source: lab.git/iptables/ufw/before.rules @ ab902ad

trunk
Last change on this file since ab902ad was ab902ad, checked in by mitty <mitty@…>, 15 years ago
  • original rules from /etc/ufw/*.rules

git-svn-id: https://lab.mitty.jp/svn/lab/trunk@11 7d2118f6-f56c-43e7-95a2-4bb3031d96e7

  • Property mode set to 100644
File size: 2.1 KB
Line 
1#
2# rules.before
3#
4# Rules that should be run before the ufw command line added rules. Custom
5# rules should be added to one of these chains:
6#   ufw-before-input
7#   ufw-before-output
8#   ufw-before-forward
9#
10
11# Don't delete these required lines, otherwise there will be errors
12*filter
13:ufw-before-input - [0:0]
14:ufw-before-output - [0:0]
15:ufw-before-forward - [0:0]
16:ufw-not-local - [0:0]
17# End required lines
18
19
20# allow all on loopback
21-A ufw-before-input -i lo -j ACCEPT
22-A ufw-before-output -i lo -j ACCEPT
23
24# connection tracking rules
25-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
26
27# drop INVALID packets
28# uncomment to log INVALID packets
29#-A ufw-before-input -m conntrack --ctstate INVALID -j LOG --log-prefix "[UFW BLOCK INVALID]: "
30-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
31
32# connection tracking for outbound
33-A ufw-before-output -p tcp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
34-A ufw-before-output -p udp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
35
36# ok icmp codes
37-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
38-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
39-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
40-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
41-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
42
43# allow dhcp client to work
44-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT
45
46#
47# ufw-not-local
48#
49-A ufw-before-input -j ufw-not-local
50
51# if LOCAL, RETURN
52-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
53
54# if MULTICAST, RETURN
55-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
56
57# if BROADCAST, RETURN
58-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
59
60-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK NOT-TO-ME]: "
61
62# all other non-local packets are dropped
63-A ufw-not-local -j DROP
64
65# allow MULTICAST, be sure the MULTICAST line above is uncommented
66-A ufw-before-input -s 224.0.0.0/4 -j ACCEPT
67-A ufw-before-input -d 224.0.0.0/4 -j ACCEPT
68
69
70# don't delete the 'COMMIT' line or these rules won't be processed
71COMMIT
Note: See TracBrowser for help on using the repository browser.