# Generated by iptables-save v1.4.12 on Tue Nov 26 19:57:04 2013
    *filter
    :INPUT DROP [624:55836]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    :FILETRANSFER - [0:0]
    :OPENVPN - [0:0]
    :SPAMMERS - [0:0]
    :SSH-ALL - [0:0]
    :SSH-BLOCKED - [0:0]
    :TRUSTFORWARDS - [0:0]
    :TRUSTIN-OUTPUT - [0:0]
    :TRUSTIN-UDP - [0:0]
    -A INPUT -m state --state INVALID -j DROP
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -i br1 -j ACCEPT
    -A INPUT -i tap0 -j ACCEPT
    -A INPUT -m set --match-set trustin src -j ACCEPT
    -A INPUT -m set --match-set blackhole src -j DROP
    -A INPUT -i br1 -j ACCEPT
    -A INPUT -m set --match-set spammers src -j SPAMMERS
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -p udp -m udp --dport 500 -j ACCEPT
    -A INPUT -p esp -j ULOG --ulog-prefix "IPSec connection event: "
    -A INPUT -p ah -j ULOG --ulog-prefix "IPSec connection event: "
    -A INPUT -p esp -j ACCEPT
    -A INPUT -p ah -j ACCEPT
    -A INPUT -p tcp -m tcp --dport 22 -j SSH-ALL
    -A INPUT -p tcp -m tcp --dport 1194 -j OPENVPN
    -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
    -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
    -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
    -A INPUT -p tcp -m tcp --dport 67 -j ACCEPT
    -A INPUT -p tcp -m tcp --dport XXXX -j ACCEPT
    -A INPUT -p tcp -m tcp --dport XXXX -j ACCEPT
    -A INPUT -p tcp -m set --match-set filenet src -j FILETRANSFER
    -A INPUT -p tcp -m tcp --sport 389 -j ACCEPT
    -A INPUT -p tcp -m tcp --sport 636 -j ACCEPT
    -A INPUT -p tcp -m set --match-set proxies src -j ACCEPT
    -A INPUT -p udp -m udp --sport 53 -j ACCEPT
    -A INPUT -p udp -m udp --sport 67 -j ACCEPT
    -A INPUT -p udp -m udp --dport 53 -j ACCEPT
    -A INPUT -p udp -m udp --dport 67 -j ACCEPT
    -A INPUT -p udp -m set --match-set trustout dst -j TRUSTIN-UDP
    -A FORWARD -m state --state INVALID -j DROP
    -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -m set --match-set trustin src -j ACCEPT
    -A FORWARD -m set --match-set trustout dst -j ACCEPT
    -A FORWARD -m set --match-set trustout src -j ACCEPT
    -A FORWARD -m set --match-set trustforward src -j TRUSTFORWARDS
    -A FORWARD -p tcp -m set --match-set proxies src -j ACCEPT
    -A FORWARD -p tcp -m set --match-set proxies dst -j ACCEPT
    -A FORWARD -p tcp -j RETURN
    -A FORWARD -p udp -m udp --sport 53 -j ACCEPT
    -A FORWARD -p udp -m udp --sport 67 -j ACCEPT
    -A FORWARD -p udp -m udp --dport 53 -j ACCEPT
    -A FORWARD -p udp -m udp --dport 67 -j ACCEPT
    -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A OUTPUT -m set --match-set trustout src -j ACCEPT
    -A OUTPUT -m set --match-set trustin src -j TRUSTIN-OUTPUT
    -A OUTPUT -m set --match-set trustout dst -j ACCEPT
    -A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
    -A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
    -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
    -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
    -A OUTPUT -p tcp -m tcp --dport 389 -j ACCEPT
    -A OUTPUT -p tcp -m tcp --dport 636 -j ACCEPT
    -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
    -A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT
    -A OUTPUT -p tcp -m tcp --sport 443 -j ACCEPT
    -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
    -A OUTPUT -p udp -m udp --dport 67 -j ACCEPT
    -A FILETRANSFER -p tcp -m set --match-set fileport dst -j ACCEPT
    -A FILETRANSFER -p tcp -j RETURN
    -A OPENVPN -p tcp -j ULOG --ulog-prefix "OpenVPN Event per rule 138: "
    -A OPENVPN -p tcp -j ACCEPT
    -A SPAMMERS -j ULOG --ulog-prefix "Blocked-IP per rule 109: "
    -A SPAMMERS -j SET --add-set blackhole src
    -A SPAMMERS -j DROP
    -A SSH-ALL -p tcp -m recent --set --name SSH --rsource
    -A SSH-ALL -p tcp -m recent --update --seconds 180 --hitcount 8 --name SSH --rsource -j SSH-BLOCKED
    -A SSH-ALL -p tcp -j ACCEPT
    -A SSH-BLOCKED -p tcp -j ULOG --ulog-prefix "Blocked-ssh per rule 130: "
    -A SSH-BLOCKED -p tcp -j SET --add-set blackhole src
    -A SSH-BLOCKED -p tcp -j DROP
    -A TRUSTFORWARDS -m set --match-set trustforward dst -j ACCEPT
    -A TRUSTFORWARDS -j RETURN
    -A TRUSTIN-OUTPUT -m set --match-set trustout dst -j ACCEPT
    -A TRUSTIN-OUTPUT -j RETURN
    -A TRUSTIN-UDP -p udp -m set --match-set fileport src -j ACCEPT
    -A TRUSTIN-UDP -p udp -j RETURN
    COMMIT
    # Completed on Tue Nov 26 19:57:04 2013
    # Generated by iptables-save v1.4.12 on Tue Nov 26 19:57:04 2013
    *nat
    :PREROUTING ACCEPT [1408:137513]
    :INPUT ACCEPT [195:12332]
    :OUTPUT ACCEPT [134:8355]
    :POSTROUTING ACCEPT [133:9134]
    -A PREROUTING -i eth0 -p tcp -m tcp --dport XXXX -j DNAT --to-destination 192.168.1.3:22
    -A PREROUTING -i eth0 -p tcp -m tcp --dport XXXX -j DNAT --to-destination 192.168.1.4:22
    -A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.121.7:443
    -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.121.7:80
    -A POSTROUTING -p tcp -m tcp --dport 22 -j MASQUERADE
    -A POSTROUTING -p tcp -m tcp --dport 80 -j MASQUERADE
    -A POSTROUTING -p tcp -m tcp --dport 443 -j MASQUERADE
    -A POSTROUTING -s 192.168.1.0/24 ! -d 192.168.1.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
    -A POSTROUTING -s 192.168.1.0/24 ! -d 192.168.1.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
    -A POSTROUTING -s 192.168.1.0/24 ! -d 192.168.1.0/24 -j MASQUERADE
    -A POSTROUTING -o tap0 -j MASQUERADE
    COMMIT
    # Completed on Tue Nov 26 19:57:04 2013
    # Generated by iptables-save v1.4.12 on Tue Nov 26 19:57:04 2013
    *mangle
    :PREROUTING ACCEPT [21652:26968794]
    :INPUT ACCEPT [17965:26091140]
    :FORWARD ACCEPT [3815:890854]
    :OUTPUT ACCEPT [10579:767130]
    :POSTROUTING ACCEPT [14388:1657412]
    COMMIT
    # Completed on Tue Nov 26 19:57:04 2013