SNAT работает без разрешающих правил

12.11.2012 21:16 · отредактировано #285024

hi
Есть хост 10,11,110,67 и гейт по умолчанию для него 10,11,110,224.
Оказалось, что хост выходит в мир под ip 1.1.1.7. Правил, разрешающих это, не наблюдается.

Правила не гейте (iptables -n -L -t nat -v --line-number | grep 1.1.1.7)

text


15       0     0 DNAT       tcp  --  *      *       0.0.0.0/0            1.1.1.7        tcp dpt:443 /* Port forwarding */ to:10.11.110.27
16       0     0 DNAT       tcp  --  *      *       0.0.0.0/0            1.1.1.7        tcp dpt:6661 /* Port forwarding */ to:10.11.110.87
17       0     0 DNAT       tcp  --  *      *       0.0.0.0/0            1.1.1.7        tcp dpt:3390 /* Port forwarding */ to:10.11.119.200
20       0     0 DNAT       tcp  --  *      *       0.0.0.0/0            1.1.1.7        tcp dpt:3389 /* Port forwarding */ to:10.11.110.248
3      187 11220 SNAT       all  --  *      *       10.11.110.14         0.0.0.0/0            to:1.1.1.7
4        0     0 SNAT       all  --  *      *       10.11.110.9          0.0.0.0/0            to:1.1.1.7
5      864 78615 SNAT       all  --  *      *       10.11.110.111        0.0.0.0/0            to:1.1.1.7
6        1    76 SNAT       all  --  *      *       10.11.110.26         0.0.0.0/0            to:1.1.1.7
7        0     0 SNAT       all  --  *      *       10.11.110.170        0.0.0.0/0            to:1.1.1.7
8        0     0 SNAT       all  --  *      *       10.11.110.6          0.0.0.0/0            to:1.1.1.7
9        0     0 SNAT       all  --  *      *       10.11.110.107        0.0.0.0/0            to:1.1.1.7
26       0     0 SNAT       all  --  *      *       10.11.110.57         0.0.0.0/0            to:1.1.1.7
27       0     0 SNAT       all  --  *      *       10.11.110.87         0.0.0.0/0            to:1.1.1.7
30       0     0 SNAT       all  --  *      *       10.11.110.248        0.0.0.0/0            to:1.1.1.7
31       0     0 SNAT       all  --  *      *       10.11.119.200        0.0.0.0/0            to:1.1.1.7
32       0     0 SNAT       all  --  *      *       10.11.110.27         0.0.0.0/0            to:1.1.1.7
37      75  4940 SNAT       all  --  *      *       10.11.108.251        0.0.0.0/0            to:1.1.1.7

Если судить по счетчикам, то это либо 37 правило, либо 5е. Есть идеи?

12.11.2012 23:48 #285052

А явно запрещающие правила есть? =)

13.11.2012 01:32 · отредактировано #285066

Какой интересный вопрос).
Правила, которые меняют soure ip на 1.1.1.7 только те, что я показал. Если все то же проделать на 10,11,110,165 к примеру, то SNAT не работает, что есть логично.
Зачем тогда явно запрещающие правила, если более ничего не может поменять src ip 10,11,110,67 на 1.1.1.7? )

13.11.2012 13:41 · отредактировано #285128

а MASQERADE есть где-нибудь? )

а можно iptables-save выложить вывод? он как-то привычнее для восприятия.

ну и краткую схему сети =). чудес же не бывает =).

15.11.2012 18:08 · отредактировано #285348

Про MASQUERADE ничего не нашел, сначала тоже подумал о нем. )
Краткая схема такая:
- сеть 10,11,0,0/16 роутится чезер несколько гейтов соответствено, в зависимости от настроек клиентов
- 10,11,110,224 - один из многих гейтов, который и есть проблемный. На гейте через vlan висят ip провайдера из сети 1,1,1,0/24, в частности и 1,1,1,7, через который почему-то выходит в мир хост 10,11,110,67. Трейс говорит, что марштут как раз через 10,11,110,224 проходит.

Показать

text

iptables-save
# Generated by iptables-save v1.4.12 on Tue Nov 13 16:34:22 2012
*raw
:PREROUTING ACCEPT [155706:118222677]
:OUTPUT ACCEPT [754:65149]
COMMIT
# Completed on Tue Nov 13 16:34:22 2012
# Generated by iptables-save v1.4.12 on Tue Nov 13 16:34:22 2012
*nat
:PREROUTING ACCEPT [3760:409665]
:INPUT ACCEPT [2634:312790]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [757:41929]
:dnat - [0:0]
:snt_dnat - [0:0]
:vlan2121_masq - [0:0]
-A PREROUTING -j dnat
-A POSTROUTING -o vlan2121 -j vlan2121_masq
-A dnat -i vlan2121 -j snt_dnat
-A snt_dnat -d 1.1.1.33/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.60
-A snt_dnat -d 1.1.1.33/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.60:81
-A snt_dnat -d 1.1.1.33/32 -p tcp -m tcp --dport 21 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.60
-A snt_dnat -d 1.1.1.31/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.17
-A snt_dnat -d 1.1.1.31/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.17
-A snt_dnat -d 1.1.1.35/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.148
-A snt_dnat -d 1.1.1.35/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.148
-A snt_dnat -d 1.1.1.39/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.145
-A snt_dnat -d 1.1.1.39/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.145
-A snt_dnat -d 1.1.1.40/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.252
-A snt_dnat -d 1.1.1.40/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.252
-A snt_dnat -d 1.1.1.34/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.251
-A snt_dnat -d 1.1.1.34/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.251
-A snt_dnat -d 1.1.1.41/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.28
-A snt_dnat -d 1.1.1.7/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.27
-A snt_dnat -d 1.1.1.7/32 -p tcp -m tcp --dport 6661 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.87
-A snt_dnat -d 1.1.1.7/32 -p tcp -m tcp --dport 3390 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.119.200
-A snt_dnat -d 1.1.1.36/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.83
-A snt_dnat -d 1.1.1.36/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.83
-A snt_dnat -d 1.1.1.7/32 -p tcp -m tcp --dport 3389 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.248
-A snt_dnat -d 1.1.1.41/32 -p tcp -m tcp --dport 6969 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.108.21:3389
-A snt_dnat -d 1.1.1.40/32 -p tcp -m tcp --dport 6969 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.108.20:3389
-A snt_dnat -d 1.1.1.40/32 -p tcp -m tcp --dport 23 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.91
-A snt_dnat -d 1.1.1.40/32 -p tcp -m tcp --dport 21 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.91
-A snt_dnat -d 1.1.1.40/32 -p tcp -m tcp --dport 4000 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.91:4000
-A snt_dnat -d 1.1.1.41/32 -p tcp -m tcp --dport 23 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.93
-A snt_dnat -d 1.1.1.41/32 -p tcp -m tcp --dport 21 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.93
-A snt_dnat -d 1.1.1.41/32 -p tcp -m tcp --dport 4000 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.93:4000
-A snt_dnat -d 1.1.1.43/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.122
-A snt_dnat -d 1.1.1.43/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.122
-A snt_dnat -d 1.1.1.44/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.46
-A snt_dnat -d 1.1.1.44/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.46
-A snt_dnat -d 1.1.1.44/32 -p tcp -m tcp --dport 21 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.46
-A snt_dnat -d 1.1.1.44/32 -p tcp -m tcp --dport 81 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.46:81
-A snt_dnat -d 1.1.1.44/32 -p tcp -m tcp --dport 444 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.46:444
-A snt_dnat -d 1.1.1.44/32 -p tcp -m tcp --dport 8000 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.46:8000
-A snt_dnat -d 1.1.1.42/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.115
-A snt_dnat -d 1.1.1.42/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.115
-A snt_dnat -d 1.1.1.32/32 -p tcp -m tcp --dport 1494 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.11:1494
-A snt_dnat -d 1.1.1.32/32 -p udp -m udp --dport 1494 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.11:1494
-A snt_dnat -d 1.1.1.32/32 -p tcp -m tcp --dport 2598 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.11:2598
-A snt_dnat -d 1.1.1.32/32 -p udp -m udp --dport 2598 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.11:2598
-A snt_dnat -d 1.1.1.32/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.11
-A snt_dnat -d 1.1.1.208/32 -p tcp -m tcp --dport 21 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.49
-A snt_dnat -d 1.1.1.208/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.49
-A snt_dnat -d 1.1.1.208/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.49
-A snt_dnat -d 1.1.1.204/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.39
-A snt_dnat -d 1.1.1.204/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.39
-A snt_dnat -d 1.1.1.208/32 -p tcp -m tcp --dport 442 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.49:442
-A snt_dnat -d 1.1.1.50/32 -p tcp -m tcp --dport 22 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.205
-A snt_dnat -d 1.1.1.45/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.111.183
-A snt_dnat -d 1.1.1.46/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.238
-A snt_dnat -d 1.1.1.46/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.238
-A snt_dnat -d 1.1.1.47/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.231
-A snt_dnat -d 1.1.1.47/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.231
-A snt_dnat -d 1.1.1.51/32 -p tcp -m tcp --dport 443 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.226
-A snt_dnat -d 1.1.1.51/32 -p tcp -m tcp --dport 80 -m comment --comment "Port forwarding" -j DNAT --to-destination 10.11.110.226
-A vlan2121_masq -s 10.11.109.45/32 -j SNAT --to-source 1.1.1.41
-A vlan2121_masq -s 10.11.113.94/32 -j SNAT --to-source 1.1.1.41
-A vlan2121_masq -s 10.11.110.14/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.110.9/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.110.111/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.110.26/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.110.170/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.110.6/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.110.107/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.110.91/32 -j SNAT --to-source 1.1.1.40
-A vlan2121_masq -s 10.11.110.93/32 -j SNAT --to-source 1.1.1.41
-A vlan2121_masq -s 10.11.110.226/32 -j SNAT --to-source 1.1.1.51
-A vlan2121_masq -s 10.11.110.145/32 -j SNAT --to-source 1.1.1.39
-A vlan2121_masq -s 10.11.110.39/32 -j SNAT --to-source 1.1.1.204
-A vlan2121_masq -s 10.11.110.205/32 -j SNAT --to-source 1.1.1.50
-A vlan2121_masq -s 10.11.110.122/32 -j SNAT --to-source 1.1.1.43
-A vlan2121_masq -s 10.11.110.231/32 -j SNAT --to-source 1.1.1.47
-A vlan2121_masq -s 10.11.110.148/32 -j SNAT --to-source 1.1.1.35
-A vlan2121_masq -s 10.11.110.17/32 -j SNAT --to-source 1.1.1.31
-A vlan2121_masq -s 10.11.110.49/32 -j SNAT --to-source 1.1.1.208
-A vlan2121_masq -s 10.11.110.94/32 -j SNAT --to-source 1.1.1.208
-A vlan2121_masq -s 10.11.110.72/32 -j SNAT --to-source 1.1.1.208
-A vlan2121_masq -s 10.11.110.60/32 -j SNAT --to-source 1.1.1.33
-A vlan2121_masq -s 10.11.110.238/32 -j SNAT --to-source 1.1.1.46
-A vlan2121_masq -s 10.11.110.46/32 -j SNAT --to-source 1.1.1.44
-A vlan2121_masq -s 10.11.110.57/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.110.87/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.108.20/32 -j SNAT --to-source 1.1.1.40
-A vlan2121_masq -s 10.11.108.21/32 -j SNAT --to-source 1.1.1.41
-A vlan2121_masq -s 10.11.110.248/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.119.200/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.110.27/32 -j SNAT --to-source 1.1.1.7
-A vlan2121_masq -s 10.11.110.251/32 -j SNAT --to-source 1.1.1.34
-A vlan2121_masq -s 10.11.110.252/32 -j SNAT --to-source 1.1.1.40
-A vlan2121_masq -s 10.11.110.83/32 -j SNAT --to-source 1.1.1.36
-A vlan2121_masq -s 10.11.110.28/32 -j SNAT --to-source 1.1.1.41
-A vlan2121_masq -s 10.11.108.251/32 -j SNAT --to-source 1.1.1.7
COMMIT
# Completed on Tue Nov 13 16:34:22 2012
# Generated by iptables-save v1.4.12 on Tue Nov 13 16:34:22 2012
*mangle
:PREROUTING ACCEPT [155706:118222677]
:INPUT ACCEPT [10907:982470]
:FORWARD ACCEPT [144705:117227189]
:OUTPUT ACCEPT [754:65149]
:POSTROUTING ACCEPT [145459:117292338]
:tcfor - [0:0]
:tcin - [0:0]
:tcout - [0:0]
:tcpost - [0:0]
:tcpre - [0:0]
-A PREROUTING -j tcpre
-A INPUT -j tcin
-A FORWARD -j MARK --set-xmark 0x0/0xff
-A FORWARD -j tcfor
-A OUTPUT -j tcout
-A POSTROUTING -j tcpost
COMMIT
# Completed on Tue Nov 13 16:34:22 2012
# Generated by iptables-save v1.4.12 on Tue Nov 13 16:34:22 2012
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:Broadcast - [0:0]
:Drop - [0:0]
:Invalid - [0:0]
:NotSyn - [0:0]
:Reject - [0:0]
:dynamic - [0:0]
:fw2loc - [0:0]
:fw2nk2 - [0:0]
:fw2nk - [0:0]
:fw2snt - [0:0]
:loc2fw - [0:0]
:loc2nk2 - [0:0]
:loc2nk - [0:0]
:loc2snt - [0:0]
:loc_frwd - [0:0]
:logdrop - [0:0]
:logflags - [0:0]
:logreject - [0:0]
:nk22fw - [0:0]
:nk22loc - [0:0]
:nk22nk - [0:0]
:nk22snt - [0:0]
:nk2_frwd - [0:0]
:nk2fw - [0:0]
:nk2loc - [0:0]
:nk2nk2 - [0:0]
:nk2snt - [0:0]
:nk_frwd - [0:0]
:reject - [0:0]
:shorewall - [0:0]
:smurflog - [0:0]
:smurfs - [0:0]
:snt2fw - [0:0]
:snt2loc - [0:0]
:snt2nk2 - [0:0]
:snt2nk - [0:0]
:snt_frwd - [0:0]
:tcpflags - [0:0]
-A INPUT -m conntrack --ctstate INVALID,NEW -j dynamic
-A INPUT -i vlan3210 -j nk2fw
-A INPUT -i vlan1256 -j nk22fw
-A INPUT -i vlan2121 -j snt2fw
-A INPUT -i vlan1 -j loc2fw
-A INPUT -i lo -j ACCEPT
-A INPUT -j Drop
-A INPUT -j LOG --log-prefix "Shorewall:INPUT:DROP:" --log-level 6
-A INPUT -j DROP
-A FORWARD -i vlan3210 -j nk_frwd
-A FORWARD -i vlan1256 -j nk2_frwd
-A FORWARD -i vlan2121 -j snt_frwd
-A FORWARD -i vlan1 -j loc_frwd
-A FORWARD -j Drop
-A FORWARD -j LOG --log-prefix "Shorewall:FORWARD:DROP:" --log-level 6
-A FORWARD -j DROP
-A OUTPUT -o vlan3210 -j fw2nk
-A OUTPUT -o vlan1256 -j fw2nk2
-A OUTPUT -o vlan2121 -j fw2snt
-A OUTPUT -o vlan1 -j fw2loc
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j ACCEPT
-A Broadcast -m addrtype --dst-type BROADCAST -j DROP
-A Broadcast -m addrtype --dst-type MULTICAST -j DROP
-A Broadcast -m addrtype --dst-type ANYCAST -j DROP
-A Broadcast -d 224.0.0.0/4 -j DROP
-A Drop
-A Drop -p tcp -m tcp --dport 113 -m comment --comment Auth -j reject
-A Drop -j Broadcast
-A Drop -p icmp -m icmp --icmp-type 3/4 -m comment --comment "Needed ICMP types" -j ACCEPT
-A Drop -p icmp -m icmp --icmp-type 11 -m comment --comment "Needed ICMP types" -j ACCEPT
-A Drop -j Invalid
-A Drop -p udp -m multiport --dports 135,445 -m comment --comment SMB -j DROP
-A Drop -p udp -m udp --dport 137:139 -m comment --comment SMB -j DROP
-A Drop -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment SMB -j DROP
-A Drop -p tcp -m multiport --dports 135,139,445 -m comment --comment SMB -j DROP
-A Drop -p udp -m udp --dport 1900 -m comment --comment UPnP -j DROP
-A Drop -p tcp -j NotSyn
-A Drop -p udp -m udp --sport 53 -m comment --comment "Late DNS Replies" -j DROP
-A Invalid -m conntrack --ctstate INVALID -j DROP
-A NotSyn -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A Reject
-A Reject -p tcp -m tcp --dport 113 -m comment --comment Auth -j reject
-A Reject -j Broadcast
-A Reject -p icmp -m icmp --icmp-type 3/4 -m comment --comment "Needed ICMP types" -j ACCEPT
-A Reject -p icmp -m icmp --icmp-type 11 -m comment --comment "Needed ICMP types" -j ACCEPT
-A Reject -j Invalid
-A Reject -p udp -m multiport --dports 135,445 -m comment --comment SMB -j reject
-A Reject -p udp -m udp --dport 137:139 -m comment --comment SMB -j reject
-A Reject -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment SMB -j reject
-A Reject -p tcp -m multiport --dports 135,139,445 -m comment --comment SMB -j reject
-A Reject -p udp -m udp --dport 1900 -m comment --comment UPnP -j DROP
-A Reject -p tcp -j NotSyn
-A Reject -p udp -m udp --sport 53 -m comment --comment "Late DNS Replies" -j DROP
-A fw2loc -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A fw2loc -j ACCEPT
-A fw2nk2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A fw2nk2 -j ACCEPT
-A fw2nk -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A fw2nk -j ACCEPT
-A fw2snt -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A fw2snt -j ACCEPT
-A loc2fw -m conntrack --ctstate INVALID,NEW -j dynamic
-A loc2fw -m conntrack --ctstate INVALID,NEW -j smurfs
-A loc2fw -p tcp -j tcpflags
-A loc2fw -p tcp -m tcp --dport 22 -m comment --comment SSH -j ACCEPT
-A loc2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A loc2fw -j ACCEPT
-A loc2nk2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A loc2nk2 -j ACCEPT
-A loc2nk -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A loc2nk -j Drop
-A loc2nk -j LOG --log-prefix "Shorewall:loc2nk:DROP:" --log-level 6
-A loc2nk -j DROP
-A loc2snt -s 10.11.110.60/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.9/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.17/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.145/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.148/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.251/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.252/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.28/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.87/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.119.200/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.83/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.248/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.108.21/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.108.20/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.91/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.93/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.122/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.109.44/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.112.134/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.109.45/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.14/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.111/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.26/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.46/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.113.94/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.205/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.170/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.57/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.49/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.72/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.94/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.6/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.107/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.39/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.111.183/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.238/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.231/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.110.226/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -s 10.11.108.251/32 -m comment --comment "Access from localnet to snt" -j ACCEPT
-A loc2snt -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A loc2snt -j ACCEPT
-A loc_frwd -m conntrack --ctstate INVALID,NEW -j dynamic
-A loc_frwd -m conntrack --ctstate INVALID,NEW -j smurfs
-A loc_frwd -p tcp -j tcpflags
-A loc_frwd -o vlan3210 -j loc2nk
-A loc_frwd -o vlan1256 -j loc2nk2
-A loc_frwd -o vlan2121 -j loc2snt
-A logdrop -j DROP
-A logflags -j LOG --log-prefix "Shorewall:logflags:DROP:" --log-level 6 --log-ip-options
-A logflags -j DROP
-A logreject -j reject
-A nk22fw -m conntrack --ctstate INVALID,NEW -j dynamic
-A nk22fw -m conntrack --ctstate INVALID,NEW -j smurfs
-A nk22fw -p tcp -j tcpflags
-A nk22fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A nk22fw -j ACCEPT
-A nk22loc -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A nk22loc -j Reject
-A nk22loc -j LOG --log-prefix "Shorewall:nk22loc:REJECT:" --log-level 6
-A nk22loc -g reject
-A nk22nk -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A nk22nk -j Drop
-A nk22nk -j LOG --log-prefix "Shorewall:nk22nk:DROP:" --log-level 6
-A nk22nk -j DROP
-A nk22snt -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A nk22snt -j Reject
-A nk22snt -j LOG --log-prefix "Shorewall:nk22snt:REJECT:" --log-level 6
-A nk22snt -g reject
-A nk2_frwd -m conntrack --ctstate INVALID,NEW -j dynamic
-A nk2_frwd -m conntrack --ctstate INVALID,NEW -j smurfs
-A nk2_frwd -p tcp -j tcpflags
-A nk2_frwd -o vlan3210 -j nk22nk
-A nk2_frwd -o vlan2121 -j nk22snt
-A nk2_frwd -o vlan1 -j nk22loc
-A nk2fw -m conntrack --ctstate INVALID,NEW -j dynamic
-A nk2fw -m conntrack --ctstate INVALID,NEW -j smurfs
-A nk2fw -p tcp -j tcpflags
-A nk2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A nk2fw -j Drop
-A nk2fw -j LOG --log-prefix "Shorewall:nk2fw:DROP:" --log-level 6
-A nk2fw -j DROP
-A nk2loc -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A nk2loc -j Drop
-A nk2loc -j LOG --log-prefix "Shorewall:nk2loc:DROP:" --log-level 6
-A nk2loc -j DROP
-A nk2nk2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A nk2nk2 -j Drop
-A nk2nk2 -j LOG --log-prefix "Shorewall:nk2nk2:DROP:" --log-level 6
-A nk2nk2 -j DROP
-A nk2snt -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A nk2snt -j Drop
-A nk2snt -j LOG --log-prefix "Shorewall:nk2snt:DROP:" --log-level 6
-A nk2snt -j DROP
-A nk_frwd -m conntrack --ctstate INVALID,NEW -j dynamic
-A nk_frwd -m conntrack --ctstate INVALID,NEW -j smurfs
-A nk_frwd -p tcp -j tcpflags
-A nk_frwd -o vlan1256 -j nk2nk2
-A nk_frwd -o vlan2121 -j nk2snt
-A nk_frwd -o vlan1 -j nk2loc
-A reject -m addrtype --src-type BROADCAST -j DROP
-A reject -s 224.0.0.0/4 -j DROP
-A reject -p igmp -j DROP
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A reject -j REJECT --reject-with icmp-host-prohibited
-A smurflog -j LOG --log-prefix "Shorewall:smurfs:DROP:" --log-level 6
-A smurflog -j DROP
-A smurfs -s 0.0.0.0/32 -j RETURN
-A smurfs -m addrtype --src-type BROADCAST -g smurflog
-A smurfs -s 224.0.0.0/4 -g smurflog
-A snt2fw -m conntrack --ctstate INVALID,NEW -j dynamic
-A snt2fw -m conntrack --ctstate INVALID,NEW -j smurfs
-A snt2fw -p tcp -j tcpflags
-A snt2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A snt2fw -j ACCEPT
-A snt2loc -d 10.11.110.60/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.9/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.17/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.145/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.148/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.251/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.252/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.28/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.87/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.119.200/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.83/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.248/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.108.21/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.108.20/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.91/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.93/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.122/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.109.44/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.112.134/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.109.45/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.14/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.111/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.26/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.46/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.113.94/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.205/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.170/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.57/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.49/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.72/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.94/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.6/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.107/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.39/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.111.183/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.238/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.231/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.110.226/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -d 10.11.108.251/32 -m comment --comment "Access from snt to localnet" -j ACCEPT
-A snt2loc -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A snt2loc -d 10.11.110.60/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.33 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.60/32 -p tcp -m tcp --dport 81 -m conntrack --ctorigdstport 80 -m conntrack --ctorigdst 1.1.1.33 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.60/32 -p tcp -m tcp --dport 21 -m conntrack --ctorigdst 1.1.1.33 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.17/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.31 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.17/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.31 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.148/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.35 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.148/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.35 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.145/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.39 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.145/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.39 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.252/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.40 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.252/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.40 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.251/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.34 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.251/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.34 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.28/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.41 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.27/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.7 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.87/32 -p tcp -m tcp --dport 6661 -m conntrack --ctorigdst 1.1.1.7 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.119.200/32 -p tcp -m tcp --dport 3390 -m conntrack --ctorigdst 1.1.1.7 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.83/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.36 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.83/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.36 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.248/32 -p tcp -m tcp --dport 3389 -m conntrack --ctorigdst 1.1.1.7 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.108.21/32 -p tcp -m tcp --dport 3389 -m conntrack --ctorigdstport 6969 -m conntrack --ctorigdst 1.1.1.41 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.108.20/32 -p tcp -m tcp --dport 3389 -m conntrack --ctorigdstport 6969 -m conntrack --ctorigdst 1.1.1.40 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.91/32 -p tcp -m tcp --dport 23 -m conntrack --ctorigdst 1.1.1.40 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.91/32 -p tcp -m tcp --dport 21 -m conntrack --ctorigdst 1.1.1.40 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.91/32 -p tcp -m tcp --dport 4000 -m conntrack --ctorigdstport 4000 -m conntrack --ctorigdst 1.1.1.40 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.93/32 -p tcp -m tcp --dport 23 -m conntrack --ctorigdst 1.1.1.41 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.93/32 -p tcp -m tcp --dport 21 -m conntrack --ctorigdst 1.1.1.41 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.93/32 -p tcp -m tcp --dport 4000 -m conntrack --ctorigdstport 4000 -m conntrack --ctorigdst 1.1.1.41 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.122/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.43 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.122/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.43 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.46/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.44 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.46/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.44 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.46/32 -p tcp -m tcp --dport 21 -m conntrack --ctorigdst 1.1.1.44 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.46/32 -p tcp -m tcp --dport 81 -m conntrack --ctorigdstport 81 -m conntrack --ctorigdst 1.1.1.44 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.46/32 -p tcp -m tcp --dport 444 -m conntrack --ctorigdstport 444 -m conntrack --ctorigdst 1.1.1.44 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.46/32 -p tcp -m tcp --dport 8000 -m conntrack --ctorigdstport 8000 -m conntrack --ctorigdst 1.1.1.44 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.115/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.42 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.115/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.42 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.11/32 -p tcp -m tcp --dport 1494 -m conntrack --ctorigdstport 1494 -m conntrack --ctorigdst 1.1.1.32 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.11/32 -p udp -m udp --dport 1494 -m conntrack --ctorigdstport 1494 -m conntrack --ctorigdst 1.1.1.32 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.11/32 -p tcp -m tcp --dport 2598 -m conntrack --ctorigdstport 2598 -m conntrack --ctorigdst 1.1.1.32 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.11/32 -p udp -m udp --dport 2598 -m conntrack --ctorigdstport 2598 -m conntrack --ctorigdst 1.1.1.32 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.11/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.32 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.49/32 -p tcp -m tcp --dport 21 -m conntrack --ctorigdst 1.1.1.208 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.49/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.208 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.49/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.208 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.39/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.204 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.39/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.204 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.49/32 -p tcp -m tcp --dport 442 -m conntrack --ctorigdstport 442 -m conntrack --ctorigdst 1.1.1.208 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.205/32 -p tcp -m tcp --dport 22 -m conntrack --ctorigdst 1.1.1.50 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.111.183/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.45 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.238/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.46 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.238/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.46 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.231/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.47 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.231/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.47 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.226/32 -p tcp -m tcp --dport 443 -m conntrack --ctorigdst 1.1.1.51 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -d 10.11.110.226/32 -p tcp -m tcp --dport 80 -m conntrack --ctorigdst 1.1.1.51 -m comment --comment "Port forwarding" -j ACCEPT
-A snt2loc -j Reject
-A snt2loc -j LOG --log-prefix "Shorewall:snt2loc:REJECT:" --log-level 6
-A snt2loc -g reject
-A snt2nk2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A snt2nk2 -j Reject
-A snt2nk2 -j LOG --log-prefix "Shorewall:snt2nk2:REJECT:" --log-level 6
-A snt2nk2 -g reject
-A snt2nk -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A snt2nk -j Drop
-A snt2nk -j LOG --log-prefix "Shorewall:snt2nk:DROP:" --log-level 6
-A snt2nk -j DROP
-A snt_frwd -m conntrack --ctstate INVALID,NEW -j dynamic
-A snt_frwd -m conntrack --ctstate INVALID,NEW -j smurfs
-A snt_frwd -p tcp -j tcpflags
-A snt_frwd -o vlan3210 -j snt2nk
-A snt_frwd -o vlan1256 -j snt2nk2
-A snt_frwd -o vlan1 -j snt2loc
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g logflags
-A tcpflags -p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g logflags
COMMIT
# Completed on Tue Nov 13 16:34:22 2012