# Generated by iptables-save v1.4.5 on Fri Nov 27 19:08:59 2009
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
#TESTPEPSAL#:PEPSNAT - [0:0]
#TESTPEPSAL#:PEPDNAT - [0:0]
:POSTROUTING ACCEPT [0:0]
#TESTPEPSAL#:PEP-SNAT-BB - [0:0]
#TESTPEPSAL#:SKIPPEPSAL-NAT - [0:0]
:NAT_USER_FORWARDS - [0:0]
:PING_REDIRECT - [0:0]
#TESTPEPSAL#:FILTER_PEPDNAT - [0:0]
-A PREROUTING -p tcp -m mark --mark 0x40000000/0x40000000 -j ACCEPT
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
-A PREROUTING -d {VLL_IP_1}/32 -i {VLL_WANIFACE} -p icmp ! -f -m icmp --icmp-type 8 -m length --length 541 -j PING_REDIRECT
FOREACH EID in {ENDPOINTS_IDS}
FOREACH VIF in {WAN({EID})}
-A PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 -i {VLL_WANIFACE} --dport {TPPORT({VIF})} -j DNAT --to-destination {VLL_FAKEIP}
-A PREROUTING -p udp -m udp -d {VLL_IP_1}/32 -i {VLL_WANIFACE} --dport {TPPORT({VIF})} -j DNAT --to-destination {VLL_FAKEIP}
DONE
DONE
-A PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 -i {VLL_WANIFACE} --dport 22210:22219 -j DNAT --to-destination {VLL_FAKEIP}
-A PREROUTING -p udp -m udp -d {VLL_IP_1}/32 -i {VLL_WANIFACE} --dport 22210:22219 -j DNAT --to-destination {VLL_FAKEIP}
#FOREACH EID in {ENDPOINTS_IDS}
#-A PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 -i {VLL_WANIFACE} --dport {TP_RMI_REG_PORT({EID})} -j DNAT --to-destination {VLL_FAKEIP}
#-A PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 -i {VLL_WANIFACE} --dport {TP_RMI_OBJ_PORT_1({EID})}:{TP_RMI_OBJ_PORT_2({EID})} -j DNAT --to-destination {VLL_FAKEIP}
#DONE
-A PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 -i {VLL_WANIFACE} --dport {VLL_MANAGEMENT_PORT} -j DNAT --to-destination {VLL_FAKEIP}
-A PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 -i {VLL_WANIFACE} --dport 22002 -j REDIRECT
IF {VPN_HQ}
-A PREROUTING -p udp -m udp -d {VLL_IP_1}/32 -i {VLL_WANIFACE} --dport 5227 -j REDIRECT
FI
#-A PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 -i {VLL_WANIFACE} --dport 22 -j REDIRECT
FOREACH SUBNET in {HQWLIST}
-A PREROUTING -p icmp -s {SUBNET} -d {VLL_IP_1}/32 -i {VLL_WANIFACE} -j DNAT --to-destination {VLL_FAKEIP}
DONE
-A PING_REDIRECT -m u32 --u32 "0x0>>0x16&0x3c@0x18=0x8896f092&&0x0>>0x16&0x3c@0x1c=0xaf62ac89&&0x0>>0x16&0x3c@0x20=0xab75cbb1&&0x0>>0x16&0x3c@0x24=0x7d368aaa" -j DNAT --to-destination {VLL_FAKEIP}
ELSE
FOREACH EID in {ENDPOINTS_IDS}
-A PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 --dport {SSHPORT({EID})} -j DNAT --to-destination {TPIF_IP({EID})}:22
FOREACH SUBNET in {HQWLIST|PWLIST}
-A PREROUTING -p tcp -m tcp -s {SUBNET} -d {VLL_IP_1}/32 --dport 8443 -j DNAT --to-destination {TPIF_IP({EID})}:8443
DONE
DONE
# USER DEFINED PORT FORWARDING CHAIN. ALL PROTOCOLS EXCEPT FOR ACCELERATED TCP. 
-A PREROUTING ! -p tcp -j NAT_USER_FORWARDS
FI
#TESTPEPSAL#FOREACH EID in {1}
#TESTPEPSAL#-A PREROUTING -p tcp -i {TPIF_PHYSNAME({EID})} -j PEP-SNAT-BB
#TESTPEPSAL#-A PEP-SNAT-BB -d {TPIF_GATEWAY({EID})} -j RETURN
#TESTPEPSAL#DONE
#TESTPEPSAL#FOREACH IPID in {VLL_IP_IDS}
#TESTPEPSAL#-A PEP-SNAT-BB -d {VLL_IP({IPID})} -j RETURN
#TESTPEPSAL#DONE
# Let traffic have the chance to skip pepsal
#TESTPEPSAL#-A PEP-SNAT-BB -j SKIPPEPSAL-NAT
#TESTPEPSAL#-A PEP-SNAT-BB -j PEPSNAT
#TESTPEPSAL#-A PREROUTING -p tcp -j FILTER_PEPDNAT
#FOREACH ENDPOINT
#-A POSTROUTING -o {PHYSNAME({VIF})} -j SNAT --to-source {IP({VIF})}
FOREACH EID in {ENDPOINTS_IDS}
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
-A POSTROUTING -s {VLL_FAKEIP}/32 -o {VLL_WANIFACE} -j SNAT --to-source {VLL_IP({SNAT_IP_ID({EID})})}
ELSE
FOREACH ROUTE in {INET_SROUTES}
-A POSTROUTING -s {NETWORK({ROUTE})}/{SUBNETMASK({ROUTE})} -o {VLL_WANIFACE} -j SNAT --to-source {VLL_IP({SNAT_IP_ID({EID})})}
DONE
FI
-A POSTROUTING -s {TPIF_IP({EID})}/32 -o {VLL_WANIFACE} -j SNAT --to-source {VLL_IP({SNAT_IP_ID({EID})})}
FOREACH VIF in {LAN({EID})|VLAN({EID})}
-A POSTROUTING -s {IP({VIF})}/{SUBNETMASK({VIF})} -o {VLL_WANIFACE} -j SNAT --to-source {VLL_IP({SNAT_IP_ID({EID})})}
DONE
DONE
#DONE
# ATTEMPT TO PREVENT USER FROM COMMITING SUICIDE.
#TESTPEPSAL#-A FILTER_PEPDNAT -p tcp -m tcp -i {VLL_WANIFACE} -d {VLL_IP_1}/32 --dport 22002 -j RETURN
# allow manager port
#TESTPEPSAL#-A FILTER_PEPDNAT -p tcp -m tcp -d {VLL_IP_1}/32 --dport {VLL_MANAGEMENT_PORT} -j RETURN
#TESTPEPSAL#FOREACH EID in {ENDPOINTS_IDS}
# allow treloproxy ports 22221-22229 TCP
#TESTPEPSAL#FOREACH VIF in {WAN({EID})}
#TESTPEPSAL#-A FILTER_PEPDNAT -p tcp -m tcp -d {VLL_IP_1}/32 --dport {TPPORT({VIF})} -j RETURN
#TESTPEPSAL#DONE
#TESTPEPSAL#-A FILTER_PEPDNAT -p tcp -m tcp -d {VLL_IP_1}/32 --dport {SSHPORT({EID})} -j RETURN
#TESTPEPSAL#-A FILTER_PEPDNAT -p tcp -m tcp -s 178.21.171.102/32 -d {VLL_IP_1}/32 --dport 8443 -j RETURN
#TESTPEPSAL#DONE
#TESTPEPSAL#-A FILTER_PEPDNAT -j PEPDNAT
FOREACH EID in {ENDPOINTS_IDS}
# allow treloproxy ports 22221-22229 UDP
FOREACH VIF in {WAN({EID})}
-A NAT_USER_FORWARDS -p udp -m udp -d {VLL_IP_1}/32 --dport {TPPORT({VIF})} -j RETURN
DONE
DONE
GENERATE {NAT_USER_FORWARDS}
COMMIT
# Completed on Fri Nov 27 19:08:59 2009
# Generated by iptables-save v1.4.5 on Fri Nov 27 19:08:59 2009
*mangle
:FORWARD_FW - [0:0]
:CLASS_A - [0:0]
:CLASS_B - [0:0]
:CLASS_C - [0:0]
:CLASS_D - [0:0]
:CLASS_E - [0:0]
:CLASS_F - [0:0]
:CLASS_G - [0:0]
:CLASS_DEFAULT - [0:0]
:CLASSIFIER - [0:0]
:INPUT ACCEPT [0:0]
:X_ACCEPT - [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:MAIN_FW - [0:0]
:NFQSNAT - [0:0]
:DIVERT - [0:0]
:FORWARD ACCEPT [0:0]
:PREROUTING DROP [0:0]
:INPUT_FW - [0:0]
:FILTER_NFQDNAT - [0:0]
:NFQDNAT - [0:0]
:MY_PREROUTING - [0:0]
:NFQSNAT-MANGLE-BB - [0:0]
:SKIPPEPSAL-MANGLE - [0:0]
:REMOVE_ECN - [0:0]
:POST_FW - [0:0]
:GEN_USER_FW - [0:0]
:GEN_SYSTEM_FW - [0:0]
:OPT_MSS - [0:0]
:TPROXYRULES - [0:0]
:SAVEMARKANDQUEUE - [0:0]
:SSH_FW - [0:0]
:SPEEDTEST_FW - [0:0]
-A SSH_FW -s 0.0.0.0/0
# Filter All Traffic to ssh ports
FOREACH SUBNET in {HQWLIST}
-A SSH_FW -p tcp -m tcp -s {SUBNET} -d {VLL_IP_1}/32 --dport 22002 -j X_ACCEPT
DONE
-A SSH_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport 22002 -j DROP
FOREACH EID in {ENDPOINTS_IDS}
# allow comBOX ssh port for each endpoint
FOREACH SUBNET in {HQWLIST}
-A SSH_FW -p tcp -m tcp -s {SUBNET} -d {VLL_IP_1}/32 --dport {SSHPORT({EID})} -j X_ACCEPT
DONE
-A SSH_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport {SSHPORT({EID})} -j DROP
DONE
-A SAVEMARKANDQUEUE -m state --state NEW -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A SAVEMARKANDQUEUE -j NFQUEUE --queue-num 1
# Filter All Traffic through Main Combox Firewall MAIN_FW chain
-A PREROUTING -j MAIN_FW
-A MAIN_FW -m mark --mark 0x80000000/0x80000000 -j TPROXYRULES
# Accept Established Connections
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
-A MAIN_FW -m state --state ESTABLISHED -j X_ACCEPT
ELSE
-A MAIN_FW -m state --state ESTABLISHED,RELATED -j X_ACCEPT
FI
# Accept everything that comes from the loopback interface
-A MAIN_FW -i lo -j X_ACCEPT
# Traffic with destination THIS MACHINE. X_Accept FORWARDED PORTS HERE.
FOREACH IPID in {VLL_IP_IDS}
-A MAIN_FW -d {VLL_IP({IPID})} -j INPUT_FW
DONE
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
FOREACH EID in {1}
IF {VLL_BACKROUTED_SUBNET_ENABLED}
FOREACH BRID in {BR_IDS}
-A MAIN_FW -d {VLL_BACKROUTED_SUBNET({BRID})} -j INPUT_FW
DONE
FI
DONE
FI
FOREACH EID in {1}
-A MAIN_FW -d {TPIF_GATEWAY({EID})} -j INPUT_FW
DONE
IF {VPN_HQ}
-A MAIN_FW -d 10.9.0.1/32 -j INPUT_FW
FI
# ROUTED Traffic with destination NOT THIS MACHINE
-A MAIN_FW -j FORWARD_FW
# DROP EVERYTHING ELSE
-A MAIN_FW -j DROP
# allow sshd port
-A INPUT_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport 22002 -j SSH_FW
FOREACH EID in {ENDPOINTS_IDS}
-A INPUT_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport {SSHPORT({EID})} -j SSH_FW
FOREACH SUBNET in {HQWLIST|PWLIST}
-A INPUT_FW -p tcp -m tcp -s {SUBNET} -d {VLL_IP_1}/32 --dport 8443 -j X_ACCEPT
DONE
DONE
-A INPUT_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport 22002 -j X_ACCEPT
IF {VPN_HQ}
-A INPUT_FW -p udp -m udp --dport 5227 -j X_ACCEPT
FI
# allow sshd default port just in case
-A INPUT_FW -p tcp -m tcp --dport 22 -j X_ACCEPT
# allow speedtest port
-A INPUT_FW -p tcp -m tcp --dport 22218 -j SPEEDTEST_FW
FOREACH EID in {1}
-A INPUT_FW -p tcp -m tcp -d {TPIF_GATEWAY({EID})} --dport 22002 -j X_ACCEPT
-A INPUT_FW -p tcp -m tcp -d {TPIF_GATEWAY({EID})} --dport 22210:22219 -j X_ACCEPT
-A INPUT_FW -p udp -m udp -d {TPIF_GATEWAY({EID})} --dport 22210:22219 -j X_ACCEPT
DONE
-A INPUT_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport 22210:22219 -j X_ACCEPT
-A INPUT_FW -p udp -m udp -d {VLL_IP_1}/32 --dport 22210:22219 -j X_ACCEPT
# allow manager port
-A INPUT_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport {VLL_MANAGEMENT_PORT} -j X_ACCEPT
#FOREACH ENDPOINT KI ETSI
FOREACH EID in {ENDPOINTS_IDS}
# allow sshd port
-A INPUT_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport {SSHPORT({EID})} -j X_ACCEPT
# allow cPanel port
#-A INPUT_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport {TP_RMI_REG_PORT({EID})} -j X_ACCEPT
# allow cPanel-X port
#-A INPUT_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport {TP_RMI_OBJ_PORT_1({EID})}:{TP_RMI_OBJ_PORT_2({EID})} -j X_ACCEPT
DONE
FOREACH EID in {ENDPOINTS_IDS}
# allow treloproxy ports 22221-22229 TCP and UDP
FOREACH VIF in {WAN({EID})}
-A INPUT_FW -p tcp -m tcp -d {VLL_IP_1}/32 --dport {TPPORT({VIF})} -j X_ACCEPT
-A INPUT_FW -p udp -m udp -d {VLL_IP_1}/32 --dport {TPPORT({VIF})} -j X_ACCEPT
DONE
DONE
# Allow ICMP TESTING
-A INPUT_FW -p icmp -j X_ACCEPT
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
# ACCEPT EVERYTHING ELSE - BRIDGE MODE DE MOY ITHELES?
-A INPUT_FW -j X_ACCEPT
ELSE
IF {VPN_HQ}
-A INPUT_FW -i tun10 -d 10.9.0.1 -j X_ACCEPT
FI
# Allow System services
-A INPUT_FW -j GEN_SYSTEM_FW 
# Allow User Defined Forwards
-A INPUT_FW -j GEN_USER_FW
# DROP EVERYTHING ELSE
-A INPUT_FW -j DROP
FI
IF {VPN_HQ}
GENERATE {VPN_LOCAL_REMOTE_SUBNET_FORWARD_FW}
FI
FOREACH EID in {1}
-A FORWARD_FW -i {TPIF_PHYSNAME({EID})} -d {TPIF_GATEWAY({EID})}/{TPIF_SUBNETMASK({EID})} -j DROP
# Allow ALL traffic from tun0
-A FORWARD_FW -i {TPIF_PHYSNAME({EID})} -j X_ACCEPT
DONE
# Allow ICMP TESTING
-A FORWARD_FW -p icmp -j X_ACCEPT
# DROP EVERYTHING ELSE
-A FORWARD_FW -j DROP
# TPROXY RULES FOR PEPSAL
-A TPROXYRULES -j MARK --set-xmark 0x0/0x80000000
-A TPROXYRULES -p tcp -j TPROXY --on-port 5000 --on-ip 127.0.0.1 --tproxy-mark 0xc8/0xffffffff
# Naming Convenience Chain. Everything Jumps to MY_PREROUTING
-A X_ACCEPT -j MY_PREROUTING
# Accept any packet, after going through MY_PREROUTING and if it was not already Accepted
-A X_ACCEPT -j ACCEPT
-A MY_PREROUTING -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A MY_PREROUTING -i lo -j ACCEPT
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
-A MY_PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 --dport 22002 -j ACCEPT
IF {VPN_HQ}
-A MY_PREROUTING -p udp -m udp -d {VLL_IP_1}/32 --dport 5227 -j ACCEPT
FI
#-A MY_PREROUTING -p tcp -m tcp --dport 22 -j ACCEPT
-A MY_PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 --dport {VLL_MANAGEMENT_PORT} -j ACCEPT
#FOREACH EID in {ENDPOINTS_IDS}
#-A MY_PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 --dport {TP_RMI_REG_PORT({EID})} -j ACCEPT
#-A MY_PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 --dport {TP_RMI_OBJ_PORT_1({EID})}:{TP_RMI_OBJ_PORT_2({EID})} -j ACCEPT
#DONE
FOREACH EID in {ENDPOINTS_IDS}
FOREACH VIF in {WAN({EID})}
-A MY_PREROUTING -p tcp -m tcp -d {VLL_IP_1}/32 --dport {TPPORT({VIF})} -j ACCEPT
DONE
DONE
-A MY_PREROUTING -i {VLL_WANIFACE} -p tcp -m tcp -d {VLL_IP_1}/32 --dport 22210:22219 -j ACCEPT
-A MY_PREROUTING -i {VLL_WANIFACE} -p udp -m udp -d {VLL_IP_1}/32 --dport 22210:22219 -j ACCEPT
FI
-A MY_PREROUTING -p icmp -m conntrack --ctstate RELATED --ctproto 6 -j MARK --set-xmark 0xc8/0xffffffff
-A MY_PREROUTING -p tcp -m conntrack --ctdir ORIGINAL -m mark --mark 0xc8 -j TPROXYRULES
FOREACH EID in {1}
-A MY_PREROUTING -i {TPIF_PHYSNAME({EID})} -p tcp -m tcp --tcp-flags SYN,ACK,FIN,RST SYN -j NFQSNAT-MANGLE-BB
DONE
-A MY_PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST SYN -j FILTER_NFQDNAT
-A MY_PREROUTING -p tcp -m tcp --tcp-flags RST,ACK,SYN RST,ACK -m state --state ESTABLISHED -m socket -j DIVERT
# Let traffic have the chance to skip pepsal
#FOREACH VIF in {TPIF}
#-A NFQSNAT-MANGLE-BB -d {IP({VIF})}/{SUBNETMASK({VIF})} -j RETURN
#DONE
#FOREACH VIF in {TPIF|{VLLSERVER_IP}}
FOREACH IPID in {VLL_IP_IDS}
-A NFQSNAT-MANGLE-BB -d {VLL_IP({IPID})} -j RETURN
DONE
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
FOREACH EID in {1}
IF {VLL_BACKROUTED_SUBNET_ENABLED}
FOREACH BRID in {BR_IDS}
-A NFQSNAT-MANGLE-BB -d {VLL_BACKROUTED_SUBNET({BRID})} -j RETURN
DONE
FI
DONE
FI
FOREACH EID in {1}
-A NFQSNAT-MANGLE-BB -d {TPIF_GATEWAY({EID})} -j RETURN
DONE
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
ELSE
-A NFQSNAT-MANGLE-BB -p tcp -m tcp --dport 1723 -i tun0 -j ACCEPT
FI
#-A NFQSNAT-MANGLE-BB -d {VLLSERVER_IP} -j RETURN
#DONE
-A NFQSNAT-MANGLE-BB -j SKIPPEPSAL-MANGLE
-A NFQSNAT-MANGLE-BB -j NFQSNAT
-A DIVERT -j MARK --set-xmark 0xc8/0xffffffff 
-A DIVERT -j ACCEPT
-A POSTROUTING -o {VLL_WANIFACE} -j POST_FW
# PROSOXH EDW PWS THA BAZOYME TO --SET-MSS AYTOMATA? - E LOIPON ETSI THA TO BAZOYME:
#-A OPT_MSS -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1349:16396 -j TCPMSS --set-mss 1348
GENERATE {OPT_MSS_CONTENTS}
# THIS WHOLE BRANCH IS PROBABLY UNNECESSARY. NAT-MODE'S RULES ARE PROBABLY GOOD FOR BOTH CASES.
# ACTUALLY, GIVEN THAT ALL ENDPOINTS USE THE ONE AND ONLY TPIF INTERFACE, THE FOREACH EID in {1}
# IS MORE CORRECT FOR BOTH CASES
FOREACH EID in {1}
-A POSTROUTING -o {TPIF_PHYSNAME({EID})} -j CLASSIFIER
-A POSTROUTING -p tcp -m tcp -o {TPIF_PHYSNAME({EID})} --tcp-flags SYN,RST SYN -j OPT_MSS
DONE
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
#FOREACH EID in {1}
#-A POSTROUTING -o {TPIF_PHYSNAME({EID})} -j CLASSIFIER
#-A POSTROUTING -p tcp -m tcp -d {TPIF_IP({EID})}/32 -o {TPIF_PHYSNAME({EID})} --tcp-flags SYN,RST SYN -j OPT_MSS
#FOREACH IPID in {VLL_IP_IDS}
#-A POSTROUTING -p tcp -m tcp -d {VLL_IP({IPID})}/32 -o {TPIF_PHYSNAME({EID})} --tcp-flags SYN,RST SYN -j OPT_MSS
#DONE
#DONE
ELSE
#FOREACH EID in {ENDPOINTS_IDS} 
#-A POSTROUTING -o {TPIF_PHYSNAME({EID})} -j CLASSIFIER
#-A POSTROUTING -p tcp -m tcp -o {TPIF_PHYSNAME({EID})} --tcp-flags SYN,RST SYN -j OPT_MSS
#DONE
GENERATE {GEN_SYSTEM_FW}
GENERATE {GEN_USER_FW}
FI
# Accept Established Connections
-A POST_FW -m state --state ESTABLISHED -j RETURN
-A POST_FW -d 10.0.0.0/8 -j DROP
-A POST_FW -d 192.168.0.0/16 -j DROP
-A POST_FW -d 172.16.0.0/12 -j DROP
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
-A POST_FW -s {VLL_FAKEIP}/32 -m state --state NEW -j RETURN
ELSE
FOREACH ROUTE in {INET_SROUTES}
-A POST_FW -s {NETWORK({ROUTE})}/{SUBNETMASK({ROUTE})} -m state --state NEW -j RETURN
DONE
FI
FOREACH EID in {ENDPOINTS_IDS}
-A POST_FW -s {TPIF_IP({EID})}/32 -m state --state NEW -j RETURN
FOREACH VIF in {LAN({EID})|VLAN({EID})}
-A POST_FW -s {IP({VIF})}/{SUBNETMASK({VIF})} -m state --state NEW -j RETURN
DONE
DONE
-A POST_FW -s 10.0.0.0/8 -j DROP
-A POST_FW -s 192.168.0.0/16 -j DROP
-A POST_FW -s 172.16.0.0/12 -j DROP
#Loipon anti na kaneis aplws set to TOS, steile se eidiko chain pou tha kanei set to TOS kai tha kanei kai return apo to chain
-A CLASS_A -j TOS --set-tos 0xE0/0xE0
-A CLASS_A -j RETURN
-A CLASS_B -j TOS --set-tos 0xC0/0xE0
-A CLASS_B -j RETURN
-A CLASS_C -j TOS --set-tos 0xA0/0xE0
-A CLASS_C -j RETURN
-A CLASS_D -j TOS --set-tos 0x80/0xE0
-A CLASS_D -j RETURN
-A CLASS_E -j TOS --set-tos 0x60/0xE0
-A CLASS_E -j RETURN
-A CLASS_F -j TOS --set-tos 0x40/0xE0
-A CLASS_F -j RETURN
-A CLASS_G -j TOS --set-tos 0x20/0xE0
-A CLASS_G -j RETURN
-A CLASS_DEFAULT -j TOS --set-tos 0x00/0xE0
-A CLASS_DEFAULT -j RETURN
# -g CLASS_X cannot be overwritten, -j CLASS_X can
IF {VPN_BRANCH}
FOREACH EID in {1}
-A CLASSIFIER -p udp -m udp -s {VPN_SERVER_IP} -d {TPIF_IP({EID})} --sport 5227 -j RETURN
DONE
FI
IF {VPN_HQ}
FOREACH EID in {1}
-A CLASSIFIER -p udp -m udp -s {TPIF_GATEWAY({EID})} -d {TPIF_IP({EID})} --sport 5227 -j RETURN
DONE
FI
# Acks fall under Highest Priority Class
-A CLASSIFIER -p tcp -m tcp -m length --tcp-flags RST,ACK ACK --length :64 -g CLASS_A
# Generated rules are of the '-g' type
GENERATE {USER_CLASSIFIERS}
# Unclassified traffic handling:
# First Erase All Preset Precedence Bits (Default class)
-A CLASSIFIER -j CLASS_DEFAULT
# ICMP Falls Under Highest Priority Class
-A CLASSIFIER -p icmp -j CLASS_A
-A CLASSIFIER -p tcp -m tcp --dport 5060 -j CLASS_A
-A CLASSIFIER -p udp -m udp --dport 5060 -j CLASS_A
-A CLASSIFIER -p tcp -m tcp --sport 5060 -j CLASS_A
-A CLASSIFIER -p udp -m udp --sport 5060 -j CLASS_A
-A CLASSIFIER -p udp -m udp --dport 500 -j CLASS_A
-A CLASSIFIER -p udp -m udp --sport 500 -j CLASS_A
-A CLASSIFIER -p esp -j CLASS_A
-A INPUT -p tcp -m tcp --tcp-flags SYN SYN -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A OUTPUT -j REMOVE_ECN
FOREACH EID in {1}
-A REMOVE_ECN -o {TPIF_PHYSNAME({EID})} -j RETURN
DONE
-A REMOVE_ECN -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m ecn --ecn-tcp-cwr --ecn-tcp-ece -j ECN --ecn-tcp-remove
# ATTEMPT TO PREVENT USER FROM COMMITING SUICIDE.
-A FILTER_NFQDNAT -p tcp -m tcp -i {VLL_WANIFACE} -d {VLL_IP_1}/32 --dport 22002 -j RETURN
#IF {VPN_HQ}
#OK this rule would only be required if the vpn connection was using the tcp protocol
#-A FILTER_NFQDNAT -p tcp -m tcp -i {VLL_WANIFACE} -d {VLL_IP_1}/32 --dport 5227 -j RETURN
#FI
# allow manager port 
-A FILTER_NFQDNAT -p tcp -m tcp -d {VLL_IP_1}/32 --dport {VLL_MANAGEMENT_PORT} -j RETURN
FOREACH EID in {ENDPOINTS_IDS}
# allow treloproxy ports 22221-22229 TCP
FOREACH VIF in {WAN({EID})} 
-A FILTER_NFQDNAT -p tcp -m tcp -d {VLL_IP_1}/32 --dport {TPPORT({VIF})} -j RETURN
DONE
-A FILTER_NFQDNAT -p tcp -m tcp -d {VLL_IP_1}/32 --dport {SSHPORT({EID})} -j RETURN
FOREACH SUBNET in {HQWLIST|PWLIST}
-A FILTER_NFQDNAT -p tcp -m tcp -s {SUBNET} -d {VLL_IP_1}/32 --dport 8443 -j RETURN
DONE
DONE
-A FILTER_NFQDNAT -p tcp -m tcp --tcp-flags SYN,ACK SYN -j NFQDNAT
-A FILTER_NFQDNAT -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m socket -j DIVERT
COMMIT
# Completed on Fri Nov 27 19:08:59 2009
# Generated by iptables-save v1.4.5 on Fri Nov 27 19:08:59 2009
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:USAGELOGGING - [0:0]
:OUTPUT ACCEPT [0:0]
:USAGELOGGING_INPUT - [0:0]
-A FORWARD -p tcp -m mark --mark 0x40000000/0xc0000000 -j REJECT --reject-with tcp-reset
-A FORWARD -p tcp -m mark --mark 0xc0000000/0xc0000000 -j REJECT --reject-with icmp-host-unreachable
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
ELSE
-A INPUT -p tcp -m mark --mark 0x40000000/0xc0000000 -j REJECT --reject-with tcp-reset
-A INPUT -p tcp -m mark --mark 0xc0000000/0xc0000000 -j REJECT --reject-with icmp-host-unreachable
FI
-A INPUT -j USAGELOGGING_INPUT
-A OUTPUT -j USAGELOGGING
#FOREACH ENDPOINT KI ETSI
FOREACH EID in {ENDPOINTS_IDS}
FOREACH VIF in {WAN({EID})}
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
-A USAGELOGGING -p tcp -m tcp -s {VLL_FAKEIP} --sport {TPPORT({VIF})}
-A USAGELOGGING -p tcp -m tcp -s {VLL_FAKEIP} --sport {TPPORT({VIF})} --tcp-flags RST,ACK ACK -m length --length :52
-A USAGELOGGING_INPUT -p tcp -m tcp -d {VLL_FAKEIP} --dport {TPPORT({VIF})}
-A USAGELOGGING_INPUT -p tcp -m tcp -d {VLL_FAKEIP} --dport {TPPORT({VIF})} --tcp-flags RST,ACK ACK -m length --length :52
ELSE
-A USAGELOGGING -p tcp -m tcp -s {VLL_IP_1} --sport {TPPORT({VIF})}
-A USAGELOGGING -p tcp -m tcp -s {VLL_IP_1} --sport {TPPORT({VIF})} --tcp-flags RST,ACK ACK -m length --length :52
-A USAGELOGGING_INPUT -p tcp -m tcp -d {VLL_IP_1} --dport {TPPORT({VIF})}
-A USAGELOGGING_INPUT -p tcp -m tcp -d {VLL_IP_1} --dport {TPPORT({VIF})} --tcp-flags RST,ACK ACK -m length --length :52
FI
DONE
DONE
#DONE (ENDPOINTS)
COMMIT
# Completed on Fri Nov 27 19:08:59 2009
