $IPT -A srv_db_out -j RETURN ####### SSH Server + + $IPT -A srv_ssh_in -p tcp --dport 2222 -s ${BR_NET} -m state --state NEW -j ACCEPT + $IPT -A srv_ssh_in -p tcp --dport 2222 -m state --state NEW -j LOG --log-prefix "iptables: SSH NEW": $IPT -A srv_ssh_in -p tcp --dport 2222 -m state --state NEW -m recent --set --name SSH -j ACCEPT $IPT -A srv_ssh_in -p tcp --dport 2222 -m recent \ @@ -134,22 +155,30 @@ ipt_tables () { $IPT -A srv_ssh_in -p tcp --dport 2222 --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - $IPT -A srv_ssh_in -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT + #$IPT -A srv_ssh_in -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT - $IPT -A srv_ssh_in -p tcp --dport 22 -m recent \ - --update --seconds 60 --hitcount 4 --rttl \ - --name SSH -j LOG --log-prefix "${SPAMDROPMSG} SSH" + #$IPT -A srv_ssh_in -p tcp --dport 22 -m recent \ + # --update --seconds 60 --hitcount 4 --rttl \ + # --name SSH -j LOG --log-prefix "${SPAMDROPMSG} SSH" - $IPT -A srv_ssh_in -p tcp --dport 22 -m recent --update --seconds 60 \ - --hitcount 4 --rttl --name SSH -j DROP + #$IPT -A srv_ssh_in -p tcp --dport 22 -m recent --update --seconds 60 \ + # --hitcount 4 --rttl --name SSH -j DROP - $IPT -A srv_ssh_in -p tcp --dport 22 --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + #$IPT -A srv_ssh_in -p tcp --dport 22 --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A srv_ssh_in -j RETURN + $IPT -A srv_ssh_out -p tcp --sport 2222 --dport 1024:65535 -d ${BR_NET} -m state --state ESTABLISHED -j ACCEPT + $IPT -A srv_ssh_out -p tcp --tcp-flags SYN,ACK SYN,ACK --sport 2222 -j LOG --log-prefix "iptables: SSH OUT": $IPT -A srv_ssh_out -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - $IPT -A srv_ssh_out -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + #$IPT -A srv_ssh_out -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A srv_ssh_out -j RETURN + ####### smtp Server + $IPT -A srv_smtp_in -p tcp --dport 25 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + $IPT -A srv_smtp_in -j RETURN + $IPT -A srv_smtp_out -p tcp --sport 25 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT + $IPT -A srv_smtp_out -j RETURN + ####### HTTP Server $IPT -A srv_http_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A srv_http_in -j RETURN @@ -229,6 +258,9 @@ ipt_tables () { $IPT -A cli_ssh_in -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A cli_ssh_in -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A cli_ssh_in -j RETURN + + $IPT -A cli_ssh_out -p tcp -d ${BR_NET} --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + $IPT -A cli_ssh_out -p tcp --tcp-flags SYN,ACK SYN,ACK --dport 2222 -j LOG --log-prefix "iptables: SSH OUT": $IPT -A cli_ssh_out -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A cli_ssh_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A cli_ssh_out -j RETURN @@ -258,5 +290,3 @@ ipt_tables () { $IPT -A srv_ntp -j RETURN } - - diff --git a/core/conf/iptables/ipt-server.sh b/core/conf/iptables/ipt-server.sh index 784f044..6cd7175 100644 --- a/core/conf/iptables/ipt-server.sh +++ b/core/conf/iptables/ipt-server.sh @@ -1,51 +1,50 @@ echo "setting server iptables ..." -source ipt-conf.sh -source ipt-firewall.sh +source /etc/iptables/ipt-conf.sh +source /etc/iptables/ipt-firewall.sh ipt_clear ipt_tables # Unlimited on loopback $IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT $IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT -$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT +#$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT +#$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT ####### Input Chain ###### $IPT -A INPUT -j blocker +$IPT -A INPUT -i ${PUB_IF} -s ${BR_NET} -p udp --dport 520 -j DROP + $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_https_in + $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_https_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_git_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_ssh_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_smtp_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j cli_https_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j cli_http_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ssh_in + $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_https_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_http_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ssh_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_git_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ntp ####### Output Chain ###### $IPT -A OUTPUT -j blocker $IPT -A OUTPUT -o ${PUB_IF} -d ${DNS} -s ${PUB_IP} -j cli_dns_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j cli_http_out -$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j cli_ssh_out + $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_https_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_ssh_out +$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_smtp_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_git_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j cli_https_out -$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j cli_http_out - $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_https_out -$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_http_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_ssh_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_git_out -$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_ntp ## log everything else and drop ipt_log diff --git a/core/conf/iptables/server.v4 b/core/conf/iptables/server.v4 index 678800b..164f95b 100644 --- a/core/conf/iptables/server.v4 +++ b/core/conf/iptables/server.v4 @@ -1,39 +1,41 @@ -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 +# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 *security :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 +# Completed on Mon Feb 17 04:36:55 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 *raw :PREROUTING ACCEPT [0:0] -:OUTPUT ACCEPT [1:132] +:OUTPUT ACCEPT [187:298268] COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 +# Completed on Mon Feb 17 04:36:55 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 +# Completed on Mon Feb 17 04:36:55 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 *mangle :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [1:132] +:OUTPUT ACCEPT [187:298268] :POSTROUTING ACCEPT [0:0] COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 +# Completed on Mon Feb 17 04:36:55 2020 +# Generated by iptables-save v1.8.4 on Mon Feb 17 04:36:55 2020 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :blocker - [0:0] +:blockip_in - [0:0] +:blockip_out - [0:0] :cli_dns_in - [0:0] :cli_dns_out - [0:0] :cli_ftp_in - [0:0] @@ -66,19 +68,24 @@ COMMIT :srv_https_in - [0:0] :srv_https_out - [0:0] :srv_icmp - [0:0] +:srv_ntp - [0:0] :srv_rip - [0:0] +:srv_smtp_in - [0:0] +:srv_smtp_out - [0:0] :srv_ssh_in - [0:0] :srv_ssh_out - [0:0] -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT -A INPUT -j blocker +-A INPUT -s 10.0.0.0/8 -i ens3 -p udp -m udp --dport 520 -j DROP -A INPUT -s 10.0.0.254/32 -d 10.0.0.4/32 -i ens3 -j cli_dns_in +-A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j cli_http_in +-A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j cli_https_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_https_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_ssh_in -A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_git_in --A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j cli_http_in --A INPUT -d 10.0.0.4/32 -i ens3 -j srv_https_in +-A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_smtp_in -A INPUT -d 10.0.0.4/32 -i ens3 -j cli_https_in --A INPUT -d 10.0.0.4/32 -i ens3 -j cli_http_in +-A INPUT -d 10.0.0.4/32 -i ens3 -j srv_https_in -A INPUT -d 10.0.0.4/32 -i ens3 -j srv_ssh_in -A INPUT -d 10.0.0.4/32 -i ens3 -j srv_git_in -A INPUT -j LOG --log-prefix "iptables: INPUT: " --log-level 7 @@ -89,12 +96,12 @@ COMMIT -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j cli_http_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_https_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_ssh_out +-A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_smtp_out -A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_git_out -A OUTPUT -s 10.0.0.4/32 -o ens3 -j cli_https_out --A OUTPUT -s 10.0.0.4/32 -o ens3 -j cli_http_out -A OUTPUT -s 10.0.0.4/32 -o ens3 -j srv_https_out --A OUTPUT -d 10.0.0.0/8 -o ens3 -j srv_ssh_out --A OUTPUT -d 10.0.0.0/8 -o ens3 -j srv_git_out +-A OUTPUT -s 10.0.0.4/32 -o ens3 -j srv_ssh_out +-A OUTPUT -s 10.0.0.4/32 -o ens3 -j srv_git_out -A OUTPUT -j LOG --log-prefix "iptables: OUTPUT: " --log-level 7 -A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop sync: " --log-level 7 -A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP @@ -112,6 +119,734 @@ COMMIT -A blocker -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP -A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP -A blocker -j RETURN +-A blockip_in -s 52.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.0.0.0/8 -j DROP +-A blockip_in -s 54.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.0.0.0/8 -j DROP +-A blockip_in -s 13.48.203.206/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.48.203.206/32 -j DROP +-A blockip_in -s 2.21.169.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.21.169.41/32 -j DROP +-A blockip_in -s 13.115.174.176/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.115.174.176/32 -j DROP +-A blockip_in -s 18.182.0.0/16 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.182.0.0/16 -j DROP +-A blockip_in -s 23.10.69.56/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.69.56/32 -j DROP +-A blockip_in -s 104.89.189.238/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 104.89.189.238/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.41/32 -j DROP +-A blockip_in -s 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.168/32 -j DROP +-A blockip_in -s 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.152/32 -j DROP +-A blockip_in -s 88.221.64.239/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.64.239/32 -j DROP +-A blockip_in -s 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.138/32 -j DROP +-A blockip_in -s 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.152/32 -j DROP +-A blockip_in -s 23.10.74.160/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.74.160/32 -j DROP +-A blockip_in -s 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.224/32 -j DROP +-A blockip_in -s 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.209/32 -j DROP +-A blockip_in -s 23.10.76.42/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.10.76.42/32 -j DROP +-A blockip_in -s 88.221.65.114/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.65.114/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.48/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.48/32 -j DROP +-A blockip_in -s 2.16.65.147/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.147/32 -j DROP +-A blockip_in -s 2.16.65.171/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.171/32 -j DROP +-A blockip_in -s 88.221.65.13/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 88.221.65.13/32 -j DROP +-A blockip_in -s 195.8.22.64/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.64/32 -j DROP +-A blockip_in -s 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.40/32 -j DROP +-A blockip_in -s 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.152/32 -j DROP +-A blockip_in -s 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.22.138/32 -j DROP +-A blockip_in -s 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.37.165.98/32 -j DROP +-A blockip_in -s 23.39.84.7/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.39.84.7/32 -j DROP +-A blockip_in -s 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 23.37.165.98/32 -j DROP +-A blockip_in -s 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.224/32 -j DROP +-A blockip_in -s 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 195.8.15.209/32 -j DROP +-A blockip_in -s 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.152/32 -j DROP +-A blockip_in -s 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 2.16.65.168/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.26.211/32 -j DROP +-A blockip_in -s 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.59.84/32 -j DROP +-A blockip_in -s 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.83.103/32 -j DROP +-A blockip_in -s 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.65.125/32 -j DROP +-A blockip_in -s 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.50.86/32 -j DROP +-A blockip_in -s 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.76.109/32 -j DROP +-A blockip_in -s 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.165.77/32 -j DROP +-A blockip_in -s 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.222.92/32 -j DROP +-A blockip_in -s 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.254.127/32 -j DROP +-A blockip_in -s 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.9.106/32 -j DROP +-A blockip_in -s 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.192.89/32 -j DROP +-A blockip_in -s 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.158.207.255/32 -j DROP +-A blockip_in -s 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.124.153.99/32 -j DROP +-A blockip_in -s 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.123.92.221/32 -j DROP +-A blockip_in -s 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.224.167/32 -j DROP +-A blockip_in -s 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.45.201/32 -j DROP +-A blockip_in -s 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.93.153.201/32 -j DROP +-A blockip_in -s 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.103.70/32 -j DROP +-A blockip_in -s 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.196.78.8/32 -j DROP +-A blockip_in -s 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.20.203/32 -j DROP +-A blockip_in -s 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.110.84/32 -j DROP +-A blockip_in -s 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.82.208/32 -j DROP +-A blockip_in -s 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.31.225/32 -j DROP +-A blockip_in -s 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.58.105.233/32 -j DROP +-A blockip_in -s 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.241.69/32 -j DROP +-A blockip_in -s 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.28.195.9/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.79/32 -j DROP +-A blockip_in -s 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.199/32 -j DROP +-A blockip_in -s 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.27/32 -j DROP +-A blockip_in -s 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.241.212/32 -j DROP +-A blockip_in -s 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.111.172/32 -j DROP +-A blockip_in -s 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.232.16/32 -j DROP +-A blockip_in -s 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.34.196/32 -j DROP +-A blockip_in -s 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.187.153/32 -j DROP +-A blockip_in -s 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.184.201.126/32 -j DROP +-A blockip_in -s 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.82.205/32 -j DROP +-A blockip_in -s 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.150.188/32 -j DROP +-A blockip_in -s 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.156.16/32 -j DROP +-A blockip_in -s 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.13.61/32 -j DROP +-A blockip_in -s 72.21.195.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 72.21.195.65/32 -j DROP +-A blockip_in -s 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.13.61/32 -j DROP +-A blockip_in -s 52.46.145.112/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.46.145.112/32 -j DROP +-A blockip_in -s 52.46.141.49/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.46.141.49/32 -j DROP +-A blockip_in -s 54.239.26.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.239.26.255/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.37.114.192/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.37.114.192/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.160.240.60/32 -j DROP +-A blockip_in -s 52.10.136.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.10.136.27/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.160.240.60/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.26.211/32 -j DROP +-A blockip_in -s 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.59.84/32 -j DROP +-A blockip_in -s 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.83.103/32 -j DROP +-A blockip_in -s 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.65.125/32 -j DROP +-A blockip_in -s 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.50.86/32 -j DROP +-A blockip_in -s 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.76.109/32 -j DROP +-A blockip_in -s 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.165.77/32 -j DROP +-A blockip_in -s 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.197.222.92/32 -j DROP +-A blockip_in -s 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.254.127/32 -j DROP +-A blockip_in -s 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.9.106/32 -j DROP +-A blockip_in -s 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.192.89/32 -j DROP +-A blockip_in -s 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.158.207.255/32 -j DROP +-A blockip_in -s 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.124.153.99/32 -j DROP +-A blockip_in -s 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.123.92.221/32 -j DROP +-A blockip_in -s 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.224.167/32 -j DROP +-A blockip_in -s 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.45.201/32 -j DROP +-A blockip_in -s 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.93.153.201/32 -j DROP +-A blockip_in -s 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.156.103.70/32 -j DROP +-A blockip_in -s 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.196.78.8/32 -j DROP +-A blockip_in -s 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.157.20.203/32 -j DROP +-A blockip_in -s 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.110.84/32 -j DROP +-A blockip_in -s 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.82.208/32 -j DROP +-A blockip_in -s 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.31.225/32 -j DROP +-A blockip_in -s 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.58.105.233/32 -j DROP +-A blockip_in -s 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 3.120.241.69/32 -j DROP +-A blockip_in -s 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.28.195.9/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.148.24.227/32 -j DROP +-A blockip_in -s 52.41.41.102/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.41.41.102/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.200.12.154/32 -j DROP +-A blockip_in -s 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 34.214.185.21/32 -j DROP +-A blockip_in -s 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 52.32.14.1/32 -j DROP +-A blockip_in -s 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.148.24.227/32 -j DROP +-A blockip_in -s 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 54.71.96.255/32 -j DROP +-A blockip_in -s 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.250.92/32 -j DROP +-A blockip_in -s 35.166.120.35/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 35.166.120.35/32 -j DROP +-A blockip_in -s 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.18/32 -j DROP +-A blockip_in -s 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.72/32 -j DROP +-A blockip_in -s 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.65/32 -j DROP +-A blockip_in -s 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 13.225.245.33/32 -j DROP +-A blockip_in -s 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.111.172/32 -j DROP +-A blockip_in -s 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.232.16/32 -j DROP +-A blockip_in -s 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.195.34.196/32 -j DROP +-A blockip_in -s 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.187.153/32 -j DROP +-A blockip_in -s 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.184.201.126/32 -j DROP +-A blockip_in -s 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.194.82.205/32 -j DROP +-A blockip_in -s 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.150.188/32 -j DROP +-A blockip_in -s 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_in -s 18.185.156.16/32 -j DROP +-A blockip_out -d 52.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.0.0.0/8 -j DROP +-A blockip_out -d 54.0.0.0/8 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.0.0.0/8 -j DROP +-A blockip_out -d 13.48.203.206/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.48.203.206/32 -j DROP +-A blockip_out -d 2.21.169.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.21.169.41/32 -j DROP +-A blockip_out -d 13.115.174.176/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.115.174.176/32 -j DROP +-A blockip_out -d 18.182.0.0/16 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.182.0.0/16 -j DROP +-A blockip_out -d 23.10.69.56/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.69.56/32 -j DROP +-A blockip_out -d 104.89.189.238/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 104.89.189.238/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.41/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.41/32 -j DROP +-A blockip_out -d 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.168/32 -j DROP +-A blockip_out -d 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.152/32 -j DROP +-A blockip_out -d 88.221.64.239/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.64.239/32 -j DROP +-A blockip_out -d 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.138/32 -j DROP +-A blockip_out -d 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.152/32 -j DROP +-A blockip_out -d 23.10.74.160/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.74.160/32 -j DROP +-A blockip_out -d 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.224/32 -j DROP +-A blockip_out -d 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.209/32 -j DROP +-A blockip_out -d 23.10.76.42/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.10.76.42/32 -j DROP +-A blockip_out -d 88.221.65.114/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.65.114/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.48/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.48/32 -j DROP +-A blockip_out -d 2.16.65.147/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.147/32 -j DROP +-A blockip_out -d 2.16.65.171/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.171/32 -j DROP +-A blockip_out -d 88.221.65.13/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 88.221.65.13/32 -j DROP +-A blockip_out -d 195.8.22.64/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.64/32 -j DROP +-A blockip_out -d 195.8.22.40/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.40/32 -j DROP +-A blockip_out -d 195.8.22.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.152/32 -j DROP +-A blockip_out -d 195.8.22.138/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.22.138/32 -j DROP +-A blockip_out -d 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.37.165.98/32 -j DROP +-A blockip_out -d 23.39.84.7/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.39.84.7/32 -j DROP +-A blockip_out -d 23.37.165.98/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 23.37.165.98/32 -j DROP +-A blockip_out -d 195.8.15.224/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.224/32 -j DROP +-A blockip_out -d 195.8.15.209/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 195.8.15.209/32 -j DROP +-A blockip_out -d 2.16.65.152/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.152/32 -j DROP +-A blockip_out -d 2.16.65.168/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 2.16.65.168/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.26.211/32 -j DROP +-A blockip_out -d 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.59.84/32 -j DROP +-A blockip_out -d 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.83.103/32 -j DROP +-A blockip_out -d 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.65.125/32 -j DROP +-A blockip_out -d 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.50.86/32 -j DROP +-A blockip_out -d 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.76.109/32 -j DROP +-A blockip_out -d 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.165.77/32 -j DROP +-A blockip_out -d 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.222.92/32 -j DROP +-A blockip_out -d 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.254.127/32 -j DROP +-A blockip_out -d 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.9.106/32 -j DROP +-A blockip_out -d 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.192.89/32 -j DROP +-A blockip_out -d 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.158.207.255/32 -j DROP +-A blockip_out -d 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.124.153.99/32 -j DROP +-A blockip_out -d 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.123.92.221/32 -j DROP +-A blockip_out -d 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.224.167/32 -j DROP +-A blockip_out -d 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.45.201/32 -j DROP +-A blockip_out -d 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.93.153.201/32 -j DROP +-A blockip_out -d 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.103.70/32 -j DROP +-A blockip_out -d 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.196.78.8/32 -j DROP +-A blockip_out -d 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.20.203/32 -j DROP +-A blockip_out -d 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.110.84/32 -j DROP +-A blockip_out -d 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.82.208/32 -j DROP +-A blockip_out -d 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.31.225/32 -j DROP +-A blockip_out -d 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.58.105.233/32 -j DROP +-A blockip_out -d 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.241.69/32 -j DROP +-A blockip_out -d 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.28.195.9/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.79/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.79/32 -j DROP +-A blockip_out -d 13.225.241.199/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.199/32 -j DROP +-A blockip_out -d 13.225.241.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.27/32 -j DROP +-A blockip_out -d 13.225.241.212/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.241.212/32 -j DROP +-A blockip_out -d 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.111.172/32 -j DROP +-A blockip_out -d 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.232.16/32 -j DROP +-A blockip_out -d 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.34.196/32 -j DROP +-A blockip_out -d 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.187.153/32 -j DROP +-A blockip_out -d 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.184.201.126/32 -j DROP +-A blockip_out -d 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.82.205/32 -j DROP +-A blockip_out -d 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.150.188/32 -j DROP +-A blockip_out -d 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.156.16/32 -j DROP +-A blockip_out -d 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.13.61/32 -j DROP +-A blockip_out -d 72.21.195.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 72.21.195.65/32 -j DROP +-A blockip_out -d 13.225.13.61/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.13.61/32 -j DROP +-A blockip_out -d 52.46.145.112/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.46.145.112/32 -j DROP +-A blockip_out -d 52.46.141.49/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.46.141.49/32 -j DROP +-A blockip_out -d 54.239.26.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.239.26.255/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.37.114.192/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.37.114.192/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.160.240.60/32 -j DROP +-A blockip_out -d 52.10.136.27/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.10.136.27/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 35.160.240.60/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.160.240.60/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 18.197.26.211/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.26.211/32 -j DROP +-A blockip_out -d 3.120.59.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.59.84/32 -j DROP +-A blockip_out -d 18.197.83.103/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.83.103/32 -j DROP +-A blockip_out -d 3.120.65.125/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.65.125/32 -j DROP +-A blockip_out -d 3.120.50.86/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.50.86/32 -j DROP +-A blockip_out -d 18.197.76.109/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.76.109/32 -j DROP +-A blockip_out -d 3.120.165.77/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.165.77/32 -j DROP +-A blockip_out -d 18.197.222.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.197.222.92/32 -j DROP +-A blockip_out -d 35.156.254.127/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.254.127/32 -j DROP +-A blockip_out -d 35.157.9.106/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.9.106/32 -j DROP +-A blockip_out -d 35.156.192.89/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.192.89/32 -j DROP +-A blockip_out -d 35.158.207.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.158.207.255/32 -j DROP +-A blockip_out -d 3.124.153.99/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.124.153.99/32 -j DROP +-A blockip_out -d 3.123.92.221/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.123.92.221/32 -j DROP +-A blockip_out -d 35.156.224.167/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.224.167/32 -j DROP +-A blockip_out -d 35.157.45.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.45.201/32 -j DROP +-A blockip_out -d 54.93.153.201/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.93.153.201/32 -j DROP +-A blockip_out -d 35.156.103.70/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.156.103.70/32 -j DROP +-A blockip_out -d 18.196.78.8/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.196.78.8/32 -j DROP +-A blockip_out -d 35.157.20.203/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.157.20.203/32 -j DROP +-A blockip_out -d 18.195.110.84/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.110.84/32 -j DROP +-A blockip_out -d 18.195.82.208/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.82.208/32 -j DROP +-A blockip_out -d 18.194.31.225/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.31.225/32 -j DROP +-A blockip_out -d 52.58.105.233/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.58.105.233/32 -j DROP +-A blockip_out -d 3.120.241.69/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 3.120.241.69/32 -j DROP +-A blockip_out -d 52.28.195.9/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.28.195.9/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.148.24.227/32 -j DROP +-A blockip_out -d 52.41.41.102/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.41.41.102/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 54.200.12.154/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.200.12.154/32 -j DROP +-A blockip_out -d 34.214.185.21/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 34.214.185.21/32 -j DROP +-A blockip_out -d 52.32.14.1/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 52.32.14.1/32 -j DROP +-A blockip_out -d 54.148.24.227/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.148.24.227/32 -j DROP +-A blockip_out -d 54.71.96.255/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 54.71.96.255/32 -j DROP +-A blockip_out -d 35.166.250.92/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.250.92/32 -j DROP +-A blockip_out -d 35.166.120.35/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 35.166.120.35/32 -j DROP +-A blockip_out -d 13.225.245.18/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.18/32 -j DROP +-A blockip_out -d 13.225.245.72/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.72/32 -j DROP +-A blockip_out -d 13.225.245.65/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.65/32 -j DROP +-A blockip_out -d 13.225.245.33/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 13.225.245.33/32 -j DROP +-A blockip_out -d 18.194.111.172/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.111.172/32 -j DROP +-A blockip_out -d 18.195.232.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.232.16/32 -j DROP +-A blockip_out -d 18.195.34.196/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.195.34.196/32 -j DROP +-A blockip_out -d 18.185.187.153/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.187.153/32 -j DROP +-A blockip_out -d 18.184.201.126/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.184.201.126/32 -j DROP +-A blockip_out -d 18.194.82.205/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.194.82.205/32 -j DROP +-A blockip_out -d 18.185.150.188/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.150.188/32 -j DROP +-A blockip_out -d 18.185.156.16/32 -j LOG --log-prefix "BLOCKED IP: " +-A blockip_out -d 18.185.156.16/32 -j DROP -A cli_dns_in -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT -A cli_dns_in -j RETURN -A cli_dns_out -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT @@ -159,6 +894,8 @@ COMMIT -A cli_ssh_in -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A cli_ssh_in -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A cli_ssh_in -j RETURN +-A cli_ssh_out -d 10.0.0.0/8 -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT +-A cli_ssh_out -p tcp -m tcp --dport 2222 --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "iptables: SSH OUT:" -A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT -A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT -A cli_ssh_out -j RETURN @@ -190,19 +927,24 @@ COMMIT -A srv_https_out -j RETURN -A srv_icmp -p icmp -j ACCEPT -A srv_icmp -j RETURN +-A srv_ntp -p udp -m udp --sport 123 --dport 123 -j ACCEPT +-A srv_ntp -j RETURN -A srv_rip -p udp -m udp --sport 520 --dport 520 -j ACCEPT -A srv_rip -j RETURN +-A srv_smtp_in -p tcp -m tcp --sport 1024:65535 --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT +-A srv_smtp_in -j RETURN +-A srv_smtp_out -p tcp -m tcp --sport 25 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +-A srv_smtp_out -j RETURN +-A srv_ssh_in -s 10.0.0.0/8 -p tcp -m tcp --dport 2222 -m state --state NEW -j ACCEPT +-A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -j LOG --log-prefix "iptables: SSH NEW:" -A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" +-A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP: SSH" -A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP -A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP --A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state ESTABLISHED -j ACCEPT -A srv_ssh_in -j RETURN +-A srv_ssh_out -d 10.0.0.0/8 -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +-A srv_ssh_out -p tcp -m tcp --sport 2222 --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "iptables: SSH OUT:" -A srv_ssh_out -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_out -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A srv_ssh_out -j RETURN COMMIT -# Completed on Mon Jul 8 00:42:39 2019 +# Completed on Mon Feb 17 04:36:55 2020 -- cgit 1.4.1-2-gfad0