# Generated by iptables-save v1.4.12 on Thu Jul 11 09:59:51 2013
*mangle
:PREROUTING ACCEPT [194658:65532093]
:INPUT ACCEPT [194215:65407903]
:FORWARD ACCEPT [443:124190]
:OUTPUT ACCEPT [207778:82483803]
:POSTROUTING ACCEPT [208221:82607993]
COMMIT
# Completed on Thu Jul 11 09:59:51 2013
# Generated by iptables-save v1.4.12 on Thu Jul 11 09:59:51 2013
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i lxcbr0 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -p ah -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lxcbr0 -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Thu Jul 11 09:59:51 2013
# Generated by iptables-save v1.4.12 on Thu Jul 11 09:59:51 2013
*nat
:PREROUTING ACCEPT [32:1974]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.255.255.0/24 ! -d 192.255.255.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.255.255.0/24 ! -d 192.255.255.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.255.255.0/24 ! -d 192.255.255.0/24 -j MASQUERADE
COMMIT
# Completed on Thu Jul 11 09:59:51 2013

# -*- shell-script -*-
#
#  Configuration file for ferm(1).
#

table nat {
    chain ( PREROUTING INPUT OUTPUT ) { policy ACCEPT; }
    chain POSTROUTING {
        policy ACCEPT;
        proto ( tcp udp ) {
            saddr 192.255.255.0/24 daddr ! 192.255.255.0/24 MASQUERADE to-ports 1024-65535;
        }
        saddr 192.255.255.0/24 daddr ! 192.255.255.0/24 MASQUERADE;
    }
}

table mangle {
    chain ( PREROUTING INPUT FORWARD OUTPUT POSTROUTING ) { policy ACCEPT ; }
}


table filter {
    chain INPUT {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        # allow local packet
        interface ( lo lxcbr0 ) ACCEPT;

        # respond to ping
        proto icmp ACCEPT;

        # allow IPsec
        proto udp dport 500 ACCEPT;
        proto (esp ah) ACCEPT;

        # allow SSH connections
        proto tcp dport ssh ACCEPT;
    }
    chain OUTPUT {
        policy ACCEPT;

        # connection tracking
        #mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;
    }
    chain FORWARD {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;
        interface ( lxcbr0 ) ACCEPT;
    }
}