[Shorewall-users] shorewall problem following power outage

ether bunny ethrbunny at hotmail.com
Fri Oct 10 04:29:23 PDT 2003


Is this 'status' any more informative?

(sorry for the confusion - im using a linksys router to get past the 
firewall machine - it might not have been properly connected when I asked 
for the previous status).

The fact is that using this linksys box I can connect to the net - this 
seems like my network connection is ok.. could I have a faulty NIC?



>From: Tom Eastep <teastep at shorewall.net>
>To: Shorewall Users Mailing List <shorewall-users at lists.shorewall.net>
>CC: ether bunny <ethrbunny at hotmail.com>
>Subject: Re: [Shorewall-users] shorewall problem following power outage
>Date: 09 Oct 2003 15:25:32 -0700
>MIME-Version: 1.0
>Received: from lists.shorewall.net ([206.124.146.177]) by 
>mc12-f32.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600); Thu, 9 Oct 2003 
>15:35:16 -0700
>Received: from wookie.shorewall.net (wookie.shorewall.net 
>[192.168.1.3])(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 
>bits))(No client certificate requested)by lists.shorewall.net (Postfix) 
>with ESMTPid 8D8AD33F35; Thu,  9 Oct 2003 15:25:33 -0700 (PDT)
>X-Message-Info: JGTYoYF78jGbp9xMFRJbDDCh66YuJ1VS
>In-Reply-To: <Law9-F34xyPyF1BcI3E000006bf at hotmail.com>
>References: <Law9-F34xyPyF1BcI3E000006bf at hotmail.com>
>Organization: Message-Id: <1065738332.25240.107.camel at wookie.shorewall.net>
>X-Mailer: Ximian Evolution 1.2.2 (1.2.2-5) Return-Path: 
>teastep at shorewall.net
>X-OriginalArrivalTime: 09 Oct 2003 22:35:17.0395 (UTC) 
>FILETIME=[9D30C630:01C38EB5]
>
>On Thu, 2003-10-09 at 15:14, ether bunny wrote:
> > 1K pardons
> >
> > (policy)
> > net		all		DROP		info
> > all		all		REJECT		info
> >
> >
> > (interface)
> > net	eth0		155.229.27.255
> > loc	eth1		192.168.1.231
> > dmz	eth2		192.168.100.1
> > #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
> >
> > shorewall status > status.out (attached)
> >
>
>It looks like your default gateway is returning "net unreachable" to any
>connection attempt through it.
>
>-Tom
>--
>Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
>Shoreline,     \ http://shorewall.net
>Washington USA  \ teastep at shorewall.net
>
>

_________________________________________________________________
Get a FREE computer virus scan online from McAfee. 
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963
-------------- next part --------------
Shorewall-1.4.2 Status at graendal - Thu Oct  9 09:32:27 PDT 2003

Counters reset Thu Oct  9 07:38:44 PDT 2003

Chain INPUT (policy DROP 2 packets, 128 bytes)
pkts bytes target     prot opt in     out     source
destination
    0     0 DROP      !icmp --  *      *       0.0.0.0/0
0.0.0.0/0          state INVALID
  399 45360 ACCEPT     all  --  lo     *       0.0.0.0/0
0.0.0.0/0
   64  7028 eth0_in    all  --  eth0   *       0.0.0.0/0
0.0.0.0/0
2581  186K eth1_in    all  --  eth1   *       0.0.0.0/0            0.0.0.0/0
   40  9660 eth2_in    all  --  eth2   *       0.0.0.0/0
0.0.0.0/0
    0     0 common     all  --  *      *       0.0.0.0/0
0.0.0.0/0
    0     0 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 6 prefix `Shorewall:INPUT:REJECT:'
    0     0 reject     all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain FORWARD (policy DROP 1 packets, 60 bytes)
pkts bytes target     prot opt in     out     source
destination
    0     0 DROP      !icmp --  *      *       0.0.0.0/0
0.0.0.0/0          state INVALID
   94  8308 eth0_fwd   all  --  eth0   *       0.0.0.0/0
0.0.0.0/0
  680 48189 eth1_fwd   all  --  eth1   *       0.0.0.0/0
0.0.0.0/0
1329  101K eth2_fwd   all  --  eth2   *       0.0.0.0/0            0.0.0.0/0
    0     0 common     all  --  *      *       0.0.0.0/0
0.0.0.0/0
    0     0 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 6 prefix `Shorewall:FORWARD:REJECT:'
    0     0 reject     all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source
destination
    0     0 DROP      !icmp --  *      *       0.0.0.0/0
0.0.0.0/0          state INVALID
  399 45360 ACCEPT     all  --  *      lo      0.0.0.0/0
0.0.0.0/0
   37  3108 fw2net     all  --  *      eth0    0.0.0.0/0
0.0.0.0/0
2674 1257K fw2loc     all  --  *      eth1    0.0.0.0/0            0.0.0.0/0
  541 57280 fw2dmz     all  --  *      eth2    0.0.0.0/0
0.0.0.0/0
    0     0 common     all  --  *      *       0.0.0.0/0
0.0.0.0/0
    0     0 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 6 prefix `Shorewall:OUTPUT:REJECT:'
    0     0 reject     all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain all2all (8 references)
pkts bytes target     prot opt in     out     source
destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
  208 28286 common     all  --  *      *       0.0.0.0/0
0.0.0.0/0
  122 11647 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 6 prefix `Shorewall:all2all:REJECT:'
  122 11647 reject     all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain common (5 references)
pkts bytes target     prot opt in     out     source
destination
   60  5694 icmpdef    icmp --  *      *       0.0.0.0/0
0.0.0.0/0
   29  6517 reject     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          udp dpts:137:139
    0     0 reject     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          udp dpt:445
    0     0 reject     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp dpt:139
    0     0 reject     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp dpt:445
    0     0 reject     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp dpt:135
    0     0 DROP       udp  --  *      *       0.0.0.0/0
0.0.0.0/0          udp dpt:1900
    2   152 DROP       all  --  *      *       0.0.0.0/0
255.255.255.255
    0     0 DROP       all  --  *      *       0.0.0.0/0
224.0.0.0/4
    0     0 reject     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp dpt:113
    2   110 DROP       udp  --  *      *       0.0.0.0/0
0.0.0.0/0          udp spt:53 state NEW
    0     0 DROP       all  --  *      *       0.0.0.0/0
155.229.27.255
    0     0 DROP       all  --  *      *       0.0.0.0/0
192.168.1.231
    0     0 DROP       all  --  *      *       0.0.0.0/0
192.168.100.1

Chain dmz2fw (1 references)
pkts bytes target     prot opt in     out     source
destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 8
   40  9660 all2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain dmz2loc (1 references)
pkts bytes target     prot opt in     out     source
destination
  721 54519 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 8
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:123
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:53
   16  1688 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:975
   50  3000 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:978
  378 31752 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:111
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:977
  157  9420 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:111
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:980
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:32772
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:2049
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:32769
    0     0 all2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain dmz2net (1 references)
pkts bytes target     prot opt in     out     source
destination
    6   330 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:53
    1    72 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:53
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 8
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:25
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 25
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:80
    0     0 all2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain dynamic (6 references)
pkts bytes target     prot opt in     out     source
destination

Chain eth0_fwd (1 references)
pkts bytes target     prot opt in     out     source
destination
   94  8308 dynamic    all  --  *      *       0.0.0.0/0
0.0.0.0/0
    9  1904 net2loc    all  --  *      eth1    0.0.0.0/0
0.0.0.0/0
   85  6404 net2dmz    all  --  *      eth2    0.0.0.0/0
0.0.0.0/0

Chain eth0_in (1 references)
pkts bytes target     prot opt in     out     source
destination
   64  7028 dynamic    all  --  *      *       0.0.0.0/0
0.0.0.0/0
   64  7028 net2fw     all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain eth1_fwd (1 references)
pkts bytes target     prot opt in     out     source
destination
  680 48189 dynamic    all  --  *      *       0.0.0.0/0
0.0.0.0/0
    9   515 loc2net    all  --  *      eth0    0.0.0.0/0
0.0.0.0/0
  671 47674 loc2dmz    all  --  *      eth2    0.0.0.0/0
0.0.0.0/0

Chain eth1_in (1 references)
pkts bytes target     prot opt in     out     source
destination
2581  186K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
2581  186K loc2fw     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain eth2_fwd (1 references)
pkts bytes target     prot opt in     out     source
destination
1329  101K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0
    7   402 dmz2net    all  --  *      eth0    0.0.0.0/0
0.0.0.0/0
1322  100K dmz2loc    all  --  *      eth1    0.0.0.0/0            0.0.0.0/0

Chain eth2_in (1 references)
pkts bytes target     prot opt in     out     source
destination
   40  9660 dynamic    all  --  *      *       0.0.0.0/0
0.0.0.0/0
   40  9660 dmz2fw     all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain fw2dmz (1 references)
pkts bytes target     prot opt in     out     source
destination
  531 56176 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 8
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:22
   10  1104 all2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain fw2loc (1 references)
pkts bytes target     prot opt in     out     source
destination
2091 1206K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0
          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 8
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:123
   14   890 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:53
   28  3140 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:975
    7   420 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:978
  419 35196 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:111
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:111
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:32773
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:2049
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:977
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:980
    3   180 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:22
  112 10543 all2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain fw2net (1 references)
pkts bytes target     prot opt in     out     source
destination
   37  3108 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:53
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:53
    0     0 all2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain icmpdef (1 references)
pkts bytes target     prot opt in     out     source
destination

Chain loc2dmz (1 references)
pkts bytes target     prot opt in     out     source
destination
  668 47446 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    1    60 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:22
    2   168 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 8
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:25
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:110
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 25
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:10000
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:111
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:977
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:111
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:980
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:32772
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:2049
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:32769
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.100.10     state NEW tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.100.10     state NEW tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.100.10     state NEW tcp dpt:8080
    0     0 ACCEPT     tcp  --  *      *       192.168.1.0/24
192.168.100.10     state NEW tcp dpt:21
    0     0 all2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain loc2fw (1 references)
pkts bytes target     prot opt in     out     source
destination
2529  178K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0
          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    3   168 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:22
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 8
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:10000
    3   408 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:111
   46  6979 all2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain loc2net (1 references)
pkts bytes target     prot opt in     out     source
destination
    7   395 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:123
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:53
    2   120 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:53
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain net2all (3 references)
pkts bytes target     prot opt in     out     source
destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
   16  3352 common     all  --  *      *       0.0.0.0/0
0.0.0.0/0
    1   404 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 6 prefix `Shorewall:net2all:DROP:'
    1   404 DROP       all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain net2dmz (1 references)
pkts bytes target     prot opt in     out     source
destination
   56  4160 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    7   644 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 8
    7   364 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.100.2      state NEW tcp dpt:25
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.100.2      state NEW tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.100.2      state NEW tcp dpt:53
    8   544 ACCEPT     udp  --  *      *       0.0.0.0/0
192.168.100.2      state NEW udp dpt:53
    6   288 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.100.10     state NEW tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.100.10     state NEW tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.100.10     state NEW tcp dpt:8080
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.100.10     state NEW tcp dpt:21
    1   404 net2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain net2fw (1 references)
pkts bytes target     prot opt in     out     source
destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
   46  3936 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 8
    3   144 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp dpt:22
   15  2948 net2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain net2loc (1 references)
pkts bytes target     prot opt in     out     source
destination
    9  1904 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 newnotsyn  tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW tcp flags:!0x16/0x02
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0          icmp type 8
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:123
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
192.168.1.202      state NEW tcp dpt:8080
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0          state NEW udp dpt:9000
    0     0 net2all    all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain newnotsyn (14 references)
pkts bytes target     prot opt in     out     source
destination
    0     0 DROP       all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain reject (10 references)
pkts bytes target     prot opt in     out     source
destination
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          reject-with tcp-reset
  206 28176 REJECT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          reject-with icmp-port-unreachable

Chain shorewall (0 references)
pkts bytes target     prot opt in     out     source
destination

Oct  9 08:32:54 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=84 TOS=0x00 PREC=0xC0 TTL=64 ID=37083 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=192.36.148.17 LEN=56 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=36 ]
Oct  9 08:32:56 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=102 TOS=0x00 PREC=0xC0 TTL=64 ID=37084 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=202.12.27.33 LEN=74 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=54 ]
Oct  9 08:33:00 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=84 TOS=0x00 PREC=0xC0 TTL=64 ID=37085 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=198.41.0.10 LEN=56 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=36 ]
Oct  9 08:33:02 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=102 TOS=0x00 PREC=0xC0 TTL=64 ID=37086 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=198.41.0.4 LEN=74 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=54 ]
Oct  9 08:33:06 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=84 TOS=0x00 PREC=0xC0 TTL=64 ID=37087 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=202.12.27.33 LEN=56 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=36 ]
Oct  9 08:33:08 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=102 TOS=0x00 PREC=0xC0 TTL=64 ID=37088 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=192.203.230.10 LEN=74 TOS=0x00
PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=54 ]
Oct  9 08:33:12 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=84 TOS=0x00 PREC=0xC0 TTL=64 ID=37089 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=198.41.0.4 LEN=56 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=36 ]
Oct  9 08:33:18 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=84 TOS=0x00 PREC=0xC0 TTL=64 ID=37094 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=192.203.230.10 LEN=56 TOS=0x00
PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=36 ]
Oct  9 09:07:28 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=113 TOS=0x00 PREC=0xC0 TTL=64 ID=55640 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=198.41.0.4 LEN=85 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=65 ]
Oct  9 09:07:34 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=113 TOS=0x00 PREC=0xC0 TTL=64 ID=55641 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=192.203.230.10 LEN=85 TOS=0x00
PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=65 ]
Oct  9 09:07:38 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=95 TOS=0x00 PREC=0xC0 TTL=64 ID=55642 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=198.41.0.4 LEN=67 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=47 ]
Oct  9 09:07:40 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=113 TOS=0x00 PREC=0xC0 TTL=64 ID=55643 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=128.63.2.53 LEN=85 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=65 ]
Oct  9 09:07:44 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=95 TOS=0x00 PREC=0xC0 TTL=64 ID=55644 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=192.203.230.10 LEN=67 TOS=0x00
PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=47 ]
Oct  9 09:07:46 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=102 TOS=0x00 PREC=0xC0 TTL=64 ID=55645 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=192.33.4.12 LEN=74 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=54 ]
Oct  9 09:07:50 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=95 TOS=0x00 PREC=0xC0 TTL=64 ID=55646 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=128.63.2.53 LEN=67 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=47 ]
Oct  9 09:07:52 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=102 TOS=0x00 PREC=0xC0 TTL=64 ID=55647 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=192.5.5.241 LEN=74 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=54 ]
Oct  9 09:07:56 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=84 TOS=0x00 PREC=0xC0 TTL=64 ID=55648 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=192.33.4.12 LEN=56 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=36 ]
Oct  9 09:07:58 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=102 TOS=0x00 PREC=0xC0 TTL=64 ID=55649 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=192.112.36.4 LEN=74 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=54 ]
Oct  9 09:08:02 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=84 TOS=0x00 PREC=0xC0 TTL=64 ID=55651 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=192.5.5.241 LEN=56 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=36 ]
Oct  9 09:08:04 all2all:REJECT:IN= OUT=eth1 SRC=192.168.1.231
DST=192.168.1.200 LEN=102 TOS=0x00 PREC=0xC0 TTL=64 ID=55652 PROTO=ICMP
TYPE=3 CODE=0 [SRC=192.168.1.200 DST=193.0.14.129 LEN=74 TOS=0x00 PREC=0x00
TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=53 LEN=54 ]

NAT Table

Chain PREROUTING (policy ACCEPT 2268 packets, 218K bytes)
pkts bytes target     prot opt in     out     source
destination
  677 75541 eth0_in    all  --  eth0   *       0.0.0.0/0
0.0.0.0/0
  663 74205 net_dnat   all  --  eth0   *       0.0.0.0/0
0.0.0.0/0
  169 15310 loc_dnat   all  --  eth1   *       0.0.0.0/0
0.0.0.0/0

Chain POSTROUTING (policy ACCEPT 1208 packets, 95791 bytes)
pkts bytes target     prot opt in     out     source
destination
    3   192 eth0_out   all  --  *      eth0    0.0.0.0/0
0.0.0.0/0
    2   120 eth0_masq  all  --  *      eth0    0.0.0.0/0
0.0.0.0/0

Chain OUTPUT (policy ACCEPT 511 packets, 43420 bytes)
pkts bytes target     prot opt in     out     source
destination

Chain eth0_in (1 references)
pkts bytes target     prot opt in     out     source
destination
   14  1336 DNAT       all  --  *      *       0.0.0.0/0
155.229.27.54      to:192.168.100.10

Chain eth0_masq (1 references)
pkts bytes target     prot opt in     out     source
destination
    2   120 MASQUERADE  all  --  *      *       192.168.1.0/24
0.0.0.0/0
    0     0 MASQUERADE  all  --  *      *       192.168.100.0/24
0.0.0.0/0
    0     0 SNAT       all  --  *      *       192.168.1.0/24
0.0.0.0/0          to:155.229.27.55

Chain eth0_out (1 references)
pkts bytes target     prot opt in     out     source
destination
    1    72 SNAT       all  --  *      *       192.168.100.10
0.0.0.0/0          to:155.229.27.54

Chain loc_dnat (1 references)
pkts bytes target     prot opt in     out     source
destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0
155.229.27.54      tcp dpt:80 to:192.168.100.10
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0
155.229.27.54      tcp dpt:443 to:192.168.100.10
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0
155.229.27.54      tcp dpt:8080 to:192.168.100.10
    0     0 DNAT       tcp  --  *      *       192.168.1.0/24
155.229.27.54      tcp dpt:21 to:192.168.100.10

Chain net_dnat (1 references)
pkts bytes target     prot opt in     out     source
destination
    7   364 DNAT       tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp dpt:25 to:192.168.100.2
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp dpt:80 to:192.168.100.2
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp dpt:635 to:192.168.1.202:8080
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp dpt:53 to:192.168.100.2
    6   407 DNAT       udp  --  *      *       0.0.0.0/0
0.0.0.0/0          udp dpt:53 to:192.168.100.2
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp dpt:21 to:192.168.100.10

Mangle Table

Chain PREROUTING (policy ACCEPT 8374 packets, 678K bytes)
pkts bytes target     prot opt in     out     source
destination
5972  485K pretos     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain INPUT (policy ACCEPT 4112 packets, 332K bytes)
pkts bytes target     prot opt in     out     source
destination

Chain FORWARD (policy ACCEPT 3000 packets, 229K bytes)
pkts bytes target     prot opt in     out     source
destination

Chain OUTPUT (policy ACCEPT 4622 packets, 1473K bytes)
pkts bytes target     prot opt in     out     source
destination
3652 1363K outtos     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain POSTROUTING (policy ACCEPT 7255 packets, 1668K bytes)
pkts bytes target     prot opt in     out     source
destination

Chain outtos (1 references)
pkts bytes target     prot opt in     out     source
destination
  763  976K TOS        tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp dpt:22 TOS set 0x10
1168  216K TOS        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0
          tcp spt:22 TOS set 0x10

Chain pretos (1 references)
pkts bytes target     prot opt in     out     source
destination
1806  130K TOS        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0
          tcp dpt:22 TOS set 0x10
  726 55544 TOS        tcp  --  *      *       0.0.0.0/0
0.0.0.0/0          tcp spt:22 TOS set 0x10
2904  209K TOS        tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0
          TOS set 0x00

tcp      6 431999 ESTABLISHED src=192.168.1.102 dst=192.168.1.231
sport=32788 dport=22 src=192.168.1.231 dst=192.168.1.102 sport=22
dport=32788 [ASSURED] use=1
udp      17 167 src=192.168.1.231 dst=192.168.1.200 sport=32772 dport=975
src=192.168.1.200 dst=192.168.1.231 sport=975 dport=32772 [ASSURED] use=1
tcp      6 425856 ESTABLISHED src=192.168.1.102 dst=192.168.100.10
sport=32787 dport=22 src=192.168.100.10 dst=192.168.1.102 sport=22
dport=32787 [ASSURED] use=1
udp      17 17 src=192.168.1.231 dst=192.168.1.200 sport=911 dport=111
src=192.168.1.200 dst=192.168.1.231 sport=111 dport=911 use=1
udp      17 17 src=192.168.1.231 dst=192.168.1.200 sport=912 dport=111
src=192.168.1.200 dst=192.168.1.231 sport=111 dport=912 use=1
udp      17 26 src=192.168.1.231 dst=192.168.1.200 sport=990 dport=975
src=192.168.1.200 dst=192.168.1.231 sport=975 dport=990 use=1
udp      17 26 src=192.168.1.231 dst=192.168.1.200 sport=991 dport=975
src=192.168.1.200 dst=192.168.1.231 sport=975 dport=991 use=1
udp      17 150 src=192.168.100.2 dst=192.168.1.200 sport=33125 dport=975
src=192.168.1.200 dst=192.168.100.2 sport=975 dport=33125 [ASSURED] use=1
tcp      6 10 SYN_SENT src=192.168.100.2 dst=192.168.1.200 sport=804
dport=111 [UNREPLIED] src=192.168.1.200 dst=192.168.100.2 sport=111
dport=804 use=1
tcp      6 69 SYN_SENT src=192.168.100.2 dst=192.168.1.200 sport=806
dport=111 [UNREPLIED] src=192.168.1.200 dst=192.168.100.2 sport=111
dport=806 use=1
udp      17 0 src=192.168.100.2 dst=192.168.1.200 sport=732 dport=111
src=192.168.1.200 dst=192.168.100.2 sport=111 dport=732 use=1
udp      17 0 src=192.168.100.2 dst=192.168.1.200 sport=733 dport=111
src=192.168.1.200 dst=192.168.100.2 sport=111 dport=733 use=1
udp      17 20 src=192.168.100.2 dst=192.168.1.200 sport=734 dport=975
src=192.168.1.200 dst=192.168.100.2 sport=975 dport=734 use=1
tcp      6 425669 ESTABLISHED src=192.168.1.101 dst=192.168.1.231 sport=3122
dport=22 src=192.168.1.231 dst=192.168.1.101 sport=22 dport=3122 [ASSURED]
use=1
tcp      6 428165 ESTABLISHED src=192.168.1.101 dst=192.168.1.231 sport=3221
dport=22 src=192.168.1.231 dst=192.168.1.101 sport=22 dport=3221 [ASSURED]
use=1





More information about the Shorewall-users mailing list