root@ubuntu ~ # shorewall dump
Shorewall 4.4.20.3 Dump at ubuntu - Sat Jul  2 21:55:32 PDT 2011

Chain INPUT (policy ACCEPT 230 packets, 20749 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 179 packets, 23685 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Log (/var/log/messages)


NAT Table

Chain PREROUTING (policy ACCEPT 12 packets, 1458 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 10 packets, 1330 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 28 packets, 2546 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 28 packets, 2546 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Mangle Table

Chain PREROUTING (policy ACCEPT 233 packets, 20917 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 231 packets, 20789 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 180 packets, 24305 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 180 packets, 24305 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Raw Table

Chain PREROUTING (policy ACCEPT 279 packets, 24285 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 221 packets, 45108 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Conntrack Table (10 out of 7680)

udp      17 12 src=192.168.217.128 dst=192.168.217.2 sport=39992 dport=53 src=192.168.217.2 dst=192.168.217.128 sport=53 dport=39992 mark=0 use=2
udp      17 12 src=192.168.217.128 dst=192.168.217.2 sport=33955 dport=53 src=192.168.217.2 dst=192.168.217.128 sport=53 dport=33955 mark=0 use=2
udp      17 0 src=192.168.217.1 dst=192.168.217.255 sport=137 dport=137 [UNREPLIED] src=192.168.217.255 dst=192.168.217.1 sport=137 dport=137 mark=0 use=2
tcp      6 98 TIME_WAIT src=192.168.217.1 dst=192.168.217.128 sport=10237 dport=22 src=192.168.217.128 dst=192.168.217.1 sport=22 dport=10237 [ASSURED] mark=0 use=2
udp      17 23 src=192.168.217.128 dst=192.168.217.2 sport=53397 dport=53 src=192.168.217.2 dst=192.168.217.128 sport=53 dport=53397 mark=0 use=2
udp      17 23 src=192.168.217.128 dst=192.168.217.2 sport=34448 dport=53 src=192.168.217.2 dst=192.168.217.128 sport=53 dport=34448 mark=0 use=2
udp      17 14 src=192.168.217.1 dst=192.168.217.255 sport=17500 dport=17500 [UNREPLIED] src=192.168.217.255 dst=192.168.217.1 sport=17500 dport=17500 mark=0 use=2
udp      17 179 src=A.A.A.A dst=192.168.217.128 sport=51194 dport=37533 src=192.168.217.128 dst=A.A.A.A sport=37533 dport=51194 [ASSURED] mark=0 use=2
tcp      6 299 ESTABLISHED src=192.168.217.128 dst=192.168.217.1 sport=22 dport=10229 src=192.168.217.1 dst=192.168.217.128 sport=10229 dport=22 [ASSURED] mark=0 use=2
udp      17 13 src=192.168.217.1 dst=255.255.255.255 sport=17500 dport=17500 [UNREPLIED] src=255.255.255.255 dst=192.168.217.1 sport=17500 dport=17500 mark=0 use=2

IP Configuration

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    inet 192.168.217.128/24 brd 192.168.217.255 scope global eth0
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
    inet 10.88.0.6 peer 10.88.0.5/32 scope global tun0

IP Stats

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    RX: bytes  packets  errors  dropped overrun mcast   
    0          0        0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    0          0        0       0       0       0      
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:20:6c:0c brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    345268     3235     0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    279803     2022     0       0       0       0      
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
    link/none 
    RX: bytes  packets  errors  dropped overrun mcast   
    7785       107      0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    5124       61       0       0       0       0      

Per-IP Counters

   iptaccount is not installed

/proc

   /proc/version = Linux version 2.6.38-8-generic (buildd@allspice) (gcc version 4.5.2 (Ubuntu/Linaro 4.5.2-8ubuntu3) ) #42-Ubuntu SMP Mon Apr 11 03:31:24 UTC 2011
   /proc/sys/net/ipv4/ip_forward = 0
   /proc/sys/net/ipv4/icmp_echo_ignore_all = 0
   /proc/sys/net/ipv4/conf/all/proxy_arp = 0
   /proc/sys/net/ipv4/conf/all/arp_filter = 0
   /proc/sys/net/ipv4/conf/all/arp_ignore = 0
   /proc/sys/net/ipv4/conf/all/rp_filter = 1
   /proc/sys/net/ipv4/conf/all/log_martians = 0
   /proc/sys/net/ipv4/conf/default/proxy_arp = 0
   /proc/sys/net/ipv4/conf/default/arp_filter = 0
   /proc/sys/net/ipv4/conf/default/arp_ignore = 0
   /proc/sys/net/ipv4/conf/default/rp_filter = 1
   /proc/sys/net/ipv4/conf/default/log_martians = 0
   /proc/sys/net/ipv4/conf/eth0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/eth0/arp_filter = 0
   /proc/sys/net/ipv4/conf/eth0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/eth0/rp_filter = 1
   /proc/sys/net/ipv4/conf/eth0/log_martians = 0
   /proc/sys/net/ipv4/conf/lo/proxy_arp = 0
   /proc/sys/net/ipv4/conf/lo/arp_filter = 0
   /proc/sys/net/ipv4/conf/lo/arp_ignore = 0
   /proc/sys/net/ipv4/conf/lo/rp_filter = 1
   /proc/sys/net/ipv4/conf/lo/log_martians = 0
   /proc/sys/net/ipv4/conf/tun0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/tun0/arp_filter = 0
   /proc/sys/net/ipv4/conf/tun0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/tun0/rp_filter = 1
   /proc/sys/net/ipv4/conf/tun0/log_martians = 0

Routing Rules

0:      from all lookup local 
32765:  from all lookup main 
32766:  from all lookup main 
32767:  from all lookup default 

Table default:


Table local:

broadcast 127.255.255.255 dev lo  proto kernel  scope link  src 127.0.0.1 
local 192.168.217.128 dev eth0  proto kernel  scope host  src 192.168.217.128 
local 10.88.0.6 dev tun0  proto kernel  scope host  src 10.88.0.6 
broadcast 192.168.217.0 dev eth0  proto kernel  scope link  src 192.168.217.128 
broadcast 192.168.217.255 dev eth0  proto kernel  scope link  src 192.168.217.128 
broadcast 127.0.0.0 dev lo  proto kernel  scope link  src 127.0.0.1 
local 127.0.0.1 dev lo  proto kernel  scope host  src 127.0.0.1 
local 127.0.0.0/8 dev lo  proto kernel  scope host  src 127.0.0.1 

Table main:

10.88.0.1 via 10.88.0.5 dev tun0 
10.88.0.5 dev tun0  proto kernel  scope link  src 10.88.0.6 
192.168.217.0/24 dev eth0  proto kernel  scope link  src 192.168.217.128 
default via 192.168.217.2 dev eth0  metric 100 

ARP

? (192.168.217.1) at 00:50:56:c0:00:08 [ether] on eth0
? (192.168.217.2) at 00:50:56:f0:b5:59 [ether] on eth0
? (192.168.217.254) at 00:50:56:f0:14:b4 [ether] on eth0

Modules

iptable_filter         12810  0 
iptable_mangle         12734  0 
iptable_nat            13182  0 
iptable_raw            12678  0 
ip_tables              27456  4 iptable_raw,iptable_mangle,iptable_nat,iptable_filter
ipt_addrtype           12599  0 
ipt_LOG                17016  0 
ipt_REJECT             12576  0 
nf_conntrack           81956  8 xt_connlimit,xt_helper,xt_connmark,xt_conntrack,xt_state,iptable_nat,nf_nat,nf_conntrack_ipv4
nf_conntrack_ipv4      19640  3 iptable_nat,nf_nat
nf_defrag_ipv4         12729  2 xt_TPROXY,nf_conntrack_ipv4
nf_defrag_ipv6         13325  1 xt_TPROXY
nf_nat                 25736  1 iptable_nat
nf_tproxy_core         12610  1 xt_TPROXY,[permanent]
xt_CLASSIFY            12507  0 
xt_comment             12504  0 
xt_connlimit           12716  0 
xt_connmark            12755  0 
xt_conntrack           12728  0 
xt_hashlimit           17698  0 
xt_helper              12583  0 
xt_iprange             12541  0 
xt_length              12536  0 
xt_mark                12563  0 
xt_multiport           12597  0 
xt_NFQUEUE             12699  0 
xt_owner               12498  0 
xt_physdev             12587  0 
xt_pkttype             12504  0 
xt_policy              12582  0 
xt_realm               12498  0 
xt_recent              18393  0 
xt_state               12578  0 
xt_tcpmss              12501  0 
xt_tcpudp              12603  0 
xt_time                12661  0 
xt_TPROXY              12854  0 

Shorewall has detected the following iptables/netfilter capabilities:
   NAT: Available
   Packet Mangling: Available
   Multi-port Match: Available
   Extended Multi-port Match: Available
   Connection Tracking Match: Available
   Extended Connection Tracking Match Support: Available
   Packet Type Match: Available
   Policy Match: Available
   Physdev Match: Available
   Physdev-is-bridged Support: Available
   Packet length Match: Available
   IP range Match: Available
   Recent Match: Available
   Owner Match: Available
   CONNMARK Target: Available
   Extended CONNMARK Target: Available
   Connmark Match: Available
   Extended Connmark Match: Available
   Raw Table: Available
   IPP2P Match: Not available
   CLASSIFY Target: Available
   Extended REJECT: Available
   Repeat match: Available
   MARK Target: Available
   Extended MARK Target: Available
   Extended MARK Target 2: Available
   Mangle FORWARD Chain: Available
   Comments: Available
   Address Type Match: Available
   TCPMSS Match: Available
   Hashlimit Match: Available
   NFQUEUE Target: Available
   Realm Match: Available
   Helper Match: Available
   Connlimit Match: Available
   Time Match: Available
   Goto Support: Available
   LOGMARK Target: Not available
   IPMARK Target: Not available
   LOG Target: Available
   Persistent SNAT: Available
   TPROXY Target: Available
   FLOW Classifier: Available
   fwmark route mask: Available
   Mark in any table: Available
   Header Match: Not available
   ACCOUNT Target: Not available
   AUDIT Target: Not available

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1736/sshd       
tcp        0      0 192.168.217.128:22      192.168.217.1:10229     ESTABLISHED 907/sshd: null [pri
tcp6       0      0 :::22                   :::*                    LISTEN      1736/sshd       
udp        0      0 0.0.0.0:37533           0.0.0.0:*                           686/openvpn     
udp        0      0 0.0.0.0:68              0.0.0.0:*                           860/dhclient3   

Traffic Control

Device eth0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 287823 bytes 2031 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device tun0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 5124 bytes 61 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 



TC Filters

Device eth0:

Device tun0:
