Update:
I have adjusted some rules as follows:
## Permit ping access
Ping(ACCEPT) loc,fb $FW
Ping(ACCEPT) $FW loc,fb
Ping(ACCEPT) fb loc,dmz
## Drop ping access from net
Ping(DROP) net all
## Permit ICMP access
ACCEPT $FW loc,fb icmp
ACCEPT $FW net icmp
ACCEPT loc,fb net icmp
ACCEPT fb loc,dmz icmp
However, I can only ping host pc4-svp.whl.meilocal.net serving
Shorewall: 192.168.178.10 (aka 10.0.0.1 and 10.1.0.1).
http://up.picr.de/26014890cy.jpg
Any ping or traceroute to another server in 10.0.0.0/24 or 10.1.0.0/24
fails after reaching 192.168.178.10.
My conclusion is that the static route configured in router is working,
but then communication is blocked on 192.168.178.10.
thomas@pc8-nb:~$ sudo traceroute 10.0.0.2
traceroute to 10.0.0.2 (10.0.0.2), 30 hops max, 60 byte packets
1 pc4-svp.whl.meilocal.net (192.168.178.10) 0.243 ms 0.234 ms 0.231 ms
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *
thomas@pc8-nb:~$ sudo ping 10.0.0.2
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
From 192.168.178.1: icmp_seq=124 Redirect Host(New nexthop: 192.168.178.10)
From 192.168.178.1: icmp_seq=424 Redirect Host(New nexthop: 192.168.178.10)
Any advise?
(Shorewall dump attached.)
THX
Thomas
---------------------------------------------------------------------------------------------------------------------
Hi Tom,
I checked configuration and reviewed rules.
For "Ping" and "ICMP" I can see these rules:
## Permit ping access
Ping(ACCEPT) loc,fb $FW
Ping(ACCEPT) $FW loc,fb
## Drop ping access from net
Ping(DROP) net all
## Permit ICMP access
ACCEPT $FW loc,fb icmp
ACCEPT $FW net icmp
ACCEPT loc,fb net icmp
I guess this ruleset is incomplete, right?
And do I need a new rule for Traceroute?
Thanks and regards
Thomas
Am 26.06.2016 um 18:05 schrieb Tom Eastep:
> On 06/26/2016 07:10 AM, Tom Eastep wrote:
> > On 06/26/2016 05:53 AM, Thomas Schneider wrote:
> >> Hello!
>
> >> Indeed I mean the default router for 192.168.178.0/24.
> >> http://up.picr.de/26014890cy.jpg
>
> >> This router is limited in regards to modifications. But I have
> >> configured a static route on this router. To enable ICMP
> >> redirects, do I need to create related rules in Shorewall
> >> allowing this traffic?
>
> > No -- this problem has *nothing* to do with Shorewall.
>
>
>
> If you can get the Fritzbox to start routing the subject packets (or
> get it to issue ICMP redirects), there looks like there is a problem
> with your Shorewall configuration with regards to traffic from the
> 'fb' zone to 10.0.0.0/24 network (vmbr0) - I don't see any ACCEPT
> rules for that traffic.
>
> -Tom
> >
------------------------------------------------------------------------------
> Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in
San > Francisco, CA to explore cutting-edge tech and listen to tech
luminaries > present their vision of the future. This family event has
something for > everyone, including kids. Get more information and
register today. > http://sdm.link/attshape >
_______________________________________________ > Shorewall-users
mailing list > [email protected] >
https://lists.sourceforge.net/lists/listinfo/shorewall-users
Shorewall 5.0.7.2 Dump at pc4-svp - Di 28. Jun 08:57:44 CEST 2016
Shorewall is running
State:Started (Mo 27. Jun 01:14:00 CEST 2016) from /etc/shorewall/
(/var/lib/shorewall/firewall compiled by Shorewall version 5.0.7.2)
Counters reset Mo 27. Jun 01:14:00 CEST 2016
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
7808 684K UMP_IF_in all -- vmbr2 * 0.0.0.0/0 0.0.0.0/0
182K 117M UMB_IF_in all -- eth0 * 0.0.0.0/0 0.0.0.0/0
1887 143K INT_IF_in all -- vmbr0 * 0.0.0.0/0 0.0.0.0/0
0 0 vpn-fw all -- tun+ * 0.0.0.0/0 0.0.0.0/0
1744 133K DMZ_IF_in all -- vmbr1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix "Shorewall:INPUT:REJECT:"
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
953 76428 UMP_IF_fwd all -- vmbr2 * 0.0.0.0/0 0.0.0.0/0
117K 153M UMB_IF_fwd all -- eth0 * 0.0.0.0/0 0.0.0.0/0
70056 3701K INT_IF_fwd all -- vmbr0 * 0.0.0.0/0 0.0.0.0/0
0 0 vpn_frwd all -- tun+ * 0.0.0.0/0 0.0.0.0/0
0 0 DMZ_IF_fwd all -- vmbr1 * 0.0.0.0/0 0.0.0.0/0
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix "Shorewall:FORWARD:REJECT:"
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
4276 2569K ACCEPT all -- * vmbr2 0.0.0.0/0 0.0.0.0/0
24022 1330K ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0
1912 142K INT_IF_out all -- * vmbr0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * tun+ 0.0.0.0/0 0.0.0.0/0
1744 133K DMZ_IF_out all -- * vmbr1 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain Broadcast (2 references)
pkts bytes target prot opt in out source destination
6006 666K DROP all -- * * 0.0.0.0/0 0.0.0.0/0
ADDRTYPE match dst-type BROADCAST
914 32904 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
ADDRTYPE match dst-type MULTICAST
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
ADDRTYPE match dst-type ANYCAST
Chain DMZ_IF_fwd (1 references)
pkts bytes target prot opt in out source destination
0 0 dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
0 0 tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 dmz_frwd all -- * * 10.1.0.0/24 0.0.0.0/0
Chain DMZ_IF_in (1 references)
pkts bytes target prot opt in out source destination
1744 133K dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:67:68
0 0 tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT udp -- * * 0.0.0.0 0.0.0.0/0
udp dpts:67:68
1744 133K dmz-fw all -- * * 10.1.0.0/24 0.0.0.0/0
Chain DMZ_IF_out (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:67:68
1744 133K ACCEPT all -- * * 0.0.0.0/0 10.1.0.0/24
0 0 ACCEPT all -- * * 0.0.0.0/0
255.255.255.255
0 0 ACCEPT all -- * * 0.0.0.0/0 224.0.0.0/4
Chain Drop (1 references)
pkts bytes target prot opt in out source destination
1967 158K all -- * * 0.0.0.0/0 0.0.0.0/0
1967 158K Broadcast all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmptype 3 code 4 /* Needed ICMP types */
2 336 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmptype 11 /* Needed ICMP types */
2 149 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,445 /* SMB */
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:137:139 /* SMB */
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:137 dpts:1024:65535 /* SMB */
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,139,445 /* SMB */
4 299 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:1900 /* UPnP */
5 212 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp flags:!0x17/0x02
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:53 /* Late DNS Replies */
Chain INT_IF_fwd (1 references)
pkts bytes target prot opt in out source destination
22998 1152K dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
47189 2557K tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
70056 3701K loc_frwd all -- * * 10.0.0.0/24 0.0.0.0/0
Chain INT_IF_in (1 references)
pkts bytes target prot opt in out source destination
1744 133K dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:67:68
143 9960 tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT udp -- * * 0.0.0.0 0.0.0.0/0
udp dpts:67:68
1887 143K ~comb1 all -- * * 10.0.0.0/24 0.0.0.0/0
Chain INT_IF_out (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:67:68
1912 142K ACCEPT all -- * * 0.0.0.0/0 10.0.0.0/24
0 0 ACCEPT all -- * * 0.0.0.0/0
255.255.255.255
0 0 ACCEPT all -- * * 0.0.0.0/0 224.0.0.0/4
Chain Reject (10 references)
pkts bytes target prot opt in out source destination
6923 686K all -- * * 0.0.0.0/0 0.0.0.0/0
6923 686K Broadcast all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmptype 3 code 4 /* Needed ICMP types */
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmptype 11 /* Needed ICMP types */
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID
0 0 reject udp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,445 /* SMB */
0 0 reject udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:137:139 /* SMB */
0 0 reject udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:137 dpts:1024:65535 /* SMB */
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,139,445 /* SMB */
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:1900 /* UPnP */
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp flags:!0x17/0x02
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:53 /* Late DNS Replies */
Chain UMB_IF_fwd (1 references)
pkts bytes target prot opt in out source destination
0 0 sfilter all -- * eth0 0.0.0.0/0 0.0.0.0/0
[goto]
65 3044 dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
65 3044 smurfs all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
94567 150M tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
117K 153M net_frwd all -- * * 0.0.0.0/0 0.0.0.0/0
Chain UMB_IF_in (1 references)
pkts bytes target prot opt in out source destination
144K 51M dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
144K 51M smurfs all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
142K 51M ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:67:68
36478 66M tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
40630 67M net-fw all -- * * 0.0.0.0/0 0.0.0.0/0
Chain UMP_IF_fwd (1 references)
pkts bytes target prot opt in out source destination
953 76428 dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
953 76428 smurfs all -- * * 192.168.178.0/24 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
953 76428 smurfs all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
0 0 tcpflags tcp -- * * 192.168.178.0/24 0.0.0.0/0
0 0 tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
953 76428 fb_frwd all -- * * 192.168.178.0/24 0.0.0.0/0
953 76428 net_frwd all -- * * 0.0.0.0/0 0.0.0.0/0
Chain UMP_IF_in (1 references)
pkts bytes target prot opt in out source destination
3480 437K dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
3437 421K smurfs all -- * * 192.168.178.0/24 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
3480 437K smurfs all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
4249 241K tcpflags tcp -- * * 192.168.178.0/24 0.0.0.0/0
4249 241K tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
7765 669K ~comb1 all -- * * 192.168.178.0/24 0.0.0.0/0
43 15462 net-fw all -- * * 0.0.0.0/0 0.0.0.0/0
Chain all-all (9 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
5179 554K Reject all -- * * 0.0.0.0/0 0.0.0.0/0
46 2760 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix "Shorewall:all-all:REJECT:"
46 2760 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain dmz-all (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain dmz-fw (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 4505,4506
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
1744 133K Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain dmz-loc (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 10.0.0.3
tcp dpt:3306
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain dmz-net (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:53 /* DNS */
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:53 /* DNS */
0 0 ACCEPT tcp -- * * 0.0.0.0/0
130.89.148.12 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0
195.20.242.89 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0
87.230.23.19 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0
198.199.77.106 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0
134.109.228.1 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0
212.211.132.250 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0
129.143.116.113 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:11371
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:11371
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain dmz_frwd (1 references)
pkts bytes target prot opt in out source destination
0 0 dmz-all all -- * vmbr2 0.0.0.0/0
192.168.178.0/24
0 0 dmz-net all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 dmz-net all -- * vmbr2 0.0.0.0/0 0.0.0.0/0
0 0 dmz-loc all -- * vmbr0 0.0.0.0/0 10.0.0.0/24
0 0 dmz-loc all -- * vmbr0 0.0.0.0/0 224.0.0.0/4
0 0 dmz-all all -- * tun+ 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * vmbr1 0.0.0.0/0 10.1.0.0/24
Chain dynamic (10 references)
pkts bytes target prot opt in out source destination
Chain fb-net (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 80,443 /* HTTP, HTTPS */
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 192.168.178.121 0.0.0.0/0
tcp dpt:5938
0 0 ACCEPT tcp -- * * 192.168.178.48 0.0.0.0/0
tcp dpt:5938
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:11371
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:11371
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain fb_frwd (1 references)
pkts bytes target prot opt in out source destination
0 0 fb-net all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 fb-net all -- * vmbr2 0.0.0.0/0 0.0.0.0/0
0 0 all-all all -- * tun+ 0.0.0.0/0 0.0.0.0/0
0 0 ~comb0 all -- * vmbr1 0.0.0.0/0 10.1.0.0/24
0 0 ~comb0 all -- * vmbr1 0.0.0.0/0 224.0.0.0/4
Chain loc-net (2 references)
pkts bytes target prot opt in out source destination
47058 2549K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
131 7860 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 80,443,143 /* HTTP, HTTPS, IMAP */
22867 1144K ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:53 /* DNS */
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:53 /* DNS */
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:11371
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:11371
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain loc_frwd (1 references)
pkts bytes target prot opt in out source destination
70056 3701K loc-net all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 loc-net all -- * vmbr2 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * vmbr0 0.0.0.0/0 10.0.0.0/24
0 0 all-all all -- * tun+ 0.0.0.0/0 0.0.0.0/0
0 0 ~comb0 all -- * vmbr1 0.0.0.0/0 10.1.0.0/24
0 0 ~comb0 all -- * vmbr1 0.0.0.0/0 224.0.0.0/4
Chain logdrop (0 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain logflags (7 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 4 level 6 prefix "Shorewall:logflags:DROP:"
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain logreject (0 references)
pkts bytes target prot opt in out source destination
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
Chain net-all (4 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
1967 158K Drop all -- * * 0.0.0.0/0 0.0.0.0/0
1911 142K LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix "Shorewall:net-all:DROP:"
1911 142K DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain net-dmz (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID
13 640 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 143,25,80,443,465,587,993
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmptype 8 /* Ping */
0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 10.1.0.4
tcp dpt:25 limit: avg 5/sec burst 10
0 0 net-all all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain net-fw (2 references)
pkts bytes target prot opt in out source destination
38528 66M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
282 13316 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID
31 1364 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:22
16 674 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmptype 8 /* Ping */
1816 149K net-all all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain net-loc (2 references)
pkts bytes target prot opt in out source destination
117K 153M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID
802 67368 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmptype 8 /* Ping */
52 2404 ACCEPT tcp -- eth0 * 0.0.0.0/0 10.0.0.2
multiport dports 80,443 limit: avg 5/sec burst 10
151 9060 net-all all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain net_frwd (2 references)
pkts bytes target prot opt in out source destination
0 0 ~comb2 all -- * vmbr2 0.0.0.0/0
192.168.178.0/24
0 0 ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * vmbr2 0.0.0.0/0 0.0.0.0/0
118K 153M net-loc all -- * vmbr0 0.0.0.0/0 10.0.0.0/24
0 0 net-loc all -- * vmbr0 0.0.0.0/0 224.0.0.0/4
0 0 ~comb2 all -- * tun+ 0.0.0.0/0 0.0.0.0/0
13 640 net-dmz all -- * vmbr1 0.0.0.0/0 10.1.0.0/24
0 0 net-dmz all -- * vmbr1 0.0.0.0/0 224.0.0.0/4
Chain reject (19 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
ADDRTYPE match src-type BROADCAST
0 0 DROP all -- * * 224.0.0.0/4 0.0.0.0/0
0 0 DROP 2 -- * * 0.0.0.0/0 0.0.0.0/0
61 3164 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0
reject-with tcp-reset
16 960 REJECT udp -- * * 0.0.0.0/0 0.0.0.0/0
reject-with icmp-port-unreachable
0 0 REJECT icmp -- * * 0.0.0.0/0 0.0.0.0/0
reject-with icmp-host-unreachable
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0
reject-with icmp-host-prohibited
Chain sfilter (2 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix "Shorewall:sfilter:DROP:"
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain sha-lh-67289397ce1ff24538d3 (0 references)
pkts bytes target prot opt in out source destination
Chain sha-rh-a548bd405956095b166d (0 references)
pkts bytes target prot opt in out source destination
Chain shorewall (0 references)
pkts bytes target prot opt in out source destination
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0
recent: SET name: %CURRENTTIME side: source mask: 255.255.255.255
Chain smurflog (2 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix "Shorewall:smurfs:DROP:"
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain smurfs (6 references)
pkts bytes target prot opt in out source destination
43 15462 RETURN all -- * * 0.0.0.0 0.0.0.0/0
0 0 smurflog all -- * * 0.0.0.0/0 0.0.0.0/0
[goto] ADDRTYPE match src-type BROADCAST
0 0 smurflog all -- * * 224.0.0.0/4 0.0.0.0/0
[goto]
Chain tcpflags (12 references)
pkts bytes target prot opt in out source destination
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
[goto] tcp flags:0x3F/0x29
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
[goto] tcp flags:0x3F/0x00
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
[goto] tcp flags:0x06/0x06
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
[goto] tcp flags:0x05/0x05
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
[goto] tcp flags:0x03/0x03
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
[goto] tcp flags:0x19/0x09
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
[goto] tcp spt:0 flags:0x17/0x02
Chain vpn-dmz (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 143,25,80,443,465,587,993
0 0 all-all all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain vpn-fw (1 references)
pkts bytes target prot opt in out source destination
0 0 dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
0 0 tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:22
0 0 all-all all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain vpn-net (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:11371
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:11371
0 0 all-all all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain vpn_frwd (1 references)
pkts bytes target prot opt in out source destination
0 0 sfilter all -- * tun+ 0.0.0.0/0 0.0.0.0/0
[goto]
0 0 dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW,UNTRACKED
0 0 tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 all-all all -- * vmbr2 0.0.0.0/0
192.168.178.0/24
0 0 vpn-net all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 vpn-net all -- * vmbr2 0.0.0.0/0 0.0.0.0/0
0 0 all-all all -- * vmbr0 0.0.0.0/0 10.0.0.0/24
0 0 all-all all -- * vmbr0 0.0.0.0/0 224.0.0.0/4
0 0 vpn-dmz all -- * vmbr1 0.0.0.0/0 10.1.0.0/24
0 0 vpn-dmz all -- * vmbr1 0.0.0.0/0 224.0.0.0/4
Chain ~comb0 (4 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 143,25,80,443,465,587,993
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpts:2200:2299
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain ~comb1 (2 references)
pkts bytes target prot opt in out source destination
4471 257K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
1 60 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:2214
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:8006
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 443,5900:5999
1 84 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmptype 8 /* Ping */
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 4505,4506
5179 554K all-all all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain ~comb2 (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmptype 8 /* Ping */
0 0 net-all all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Log (/var/log/messages)
Jun 28 08:43:05 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49
DST=10.0.0.252 LEN=60 TOS=0x00 PREC=0x00 TTL=17 ID=52987 PROTO=UDP SPT=48190
DPT=33485 LEN=40
Jun 28 08:44:18 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=5 ID=19379 PROTO=UDP SPT=35439 DPT=33451 LEN=40
Jun 28 08:44:18 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=6 ID=19380 PROTO=UDP SPT=60180 DPT=33452 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=7 ID=19619 PROTO=UDP SPT=36536 DPT=33457 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=8 ID=19620 PROTO=UDP SPT=36696 DPT=33458 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=8 ID=19621 PROTO=UDP SPT=47263 DPT=33459 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=8 ID=19622 PROTO=UDP SPT=43589 DPT=33460 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=9 ID=19623 PROTO=UDP SPT=43213 DPT=33461 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=9 ID=19624 PROTO=UDP SPT=43328 DPT=33462 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=9 ID=19625 PROTO=UDP SPT=47630 DPT=33463 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=10 ID=19626 PROTO=UDP SPT=33049 DPT=33464 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=10 ID=19627 PROTO=UDP SPT=33535 DPT=33465 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=10 ID=19628 PROTO=UDP SPT=48912 DPT=33466 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=11 ID=19629 PROTO=UDP SPT=51903 DPT=33467 LEN=40
Jun 28 08:44:23 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=11 ID=19630 PROTO=UDP SPT=49720 DPT=33468 LEN=40
Jun 28 08:44:33 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=17 ID=21005 PROTO=UDP SPT=35538 DPT=33486 LEN=40
Jun 28 08:44:33 net-all:DROP:IN=vmbr2 OUT=vmbr0 SRC=192.168.178.49 DST=10.0.0.2
LEN=60 TOS=0x00 PREC=0x00 TTL=18 ID=21007 PROTO=UDP SPT=39011 DPT=33488 LEN=40
Jun 28 08:47:33 net-all:DROP:IN=eth0 OUT= SRC=83.22.109.29 DST=217.8.xx.xx
LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=57711 DF PROTO=TCP SPT=51831 DPT=23
WINDOW=14600 RES=0x00 SYN URGP=0 MARK=0x10000
Jun 28 08:48:44 net-all:DROP:IN=eth0 OUT= SRC=190.254.234.32 DST=217.8.xx.xx
LEN=56 TOS=0x00 PREC=0x20 TTL=48 ID=2616 DF PROTO=TCP SPT=54920 DPT=23
WINDOW=5440 RES=0x00 SYN URGP=0 MARK=0x10000
Jun 28 08:55:23 net-all:DROP:IN=eth0 OUT= SRC=122.54.131.30 DST=217.8.xx.xx
LEN=56 TOS=0x00 PREC=0x00 TTL=53 ID=8744 DF PROTO=TCP SPT=56478 DPT=23
WINDOW=5808 RES=0x00 SYN URGP=0 MARK=0x10000
NAT Table
Chain PREROUTING (policy ACCEPT 60 packets, 4444 bytes)
pkts bytes target prot opt in out source destination
1909 150K UPnP all -- eth0 * 0.0.0.0/0 0.0.0.0/0
13348 909K UPnP all -- vmbr2 * 0.0.0.0/0 0.0.0.0/0
13284 892K RETURN all -- vmbr2 * 192.168.178.0/24 0.0.0.0/0
1909 150K net_dnat all -- eth0 * 0.0.0.0/0 0.0.0.0/0
64 16910 net_dnat all -- vmbr2 * 0.0.0.0/0 0.0.0.0/0
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 3 packets, 216 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 3 packets, 216 bytes)
pkts bytes target prot opt in out source destination
26889 1424K UMB_IF_masq all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain UMB_IF_masq (1 references)
pkts bytes target prot opt in out source destination
22969 1150K SNAT all -- * * 10.0.0.0/24 0.0.0.0/0
to:217.8.xx.xx
0 0 SNAT all -- * * 10.1.0.0/24 0.0.0.0/0
to:217.8.xx.xx
Chain UPnP (2 references)
pkts bytes target prot opt in out source destination
Chain net_dnat (2 references)
pkts bytes target prot opt in out source destination
52 2404 DNAT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0
multiport dports 80,443 to:10.0.0.2
5 248 DNAT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0
tcp dpt:25 to:10.1.0.4
Mangle Table
Chain PREROUTING (policy ACCEPT 404 packets, 39294 bytes)
pkts bytes target prot opt in out source destination
391K 275M CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0
CONNMARK restore mask 0x30000
29052 3581K routemark all -- eth0 * 0.0.0.0/0 0.0.0.0/0
mark match 0x0/0x30000
13456 917K routemark all -- vmbr2 * 0.0.0.0/0 0.0.0.0/0
mark match 0x0/0x30000
Chain INPUT (policy ACCEPT 339 packets, 34136 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 57 packets, 4830 bytes)
pkts bytes target prot opt in out source destination
188K 156M MARK all -- * * 0.0.0.0/0 0.0.0.0/0
MARK and 0xfffcffff
Chain OUTPUT (policy ACCEPT 245 packets, 158K bytes)
pkts bytes target prot opt in out source destination
31954 4174K CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0
CONNMARK restore mask 0x30000
Chain POSTROUTING (policy ACCEPT 258 packets, 159K bytes)
pkts bytes target prot opt in out source destination
Chain routemark (2 references)
pkts bytes target prot opt in out source destination
29052 3581K MARK all -- eth0 * 0.0.0.0/0 0.0.0.0/0
MARK xset 0x10000/0x30000
13456 917K MARK all -- vmbr2 * 0.0.0.0/0 0.0.0.0/0
MARK xset 0x20000/0x30000
42508 4498K CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0
mark match ! 0x0/0x30000 CONNMARK save mask 0x30000
Raw Table
Chain PREROUTING (policy ACCEPT 404 packets, 39294 bytes)
pkts bytes target prot opt in out source destination
0 0 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:10080 CT helper amanda
16 756 CT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:21 CT helper ftp
0 0 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:1719 CT helper RAS
0 0 CT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:1720 CT helper Q.931
0 0 CT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:6667 CT helper irc
1282 102K CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:137 CT helper netbios-ns
4 160 CT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:1723 CT helper pptp
0 0 CT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:6566 CT helper sane
82 35780 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:5060 CT helper sip
5 377 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:161 CT helper snmp
4 140 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:69 CT helper tftp
Chain OUTPUT (policy ACCEPT 245 packets, 158K bytes)
pkts bytes target prot opt in out source destination
0 0 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:10080 CT helper amanda
0 0 CT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:21 CT helper ftp
0 0 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:1719 CT helper RAS
0 0 CT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:1720 CT helper Q.931
0 0 CT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:6667 CT helper irc
0 0 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:137 CT helper netbios-ns
0 0 CT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:1723 CT helper pptp
0 0 CT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:6566 CT helper sane
0 0 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:5060 CT helper sip
0 0 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:161 CT helper snmp
0 0 CT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:69 CT helper tftp
Conntrack Table (11 out of 262144)
udp 17 3 src=10.0.0.252 dst=78.42.43.41 sport=46234 dport=53
src=78.42.43.41 dst=217.8.xx.xx sport=53 dport=46234 mark=65536 use=1
udp 17 5 src=10.0.0.2 dst=78.42.43.41 sport=51064 dport=53 src=78.42.43.41
dst=217.8.xx.xx sport=53 dport=51064 mark=65536 use=1
udp 17 0 src=10.0.0.253 dst=78.42.43.41 sport=39674 dport=53
src=78.42.43.41 dst=217.8.xx.xx sport=53 dport=39674 mark=65536 use=1
udp 17 0 src=10.0.0.253 dst=78.42.43.41 sport=44677 dport=53
src=78.42.43.41 dst=217.8.xx.xx sport=53 dport=44677 mark=65536 use=1
udp 17 5 src=10.0.0.2 dst=78.42.43.41 sport=47591 dport=53 src=78.42.43.41
dst=217.8.xx.xx sport=53 dport=47591 mark=65536 use=1
tcp 6 431999 ESTABLISHED src=192.168.178.49 dst=192.168.178.10 sport=41478
dport=2214 src=192.168.178.10 dst=192.168.178.49 sport=2214 dport=41478
[ASSURED] mark=131072 use=1
tcp 6 431187 ESTABLISHED src=10.0.0.1 dst=10.0.0.2 sport=56468 dport=2202
src=10.0.0.2 dst=10.0.0.1 sport=2202 dport=56468 [ASSURED] mark=0 use=1
tcp 6 426001 ESTABLISHED src=10.0.0.1 dst=10.0.0.253 sport=60490
dport=22253 src=10.0.0.253 dst=10.0.0.1 sport=22253 dport=60490 [ASSURED]
mark=0 use=1
udp 17 3 src=10.0.0.252 dst=78.42.43.41 sport=52705 dport=53
src=78.42.43.41 dst=217.8.xx.xx sport=53 dport=52705 mark=65536 use=1
udp 17 29 src=10.120.192.1 dst=255.255.255.255 sport=67 dport=68
[UNREPLIED] src=255.255.255.255 dst=10.120.192.1 sport=68 dport=67 mark=65536
use=1
tcp 6 426656 ESTABLISHED src=10.0.0.1 dst=10.0.0.252 sport=56160
dport=22252 src=10.0.0.252 dst=10.0.0.1 sport=22252 dport=56160 [ASSURED]
mark=0 use=1
IP Configuration
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group
default qlen 1
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
group default qlen 1000
inet 217.8.xx.xx/26 brd 255.255.255.255 scope global eth0
valid_lft forever preferred_lft forever
5: vmbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
group default qlen 1000
inet 10.0.0.1/24 brd 10.0.0.255 scope global vmbr0
valid_lft forever preferred_lft forever
6: vmbr1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN
group default qlen 1000
inet 10.1.0.1/24 brd 10.0.0.255 scope global vmbr1
valid_lft forever preferred_lft forever
7: vmbr2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
group default qlen 1000
inet 192.168.178.10/24 brd 192.168.178.255 scope global vmbr2
valid_lft forever preferred_lft forever
IP Stats
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode
DEFAULT group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
RX: bytes packets errors dropped overrun mcast
143987630 273743 0 0 0 0
TX: bytes packets errors dropped carrier collsns
143987630 273743 0 0 0 0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
mode DEFAULT group default qlen 1000
link/ether 74:d4:35:1a:f6:0f brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
12757530631 138907879 1432 0 0 0
TX: bytes packets errors dropped carrier collsns
73883258 1008406 0 0 0 0
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master
vmbr2 state UP mode DEFAULT group default qlen 1000
link/ether 00:15:17:91:9c:b8 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
4737977660 7439233 0 2 0 886094
TX: bytes packets errors dropped carrier collsns
1786028005 5447876 0 0 0 0
4: eth2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast master
vmbr1 state DOWN mode DEFAULT group default qlen 1000
link/ether 00:15:17:91:9c:b9 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 0 0 0
5: vmbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
mode DEFAULT group default qlen 1000
link/ether fe:03:ad:be:e0:9b brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
38966379 758936 0 0 0 0
TX: bytes packets errors dropped carrier collsns
1368444432 1223978 0 0 0 0
6: vmbr1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN
mode DEFAULT group default qlen 1000
link/ether 00:15:17:91:9c:b9 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 0 0 0
7: vmbr2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
mode DEFAULT group default qlen 1000
link/ether 00:15:17:91:9c:b8 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
484751481 4066968 0 1641181 0 0
TX: bytes packets errors dropped carrier collsns
239975594 276775 0 0 0 0
18: tap123i0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast master vmbr2 state UNKNOWN mode DEFAULT group default qlen 1000
link/ether c2:de:fd:4f:7e:70 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
168627323 1154338 0 0 0 0
TX: bytes packets errors dropped carrier collsns
1663546963 4553746 0 0 0 0
19: tap121i0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast master vmbr2 state UNKNOWN mode DEFAULT group default qlen 1000
link/ether ea:7f:f7:d0:d8:fb brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
454566202 1831045 0 0 0 0
TX: bytes packets errors dropped carrier collsns
615229162 2758231 0 0 0 0
25: veth102i0@if24: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue
master vmbr0 state UP mode DEFAULT group default qlen 1000
link/ether fe:03:ad:be:e0:9b brd ff:ff:ff:ff:ff:ff link-netnsid 0
RX: bytes packets errors dropped overrun mcast
13769498 220794 0 0 0 0
TX: bytes packets errors dropped carrier collsns
341755509 339036 0 0 0 0
27: veth101i0@if26: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue
master vmbr0 state UP mode DEFAULT group default qlen 1000
link/ether fe:59:8e:51:59:6f brd ff:ff:ff:ff:ff:ff link-netnsid 1
RX: bytes packets errors dropped overrun mcast
13592413 218992 0 0 0 0
TX: bytes packets errors dropped carrier collsns
341671564 338186 0 0 0 0
31: veth100i0@if30: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue
master vmbr0 state UP mode DEFAULT group default qlen 1000
link/ether fe:73:e2:f2:bf:cd brd ff:ff:ff:ff:ff:ff link-netnsid 2
RX: bytes packets errors dropped overrun mcast
13516762 212353 0 0 0 0
TX: bytes packets errors dropped carrier collsns
337141534 329040 0 0 0 0
Bridges
bridge name bridge id STP enabled interfaces
vmbr0 8000.fe03adbee09b no veth100i0
veth101i0
veth102i0
vmbr1 8000.001517919cb9 no eth2
vmbr2 8000.001517919cb8 no eth1
tap121i0
tap123i0
Routing Rules
0: from all lookup local
999: from all lookup main
1000: from 217.8.xx.xx lookup um_business
1000: from 192.168.178.10 lookup um_private
10000: from all fwmark 0x10000/0x30000 lookup um_business
10001: from all fwmark 0x20000/0x30000 lookup um_private
11000: from 10.1.0.1 lookup um_business
32765: from all lookup balance
32767: from all lookup default
Table balance:
default via 217.8.xx.xx dev eth0
Table default:
Table local:
local 217.8.xx.xx dev eth0 proto kernel scope host src 217.8.xx.xx
local 192.168.178.10 dev vmbr2 proto kernel scope host src 192.168.178.10
local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1
local 10.1.0.1 dev vmbr1 proto kernel scope host src 10.1.0.1
local 10.0.0.1 dev vmbr0 proto kernel scope host src 10.0.0.1
broadcast 217.8.xx.xx dev eth0 proto kernel scope link src 217.8.xx.xx
broadcast 217.8.50.127 dev eth0 proto kernel scope link src 217.8.xx.xx
broadcast 192.168.178.255 dev vmbr2 proto kernel scope link src 192.168.178.10
broadcast 192.168.178.0 dev vmbr2 proto kernel scope link src 192.168.178.10
broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1
broadcast 127.0.0.0 dev lo proto kernel scope link src 127.0.0.1
broadcast 10.1.0.255 dev vmbr1 proto kernel scope link src 10.1.0.1 linkdown
broadcast 10.1.0.0 dev vmbr1 proto kernel scope link src 10.1.0.1 linkdown
broadcast 10.0.0.255 dev vmbr1 proto kernel scope link src 10.1.0.1 linkdown
broadcast 10.0.0.255 dev vmbr0 proto kernel scope link src 10.0.0.1
broadcast 10.0.0.0 dev vmbr0 proto kernel scope link src 10.0.0.1
local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1
Table main:
217.8.xx.xx dev eth0 scope link src 217.8.xx.xx
192.168.178.1 dev vmbr2 scope link src 192.168.178.10
217.8.xx.xx/26 dev eth0 proto kernel scope link src 217.8.xx.xx
192.168.178.0/24 dev vmbr2 proto kernel scope link src 192.168.178.10
10.1.0.0/24 dev vmbr1 proto kernel scope link src 10.1.0.1 linkdown
10.0.0.0/24 dev vmbr0 proto kernel scope link src 10.0.0.1
blackhole 192.168.0.0/16
blackhole 172.16.0.0/12
blackhole 10.0.0.0/8
Table um_business:
217.8.xx.xx dev eth0 scope link src 217.8.xx.xx
default via 217.8.xx.xx dev eth0 src 217.8.xx.xx
Table um_private:
192.168.178.1 dev vmbr2 scope link src 192.168.178.10
default via 192.168.178.1 dev vmbr2 src 192.168.178.10
Per-IP Counters
iptaccount is not installed
NF Accounting
Events
/proc
/proc/version = Linux version 4.4.8-1-pve (root@elsa) (gcc version 4.9.2
(Debian 4.9.2-10) ) #1 SMP Tue May 17 16:14:08 CEST 2016
/proc/sys/net/ipv4/ip_forward = 1
/proc/sys/net/ipv4/icmp_echo_ignore_all = 0
/proc/sys/net/ipv4/conf/all/proxy_arp = 0
/proc/sys/net/ipv4/conf/all/arp_filter = 0
/proc/sys/net/ipv4/conf/all/arp_ignore = 0
/proc/sys/net/ipv4/conf/all/rp_filter = 0
/proc/sys/net/ipv4/conf/all/log_martians = 0
/proc/sys/net/ipv4/conf/default/proxy_arp = 0
/proc/sys/net/ipv4/conf/default/arp_filter = 0
/proc/sys/net/ipv4/conf/default/arp_ignore = 0
/proc/sys/net/ipv4/conf/default/rp_filter = 0
/proc/sys/net/ipv4/conf/default/log_martians = 1
/proc/sys/net/ipv4/conf/eth0/proxy_arp = 0
/proc/sys/net/ipv4/conf/eth0/arp_filter = 0
/proc/sys/net/ipv4/conf/eth0/arp_ignore = 1
/proc/sys/net/ipv4/conf/eth0/rp_filter = 0
/proc/sys/net/ipv4/conf/eth0/log_martians = 1
/proc/sys/net/ipv4/conf/eth1/proxy_arp = 0
/proc/sys/net/ipv4/conf/eth1/arp_filter = 0
/proc/sys/net/ipv4/conf/eth1/arp_ignore = 0
/proc/sys/net/ipv4/conf/eth1/rp_filter = 0
/proc/sys/net/ipv4/conf/eth1/log_martians = 1
/proc/sys/net/ipv4/conf/eth2/proxy_arp = 0
/proc/sys/net/ipv4/conf/eth2/arp_filter = 0
/proc/sys/net/ipv4/conf/eth2/arp_ignore = 0
/proc/sys/net/ipv4/conf/eth2/rp_filter = 0
/proc/sys/net/ipv4/conf/eth2/log_martians = 1
/proc/sys/net/ipv4/conf/lo/proxy_arp = 0
/proc/sys/net/ipv4/conf/lo/arp_filter = 0
/proc/sys/net/ipv4/conf/lo/arp_ignore = 0
/proc/sys/net/ipv4/conf/lo/rp_filter = 0
/proc/sys/net/ipv4/conf/lo/log_martians = 1
/proc/sys/net/ipv4/conf/tap121i0/proxy_arp = 0
/proc/sys/net/ipv4/conf/tap121i0/arp_filter = 0
/proc/sys/net/ipv4/conf/tap121i0/arp_ignore = 0
/proc/sys/net/ipv4/conf/tap121i0/rp_filter = 0
/proc/sys/net/ipv4/conf/tap121i0/log_martians = 1
/proc/sys/net/ipv4/conf/tap123i0/proxy_arp = 0
/proc/sys/net/ipv4/conf/tap123i0/arp_filter = 0
/proc/sys/net/ipv4/conf/tap123i0/arp_ignore = 0
/proc/sys/net/ipv4/conf/tap123i0/rp_filter = 0
/proc/sys/net/ipv4/conf/tap123i0/log_martians = 1
/proc/sys/net/ipv4/conf/veth100i0/proxy_arp = 0
/proc/sys/net/ipv4/conf/veth100i0/arp_filter = 0
/proc/sys/net/ipv4/conf/veth100i0/arp_ignore = 0
/proc/sys/net/ipv4/conf/veth100i0/rp_filter = 0
/proc/sys/net/ipv4/conf/veth100i0/log_martians = 1
/proc/sys/net/ipv4/conf/veth101i0/proxy_arp = 0
/proc/sys/net/ipv4/conf/veth101i0/arp_filter = 0
/proc/sys/net/ipv4/conf/veth101i0/arp_ignore = 0
/proc/sys/net/ipv4/conf/veth101i0/rp_filter = 0
/proc/sys/net/ipv4/conf/veth101i0/log_martians = 1
/proc/sys/net/ipv4/conf/veth102i0/proxy_arp = 0
/proc/sys/net/ipv4/conf/veth102i0/arp_filter = 0
/proc/sys/net/ipv4/conf/veth102i0/arp_ignore = 0
/proc/sys/net/ipv4/conf/veth102i0/rp_filter = 0
/proc/sys/net/ipv4/conf/veth102i0/log_martians = 1
/proc/sys/net/ipv4/conf/vmbr0/proxy_arp = 0
/proc/sys/net/ipv4/conf/vmbr0/arp_filter = 0
/proc/sys/net/ipv4/conf/vmbr0/arp_ignore = 0
/proc/sys/net/ipv4/conf/vmbr0/rp_filter = 1
/proc/sys/net/ipv4/conf/vmbr0/log_martians = 1
/proc/sys/net/ipv4/conf/vmbr1/proxy_arp = 0
/proc/sys/net/ipv4/conf/vmbr1/arp_filter = 0
/proc/sys/net/ipv4/conf/vmbr1/arp_ignore = 0
/proc/sys/net/ipv4/conf/vmbr1/rp_filter = 1
/proc/sys/net/ipv4/conf/vmbr1/log_martians = 1
/proc/sys/net/ipv4/conf/vmbr2/proxy_arp = 0
/proc/sys/net/ipv4/conf/vmbr2/arp_filter = 0
/proc/sys/net/ipv4/conf/vmbr2/arp_ignore = 1
/proc/sys/net/ipv4/conf/vmbr2/rp_filter = 0
/proc/sys/net/ipv4/conf/vmbr2/log_martians = 1
ARP
? (10.0.0.2) auf 32:62:31:39:35:32 [ether] auf vmbr0
? (192.168.178.48) auf 58:94:6b:a4:2a:cc [ether] auf vmbr2
? (192.168.178.253) auf <unvollständig> auf vmbr2
? (192.168.178.121) auf b6:36:4a:2a:0d:12 [ether] auf vmbr2
? (10.0.0.253) auf 66:30:33:61:63:62 [ether] auf vmbr0
? (192.168.178.1) auf c8:0e:14:de:97:70 [ether] auf vmbr2
? (10.1.0.4) auf <unvollständig> auf vmbr1
? (10.0.0.252) auf 32:66:37:65:32:36 [ether] auf vmbr0
? (192.168.178.56) auf d8:90:e8:62:24:64 [ether] auf vmbr2
? (217.8.xx.xx) auf 00:01:5c:23:8e:01 [ether] auf eth0
? (192.168.178.49) auf f0:de:f1:42:30:19 [ether] auf vmbr2
Modules
ip_set 45056 2 ip_set_hash_ip,xt_set
ip_set_hash_ip 32768 0
iptable_filter 16384 1
iptable_mangle 16384 1
iptable_nat 16384 1
iptable_raw 16384 1
ip_tables 28672 4
iptable_filter,iptable_mangle,iptable_nat,iptable_raw
ipt_MASQUERADE 16384 0
ipt_REJECT 16384 4
ipt_rpfilter 16384 0
nf_conntrack 106496 32
nf_nat_ftp,nf_nat_irc,nf_nat_sip,nf_nat_amanda,xt_CT,nf_nat_snmp_basic,nf_conntrack_netbios_ns,nf_conntrack_proto_gre,xt_helper,nf_conntrack_proto_udplite,nf_nat,xt_connlimit,nf_nat_h323,nf_nat_ipv4,nf_nat_pptp,nf_nat_tftp,xt_conntrack,nf_conntrack_amanda,nf_nat_masquerade_ipv4,nf_conntrack_proto_sctp,nf_conntrack_netlink,nf_conntrack_broadcast,xt_connmark,nf_conntrack_ftp,nf_conntrack_irc,nf_conntrack_sip,nf_conntrack_h323,nf_conntrack_ipv4,nf_conntrack_pptp,nf_conntrack_sane,nf_conntrack_snmp,nf_conntrack_tftp
nf_conntrack_amanda 16384 3 nf_nat_amanda
nf_conntrack_broadcast 16384 2 nf_conntrack_netbios_ns,nf_conntrack_snmp
nf_conntrack_ftp 20480 3 nf_nat_ftp
nf_conntrack_h323 77824 5 nf_nat_h323
nf_conntrack_ipv4 16384 68
nf_conntrack_irc 16384 3 nf_nat_irc
nf_conntrack_netbios_ns 16384 2
nf_conntrack_netlink 36864 0
nf_conntrack_pptp 20480 3 nf_nat_pptp
nf_conntrack_proto_gre 16384 1 nf_conntrack_pptp
nf_conntrack_proto_sctp 20480 0
nf_conntrack_proto_udplite 16384 0
nf_conntrack_sane 16384 2
nf_conntrack_sip 28672 3 nf_nat_sip
nf_conntrack_snmp 16384 3 nf_nat_snmp_basic
nf_conntrack_tftp 16384 3 nf_nat_tftp
nf_defrag_ipv4 16384 2 xt_TPROXY,nf_conntrack_ipv4
nf_defrag_ipv6 36864 1 xt_TPROXY
nf_log_common 16384 1 nf_log_ipv4
nf_log_ipv4 16384 7
nf_nat 24576 11
nf_nat_ftp,nf_nat_irc,nf_nat_sip,nf_nat_amanda,nf_nat_proto_gre,nf_nat_h323,nf_nat_ipv4,nf_nat_pptp,nf_nat_tftp,xt_nat,nf_nat_masquerade_ipv4
nf_nat_amanda 16384 0
nf_nat_ftp 16384 0
nf_nat_h323 20480 0
nf_nat_ipv4 16384 1 iptable_nat
nf_nat_irc 16384 0
nf_nat_masquerade_ipv4 16384 1 ipt_MASQUERADE
nf_nat_pptp 16384 0
nf_nat_proto_gre 16384 1 nf_nat_pptp
nf_nat_sip 20480 0
nf_nat_snmp_basic 20480 0
nf_nat_tftp 16384 0
nf_reject_ipv4 16384 1 ipt_REJECT
xt_addrtype 16384 5
xt_AUDIT 16384 0
xt_CHECKSUM 16384 0
xt_CLASSIFY 16384 0
xt_comment 16384 27
xt_connlimit 16384 0
xt_connmark 16384 3
xt_conntrack 16384 42
xt_CT 16384 22
xt_dscp 16384 0
xt_DSCP 16384 0
xt_hashlimit 20480 0
xt_helper 16384 0
xt_iprange 16384 0
xt_length 16384 0
xt_limit 16384 2
xt_LOG 16384 7
xt_mark 16384 6
xt_multiport 16384 14
xt_nat 16384 4
xt_nfacct 16384 0
xt_NFLOG 16384 0
xt_NFQUEUE 16384 0
xt_owner 16384 0
xt_physdev 16384 0
xt_pkttype 16384 0
xt_policy 16384 0
xt_realm 16384 0
xt_recent 20480 1
xt_set 16384 0
xt_statistic 16384 0
xt_tcpmss 16384 0
xt_TCPMSS 16384 0
xt_tcpudp 16384 77
xt_time 16384 0
xt_TPROXY 20480 0
Shorewall has detected the following iptables/netfilter capabilities:
ACCOUNT Target (ACCOUNT_TARGET): Not available
Address Type Match (ADDRTYPE): Available
Amanda Helper: Available
Arptables JF (ARPTABLESJF): Not available
AUDIT Target (AUDIT_TARGET): Available
Basic Ematch (BASIC_EMATCH): Available
Basic Filter (BASIC_FILTER): Available
Capabilities Version (CAPVERSION): 50004
Checksum Target (CHECKSUM_TARGET): Available
CLASSIFY Target (CLASSIFY_TARGET): Available
Comments (COMMENTS): Available
Condition Match (CONDITION_MATCH): Not available
Connection Tracking Match (CONNTRACK_MATCH): Available
Connlimit Match (CONNLIMIT_MATCH): Available
Connmark Match (CONNMARK_MATCH): Available
CONNMARK Target (CONNMARK): Available
CT Target (CT_TARGET): Available
DSCP Match (DSCP_MATCH): Available
DSCP Target (DSCP_TARGET): Available
Enhanced Multi-port Match (EMULIPORT): Available
Extended Connection Tracking Match Support (NEW_CONNTRACK_MATCH): Available
Extended Connmark Match (XCONNMARK_MATCH): Available
Extended CONNMARK Target (XCONNMARK): Available
Extended MARK Target 2 (EXMARK): Available
Extended MARK Target (XMARK): Available
Extended Multi-port Match (XMULIPORT): Available
Extended REJECT (ENHANCED_REJECT): Available
FLOW Classifier (FLOW_FILTER): Available
FTP-0 Helper: Not available
FTP Helper: Available
fwmark route mask (FWMARK_RT_MASK): Available
Geo IP Match (GEOIP_MATCH): Not available
Goto Support (GOTO_TARGET): Available
H323 Helper: Available
Hashlimit Match (HASHLIMIT_MATCH): Available
Header Match (HEADER_MATCH): Not available
Helper Match (HELPER_MATCH): Available
Iface Match (IFACE_MATCH): Not available
IMQ Target (IMQ_TARGET): Not available
IPMARK Target (IPMARK_TARGET): Not available
IPP2P Match (IPP2P_MATCH): Not available
IP range Match(IPRANGE_MATCH): Available
Ipset Match Counters (IPSET_MATCH_COUNTERS): Available
Ipset Match (IPSET_MATCH): Available
Ipset Match Nomatch (IPSET_MATCH_NOMATCH): Available
ipset V5 (IPSET_V5): Available
iptables -S (IPTABLES_S): Available
iptables --wait option (WAIT_OPTION): Available
IRC-0 Helper: Not available
IRC Helper: Available
Kernel Version (KERNELVERSION): 40408
LOGMARK Target (LOGMARK_TARGET): Not available
LOG Target (LOG_TARGET): Available
Mangle FORWARD Chain (MANGLE_FORWARD): Available
Mark in the filter table (MARK_ANYWHERE): Available
MARK Target (MARK): Available
MASQUERADE Target (MASQUERADE_TGT): Available
Multi-port Match (MULTIPORT): Available
NAT (NAT_ENABLED): Available
Netbios_ns Helper: Available
New tos Match (NEW_TOS_MATCH): Available
NFAcct Match: Available
NFLOG Target (NFLOG_TARGET): Available
NFQUEUE Target (NFQUEUE_TARGET): Available
Owner Match (OWNER_MATCH): Available
Owner Name Match (OWNER_NAME_MATCH): Available
Packet length Match (LENGTH_MATCH): Available
Packet Mangling (MANGLE_ENABLED): Available
Packet Type Match (USEPKTTYPE): Available
Persistent SNAT (PERSISTENT_SNAT): Available
Physdev-is-bridged Support (PHYSDEV_BRIDGE): Available
Physdev Match (PHYSDEV_MATCH): Available
Policy Match (POLICY_MATCH): Available
PPTP Helper: Available
Rawpost Table (RAWPOST_TABLE): Not available
Raw Table (RAW_TABLE): Available
Realm Match (REALM_MATCH): Available
Recent Match "--reap" option (REAP_OPTION): Available
Recent Match (RECENT_MATCH): Available
Repeat match (KLUDGEFREE): Available
RPFilter Match (RPFILTER_MATCH): Available
SANE-0 Helper: Not available
SANE Helper: Available
SIP-0 Helper: Not available
SIP Helper: Available
SNMP Helper: Available
Statistic Match (STATISTIC_MATCH): Available
TARPIT Target (TARPIT_TARGET): Not available
TCPMSS Match (TCPMSS_MATCH): Available
TCPMSS Target (TCPMSS_TARGET): Available
TFTP-0 Helper: Not available
TFTP Helper: Available
Time Match (TIME_MATCH): Available
TPROXY Target (TPROXY_TARGET): Available
UDPLITE Port Redirection (UDPLITEREDIRECT): Not available
ULOG Target (ULOG_TARGET): Not available
Netid State Recv-Q Send-Q Local Address:Port Peer
Address:Port
udp UNCONN 0 0 *:68 *:*
users:(("dhclient",pid=608,fd=6))
udp UNCONN 0 0 *:111 *:*
users:(("rpcbind",pid=1117,fd=6))
udp UNCONN 0 0 *:12408 *:*
users:(("dhclient",pid=608,fd=20))
udp UNCONN 0 0 192.168.178.10:123 *:*
users:(("ntpd",pid=1419,fd=22))
udp UNCONN 0 0 10.1.0.1:123 *:*
users:(("ntpd",pid=1419,fd=21))
udp UNCONN 0 0 10.0.0.1:123 *:*
users:(("ntpd",pid=1419,fd=20))
udp UNCONN 0 0 217.8.xx.xx:123 *:*
users:(("ntpd",pid=1419,fd=19))
udp UNCONN 0 0 127.0.0.1:123 *:*
users:(("ntpd",pid=1419,fd=18))
udp UNCONN 0 0 *:123 *:*
users:(("ntpd",pid=1419,fd=16))
udp UNCONN 0 0 *:855 *:*
users:(("rpcbind",pid=1117,fd=7))
udp UNCONN 0 0 127.0.0.1:937 *:*
users:(("rpc.statd",pid=1185,fd=5))
udp UNCONN 0 0 *:54410 *:*
users:(("rpc.statd",pid=1185,fd=8))
udp UNCONN 0 0 *:56947 *:*
users:(("systemd-timesyn",pid=559,fd=13))
tcp LISTEN 0 128 127.0.0.1:85 *:*
users:(("pvedaemon worke",pid=27715,fd=6),("pvedaemon
worke",pid=27714,fd=6),("pvedaemon
worke",pid=27713,fd=6),("pvedaemon",pid=1896,fd=6))
tcp LISTEN 0 128 *:3128 *:*
users:(("spiceproxy work",pid=27774,fd=6),("spiceproxy",pid=7019,fd=6))
tcp LISTEN 0 128 *:58936 *:*
users:(("rpc.statd",pid=1185,fd=9))
tcp LISTEN 0 100 10.0.0.1:4505 *:*
users:(("salt-master",pid=26573,fd=17))
tcp LISTEN 0 100 127.0.0.1:25 *:*
users:(("master",pid=1700,fd=12))
tcp LISTEN 0 100 10.0.0.1:4506 *:*
users:(("salt-master",pid=26636,fd=25))
tcp LISTEN 0 128 *:8006 *:*
users:(("pveproxy worker",pid=27726,fd=6),("pveproxy
worker",pid=27724,fd=6),("pveproxy
worker",pid=27723,fd=6),("pveproxy",pid=7002,fd=6))
tcp LISTEN 0 128 *:2214 *:*
users:(("sshd",pid=1296,fd=3))
tcp LISTEN 0 1 127.0.0.1:61000 *:*
users:(("kvm",pid=25295,fd=20))
tcp LISTEN 0 5 127.0.0.1:5900 *:*
users:(("lxc-console",pid=7556,fd=4),("dtach",pid=7555,fd=4))
tcp LISTEN 0 128 *:111 *:*
users:(("rpcbind",pid=1117,fd=8))
tcp LISTEN 0 5 127.0.0.1:7634 *:*
users:(("hddtemp",pid=1488,fd=0))
tcp ESTAB 0 0 192.168.178.10:2214
192.168.178.49:41478
users:(("sshd",pid=23156,fd=3),("sshd",pid=23122,fd=3))
tcp ESTAB 0 0 10.0.0.1:60490 10.0.0.253:22253
users:(("ssh",pid=8266,fd=3))
tcp ESTAB 0 0 10.0.0.1:56468 10.0.0.2:2202
users:(("ssh",pid=20250,fd=3))
tcp ESTAB 0 0 10.0.0.1:56160 10.0.0.252:22252
users:(("ssh",pid=9450,fd=3))
Traffic Control
Device lo:
qdisc noqueue 0: root refcnt 2
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device eth0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1
1 1
Sent 69764194 bytes 1008406 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device eth1:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1
1 1
Sent 1751970019 bytes 5447876 pkt (dropped 0, overlimits 0 requeues 190)
backlog 0b 0p requeues 190
Device eth2:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1
1 1
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device vmbr0:
qdisc noqueue 0: root refcnt 2
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device vmbr1:
qdisc noqueue 0: root refcnt 2
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device vmbr2:
qdisc noqueue 0: root refcnt 2
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device tap123i0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1
1 1
Sent 1663546963 bytes 4553746 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device tap121i0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1
1 1
Sent 615229162 bytes 2758231 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device veth102i0:
qdisc noqueue 0: root refcnt 2
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device veth101i0:
qdisc noqueue 0: root refcnt 2
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Device veth100i0:
qdisc noqueue 0: root refcnt 2
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
TC Filters
Device lo:
Device eth0:
Device eth1:
Device eth2:
Device vmbr0:
Device vmbr1:
Device vmbr2:
Device tap123i0:
Device tap121i0:
Device veth102i0:
Device veth101i0:
Device veth100i0:
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
