sudo iptables-save-deterministic
*raw
:PREROUTING ACCEPT [0,0]
:OUTPUT ACCEPT [0,0]
-A PREROUTING -s 10.137.0.82/32 ! -i vif+ -j DROP
-A PREROUTING ! -s 10.137.0.82/32 -i vif11.0 -j DROP
COMMIT
*filter
:INPUT DROP [0,0]
:FORWARD DROP [0,0]
:OUTPUT DROP [0,0]
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m state --state INVALID -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -f -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -i vif+ -p tcp -m tcp --dport 8082 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3/4 -m state --state RELATED -j ACCEPT
-A INPUT -p icmp -j DROP
-A INPUT -i vif+ -p udp -m udp --dport 5300 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9040 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9051 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9050 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9100 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9101 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9102 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9103 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9104 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9105 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9106 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9107 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9108 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9109 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9110 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9111 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9114 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9115 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9117 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9118 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9122 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9123 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9124 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9125 -j ACCEPT
-A INPUT -i vif+ -p tcp -m tcp --dport 9150 -j ACCEPT
-A INPUT -i vif+ -p tcp -m multiport --dports 9152:9189 -j ACCEPT
-A INPUT -j DROP
-A FORWARD -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -o vif+ -p tcp -m tcp --sport 8082 -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -p udp -m owner --uid-owner 999 -m conntrack --ctstate NEW -m udp --dport 5400 -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -p tcp -m owner --uid-owner 999 -m conntrack --ctstate NEW -m tcp --dport 9041 -j ACCEPT
-A OUTPUT -m conntrack --ctstate INVALID -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -m state --state INVALID -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -f -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m owner --uid-owner 107 -j ACCEPT
-A OUTPUT -m owner --uid-owner 105 -j ACCEPT
-A OUTPUT -m owner --uid-owner 104 -j ACCEPT
-A OUTPUT -j REJECT --reject-with icmp-admin-prohibited
COMMIT
*nat
:PREROUTING ACCEPT [0,0]
:INPUT ACCEPT [0,0]
:OUTPUT ACCEPT [0,0]
:POSTROUTING ACCEPT [0,0]
:PR-QBS-SERVICES - [0,0]
-A PREROUTING -j PR-QBS-SERVICES
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9051 -j REDIRECT --to-ports 9051
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9051 -j REDIRECT --to-ports 9051
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9051 -j REDIRECT --to-ports 9051
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9050 -j REDIRECT --to-ports 9050
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9050 -j REDIRECT --to-ports 9050
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9050 -j REDIRECT --to-ports 9050
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9100 -j REDIRECT --to-ports 9100
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9100 -j REDIRECT --to-ports 9100
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9100 -j REDIRECT --to-ports 9100
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9101 -j REDIRECT --to-ports 9101
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9101 -j REDIRECT --to-ports 9101
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9101 -j REDIRECT --to-ports 9101
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9102 -j REDIRECT --to-ports 9102
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9102 -j REDIRECT --to-ports 9102
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9102 -j REDIRECT --to-ports 9102
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9103 -j REDIRECT --to-ports 9103
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9103 -j REDIRECT --to-ports 9103
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9103 -j REDIRECT --to-ports 9103
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9104 -j REDIRECT --to-ports 9104
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9104 -j REDIRECT --to-ports 9104
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9104 -j REDIRECT --to-ports 9104
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9105 -j REDIRECT --to-ports 9105
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9105 -j REDIRECT --to-ports 9105
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9105 -j REDIRECT --to-ports 9105
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9106 -j REDIRECT --to-ports 9106
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9106 -j REDIRECT --to-ports 9106
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9106 -j REDIRECT --to-ports 9106
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9107 -j REDIRECT --to-ports 9107
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9107 -j REDIRECT --to-ports 9107
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9107 -j REDIRECT --to-ports 9107
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9108 -j REDIRECT --to-ports 9108
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9108 -j REDIRECT --to-ports 9108
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9108 -j REDIRECT --to-ports 9108
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9109 -j REDIRECT --to-ports 9109
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9109 -j REDIRECT --to-ports 9109
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9109 -j REDIRECT --to-ports 9109
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9110 -j REDIRECT --to-ports 9110
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9110 -j REDIRECT --to-ports 9110
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9110 -j REDIRECT --to-ports 9110
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9111 -j REDIRECT --to-ports 9111
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9111 -j REDIRECT --to-ports 9111
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9111 -j REDIRECT --to-ports 9111
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9114 -j REDIRECT --to-ports 9114
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9114 -j REDIRECT --to-ports 9114
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9114 -j REDIRECT --to-ports 9114
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9115 -j REDIRECT --to-ports 9115
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9115 -j REDIRECT --to-ports 9115
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9115 -j REDIRECT --to-ports 9115
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9117 -j REDIRECT --to-ports 9117
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9117 -j REDIRECT --to-ports 9117
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9117 -j REDIRECT --to-ports 9117
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9118 -j REDIRECT --to-ports 9118
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9118 -j REDIRECT --to-ports 9118
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9118 -j REDIRECT --to-ports 9118
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9122 -j REDIRECT --to-ports 9122
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9122 -j REDIRECT --to-ports 9122
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9122 -j REDIRECT --to-ports 9122
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9123 -j REDIRECT --to-ports 9123
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9123 -j REDIRECT --to-ports 9123
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9123 -j REDIRECT --to-ports 9123
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9124 -j REDIRECT --to-ports 9124
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9124 -j REDIRECT --to-ports 9124
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9124 -j REDIRECT --to-ports 9124
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9125 -j REDIRECT --to-ports 9125
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9125 -j REDIRECT --to-ports 9125
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9125 -j REDIRECT --to-ports 9125
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9150 -j REDIRECT --to-ports 9150
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9150 -j REDIRECT --to-ports 9150
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9150 -j REDIRECT --to-ports 9150
-A PREROUTING -d 10.137.0.0/16 -i vif+ -p tcp -m tcp --dport 9152:9189 -j REDIRECT
-A PREROUTING -d 10.138.0.0/16 -i vif+ -p tcp -m tcp --dport 9152:9189 -j REDIRECT
-A PREROUTING -d 10.152.152.10/32 -i vif+ -p tcp -m tcp --dport 9152:9189 -j REDIRECT
-A PREROUTING -i vif+ -p udp -m udp --dport 53 -j REDIRECT --to-ports 5300
-A PREROUTING -i vif+ -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A OUTPUT -p udp -m owner --uid-owner 999 -m conntrack --ctstate NEW -j DNAT --to-destination 127.0.0.1:5400
-A OUTPUT -p tcp -m owner --uid-owner 999 -m conntrack --ctstate NEW -j DNAT --to-destination 127.0.0.1:9041
-A OUTPUT -m owner --uid-owner 107 -j RETURN
-A OUTPUT -m owner --uid-owner 105 -j RETURN
-A OUTPUT -m owner --uid-owner 104 -j RETURN
-A PR-QBS-SERVICES -d 10.137.255.254/32 -i vif+ -p tcp -m tcp --dport 8082 -j REDIRECT
COMMIT
