-
-
Notifications
You must be signed in to change notification settings - Fork 24
/
serv.rules
40 lines (40 loc) · 2.2 KB
/
serv.rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# Generated by iptables-save v1.4.21 on Wed Feb 10 14:45:55 2016
*filter
:INPUT DROP [2418:3982778]
:FORWARD DROP [0:0]
:OUTPUT DROP [1576:200742]
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Block ctf users
-A OUTPUT -m state --state NEW -m owner --uid-owner crypto70 -j DROP
-A OUTPUT -m state --state NEW -m owner --uid-owner crypto90 -j DROP
-A OUTPUT -m state --state NEW -m owner --uid-owner code50 -j DROP
-A OUTPUT -m state --state NEW -m owner --uid-owner code60 -j DROP
-A OUTPUT -m state --state NEW -m owner --uid-owner code70 -j DROP
-A OUTPUT -m state --state NEW -m owner --uid-owner code80 -j DROP
-A OUTPUT -m state --state NEW -m owner --uid-owner code90 -j DROP
-A OUTPUT -m state --state NEW -m owner --uid-owner exp50 -j DROP
-A OUTPUT -m state --state NEW -m owner --uid-owner exp60 -j DROP
-A OUTPUT -m state --state NEW -m owner --uid-owner exp70 -j DROP
-A OUTPUT -m state --state NEW -m owner --uid-owner exp90 -j DROP
# Allow output
-A OUTPUT -j ACCEPT
# Allow SSH
-A INPUT -i eth0 -p tcp -m state --state NEW --dport 22 -j ACCEPT
# Allow service from proxy
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 10009 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 10061 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 11027 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 11059 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 11071 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 11117 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 11491 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 12037 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 12049 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 12157 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 12377 -j ACCEPT
-A INPUT -i eth1 -s 10.133.11.41 -p tcp -m state --state NEW --dport 12589 -j ACCEPT
# Allow Ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
COMMIT