@include 'conf.d/';
-domain ip {
- table filter {
- chain log_and_reject {
- ULOG ulog-prefix "REJECT: ";
- proto tcp REJECT reject-with tcp-reset;
- REJECT;
- }
-
- chain log_or_drop {
- mod hashlimit hashlimit-name ulogreject hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject;
- mod hashlimit hashlimit-name uloglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second ULOG ulog-prefix "DROP: ";
- DROP;
- }
-
- }
-}
-domain ip6 {
- table filter {
- chain log_and_reject {
- LOG log-prefix "REJECT: ";
- proto tcp REJECT reject-with tcp-reset;
- REJECT;
- }
-
- chain log_or_drop {
- mod hashlimit hashlimit-name logreject hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject;
- mod hashlimit hashlimit-name loglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second LOG log-prefix "DROP: ";
- DROP;
- }
- }
-}
-domain (ip ip6) {
- table filter {
- chain INPUT {
- policy DROP;
- mod state state (ESTABLISHED RELATED) ACCEPT;
- interface lo ACCEPT;
- proto icmp ACCEPT;
- mod state state (INVALID) DROP;
- }
- }
-}
-
@include 'dsa.d/';
domain (ip ip6) {
chain INPUT {
+ proto (tcp udp) mod multiport destination-ports (135 137 138 139 445 1026 1027 1433) DROP;
jump log_or_drop;
}
}
+
+@hook pre "umask 0177; rm -f /var/run/iptables-ferm.checksum /var/run/ip6tables-ferm.checksum";
+@hook post "umask 0177; iptables-save | sed -e 's/\[.*//' -e 's/^#.*//' | sha256sum > /var/run/iptables-ferm.checksum";
+@hook post "umask 0177; ip6tables-save | sed -e 's/\[.*//' -e 's/^#.*//' | sha256sum > /var/run/ip6tables-ferm.checksum";
+# vim:set et: