# iptables-save
# Generated by iptables-save v1.4.21 on Tue Dec 15 14:16:02 2020
*raw
:PREROUTING ACCEPT [3241550:296639320]
:OUTPUT ACCEPT [2792310:633689464]
COMMIT
# Completed on Tue Dec 15 14:16:02 2020
# Generated by iptables-save v1.4.21 on Tue Dec 15 14:16:02 2020
*mangle
:PREROUTING ACCEPT [5132256:516727787]
:INPUT ACCEPT [4651875:489513799]
:FORWARD ACCEPT [480381:27213988]
:OUTPUT ACCEPT [4406321:974321357]
:POSTROUTING ACCEPT [4886702:1001535345]
COMMIT
# Completed on Tue Dec 15 14:16:02 2020
# Generated by iptables-save v1.4.21 on Tue Dec 15 14:16:02 2020
*nat
:PREROUTING ACCEPT [84188:5503273]
:INPUT ACCEPT [81873:5216554]
:OUTPUT ACCEPT [218497:14564425]
:POSTROUTING ACCEPT [218542:14567125]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.21.0.0/16 ! -o br-d6ff259af253 -j MASQUERADE
-A POSTROUTING -s 172.18.0.0/16 ! -o docker_gwbridge -j MASQUERADE
-A POSTROUTING -s 172.21.0.2/32 -d 172.21.0.2/32 -p tcp -m tcp --dport 15672 -j MASQUERADE
-A POSTROUTING -s 172.21.0.2/32 -d 172.21.0.2/32 -p tcp -m tcp --dport 5672 -j MASQUERADE
-A POSTROUTING -s 172.21.0.6/32 -d 172.21.0.6/32 -p tcp -m tcp --dport 8000 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A DOCKER -i br-d6ff259af253 -j RETURN
-A DOCKER -i docker_gwbridge -j RETURN
-A DOCKER ! -i br-d6ff259af253 -p tcp -m tcp --dport 15672 -j DNAT --to-destination 172.21.0.2:15672
-A DOCKER ! -i br-d6ff259af253 -p tcp -m tcp --dport 5672 -j DNAT --to-destination 172.21.0.2:5672
-A DOCKER ! -i br-d6ff259af253 -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.21.0.6:8000
COMMIT
# Completed on Tue Dec 15 14:16:02 2020
# Generated by iptables-save v1.4.21 on Tue Dec 15 14:16:02 2020
*filter
:INPUT ACCEPT [104606:9457902]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [95662:22649271]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
:vnetchain - [0:0]
-A INPUT -i lo -p udp -m comment --comment AppDefense_Iptable_rules -j ACCEPT
-A INPUT -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG SYN -m mark ! --mark 0x7e/0xfe -m comment --comment AppDefense_Iptable_rules -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -m conntrack --ctstate ESTABLISHED -m mark ! --mark 0x1/0x1 -m comment --comment AppDefense_Iptable_rules -j NFQUEUE --queue-num 0 --queue-bypass
-A INPUT -p udp -m conntrack --ctstate NEW -m mark ! --mark 0x1/0x1 -m comment --comment AppDefense_Iptable_rules -j NFQUEUE --queue-num 0 --queue-bypass
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG SYN -m mark ! --mark 0x1/0x1 -m comment --comment AppDefense_Iptable_rules -j NFQUEUE --queue-num 0 --queue-bypass
-A INPUT -p tcp -m mark ! --mark 0x1/0x1 -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK SYN -j vnetchain
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-d6ff259af253 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-d6ff259af253 -j DOCKER
-A FORWARD -i br-d6ff259af253 ! -o br-d6ff259af253 -j ACCEPT
-A FORWARD -i br-d6ff259af253 -o br-d6ff259af253 -j ACCEPT
-A FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker_gwbridge -j DOCKER
-A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT
-A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP
-A OUTPUT -o lo -p udp -m comment --comment AppDefense_Iptable_rules -j ACCEPT
-A OUTPUT -o lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG SYN -m comment --comment AppDefense_Iptable_rules -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m comment --comment AppDefense_Iptable_rules -j ACCEPT
-A OUTPUT -p udp -m conntrack --ctstate NEW -m mark ! --mark 0x1/0x1 -m comment --comment AppDefense_Iptable_rules -j NFQUEUE --queue-num 0 --queue-bypass
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG SYN -m mark ! --mark 0x1/0x1 -m comment --comment AppDefense_Iptable_rules -j NFQUEUE --queue-num 0 --queue-bypass
-A OUTPUT -p tcp -m mark ! --mark 0x1/0x1 -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK SYN -j vnetchain
-A DOCKER -d 172.21.0.2/32 ! -i br-d6ff259af253 -o br-d6ff259af253 -p tcp -m tcp --dport 15672 -j ACCEPT
-A DOCKER -d 172.21.0.2/32 ! -i br-d6ff259af253 -o br-d6ff259af253 -p tcp -m tcp --dport 5672 -j ACCEPT
-A DOCKER -d 172.21.0.6/32 ! -i br-d6ff259af253 -o br-d6ff259af253 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-d6ff259af253 ! -o br-d6ff259af253 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i docker_gwbridge ! -o docker_gwbridge -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-d6ff259af253 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker_gwbridge -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
-A vnetchain -j NFQUEUE --queue-num 0 --queue-bypass
COMMIT
# Completed on Tue Dec 15 14:16:02 2020