projects
/
lab.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
* Dev for wiki:Dev
[lab.git]
/
iptables
/
ufw
/
after.rules
diff --git
a/iptables/ufw/after.rules
b/iptables/ufw/after.rules
index
70b5624
..
f98d8f1
100644
(file)
--- a/
iptables/ufw/after.rules
+++ b/
iptables/ufw/after.rules
@@
-15,6
+15,12
@@
:ufw-after-forward - [0:0]
# End required lines
:ufw-after-forward - [0:0]
# End required lines
+## allow connections to the local services from WAN
+# ssh 22/tcp
+-A ufw-after-input -p tcp --syn -m state --state NEW --dport 22 -j ACCEPT
+# https 443/tcp
+-A ufw-after-input -p tcp --syn -m state --state NEW --dport 443 -j ACCEPT
+
# don't log noisy services by default
-A ufw-after-input -p udp --dport 137 -j RETURN
-A ufw-after-input -p udp --dport 138 -j RETURN
# don't log noisy services by default
-A ufw-after-input -p udp --dport 137 -j RETURN
-A ufw-after-input -p udp --dport 138 -j RETURN
@@
-24,8
+30,8
@@
-A ufw-after-input -p udp --dport 68 -j RETURN
# catchall for logging
-A ufw-after-input -p udp --dport 68 -j RETURN
# catchall for logging
--A ufw-after-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK INPUT]: "
--A ufw-after-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK FORWARD]: "
+-A ufw-after-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK INPUT]: " --log-level err
+-A ufw-after-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK FORWARD]: " --log-level err
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT