Code: Select all
# nft list ruleset
table ip filter {
chain INPUT {
type filter hook input priority 0; policy accept;
}
chain FORWARD {
type filter hook forward priority 0; policy accept;
iifname "enp2s0" oifname "enp3s0" counter packets 4615527 bytes 2521888687 accept
iifname "enp3s0" oifname "enp2s0" ct state related,established counter packets 3295924 bytes 1845458107 accept
}
chain OUTPUT {
type filter hook output priority 0; policy accept;
}
}
table ip6 filter {
chain INPUT {
type filter hook input priority 0; policy accept;
}
chain FORWARD {
type filter hook forward priority 0; policy accept;
}
chain OUTPUT {
type filter hook output priority 0; policy accept;
}
}
table bridge filter {
chain INPUT {
type filter hook input priority -200; policy accept;
}
chain FORWARD {
type filter hook forward priority -200; policy accept;
}
chain OUTPUT {
type filter hook output priority -200; policy accept;
}
}
table ip security {
chain INPUT {
type filter hook input priority 150; policy accept;
}
chain FORWARD {
type filter hook forward priority 150; policy accept;
}
chain OUTPUT {
type filter hook output priority 150; policy accept;
}
}
table ip raw {
chain PREROUTING {
type filter hook prerouting priority -300; policy accept;
}
chain OUTPUT {
type filter hook output priority -300; policy accept;
}
}
table ip mangle {
chain PREROUTING {
type filter hook prerouting priority -150; policy accept;
}
chain INPUT {
type filter hook input priority -150; policy accept;
}
chain FORWARD {
type filter hook forward priority -150; policy accept;
}
chain OUTPUT {
type route hook output priority -150; policy accept;
}
chain POSTROUTING {
type filter hook postrouting priority -150; policy accept;
}
}
table ip nat {
chain PREROUTING {
type nat hook prerouting priority -100; policy accept;
}
chain INPUT {
type nat hook input priority 100; policy accept;
}
chain POSTROUTING {
type nat hook postrouting priority 100; policy accept;
oifname "enp3s0" counter packets 28282 bytes 1972845 masquerade
}
chain OUTPUT {
type nat hook output priority -100; policy accept;
}
chain postrouting {
type nat hook postrouting priority 100; policy accept;
}
}
table ip6 security {
chain INPUT {
type filter hook input priority 150; policy accept;
}
chain FORWARD {
type filter hook forward priority 150; policy accept;
}
chain OUTPUT {
type filter hook output priority 150; policy accept;
}
}
table ip6 raw {
chain PREROUTING {
type filter hook prerouting priority -300; policy accept;
}
chain OUTPUT {
type filter hook output priority -300; policy accept;
}
}
table ip6 mangle {
chain PREROUTING {
type filter hook prerouting priority -150; policy accept;
}
chain INPUT {
type filter hook input priority -150; policy accept;
}
chain FORWARD {
type filter hook forward priority -150; policy accept;
}
chain OUTPUT {
type route hook output priority -150; policy accept;
}
chain POSTROUTING {
type filter hook postrouting priority -150; policy accept;
}
}
table ip6 nat {
chain PREROUTING {
type nat hook prerouting priority -100; policy accept;
}
chain INPUT {
type nat hook input priority 100; policy accept;
}
chain POSTROUTING {
type nat hook postrouting priority 100; policy accept;
}
chain OUTPUT {
type nat hook output priority -100; policy accept;
}
}
table bridge nat {
chain PREROUTING {
type filter hook prerouting priority -300; policy accept;
}
chain OUTPUT {
type filter hook output priority 100; policy accept;
}
chain POSTROUTING {
type filter hook postrouting priority 300; policy accept;
}
}
table inet firewalld {
ct helper helper-netbios-ns-udp {
type "netbios-ns" protocol udp
l3proto ip
}
ct helper helper-tftp-udp {
type "tftp" protocol udp
l3proto inet
}
ct helper helper-amanda-udp {
type "amanda" protocol udp
l3proto inet
}
ct helper helper-ftp-tcp {
type "ftp" protocol tcp
l3proto inet
}
ct helper helper-sane-tcp {
type "sane" protocol tcp
l3proto inet
}
ct helper helper-sip-tcp {
type "sip" protocol tcp
l3proto inet
}
ct helper helper-sip-udp {
type "sip" protocol udp
l3proto inet
}
chain raw_PREROUTING {
type filter hook prerouting priority -290; policy accept;
icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
meta nfproto ipv6 fib saddr . iif oif missing log prefix "rpfilter_DROP: " drop
jump raw_PREROUTING_ZONES
}
chain raw_PREROUTING_ZONES {
iifname "enp2s0" goto raw_PRE_internal
iifname "enp3s0" goto raw_PRE_external
goto raw_PRE_public
}
chain mangle_PREROUTING {
type filter hook prerouting priority -140; policy accept;
jump mangle_PREROUTING_ZONES
}
chain mangle_PREROUTING_ZONES {
iifname "enp2s0" goto mangle_PRE_internal
iifname "enp3s0" goto mangle_PRE_external
goto mangle_PRE_public
}
chain filter_INPUT {
type filter hook input priority 10; policy accept;
ct state established,related accept
ct status dnat accept
iifname "lo" accept
jump filter_INPUT_ZONES
ct state invalid log prefix "STATE_INVALID_DROP: "
ct state invalid drop
log prefix "FINAL_REJECT: "
reject with icmpx type admin-prohibited
}
chain filter_FORWARD {
type filter hook forward priority 10; policy accept;
ct state established,related accept
ct status dnat accept
iifname "lo" accept
ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } log prefix "RFC3964_IPv4_REJECT: " reject with icmpv6 type addr-unreachable
jump filter_FORWARD_IN_ZONES
jump filter_FORWARD_OUT_ZONES
ct state invalid log prefix "STATE_INVALID_DROP: "
ct state invalid drop
log prefix "FINAL_REJECT: "
reject with icmpx type admin-prohibited
}
chain filter_OUTPUT {
type filter hook output priority 10; policy accept;
oifname "lo" accept
ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } log prefix "RFC3964_IPv4_REJECT: " reject with icmpv6 type addr-unreachable
}
chain filter_INPUT_ZONES {
iifname "enp2s0" goto filter_IN_internal
iifname "enp3s0" goto filter_IN_external
goto filter_IN_public
}
chain filter_FORWARD_IN_ZONES {
iifname "enp2s0" goto filter_FWDI_internal
iifname "enp3s0" goto filter_FWDI_external
goto filter_FWDI_public
}
chain filter_FORWARD_OUT_ZONES {
oifname "enp2s0" goto filter_FWDO_internal
oifname "enp3s0" goto filter_FWDO_external
goto filter_FWDO_public
}
chain raw_PRE_public {
jump raw_PRE_public_pre
jump raw_PRE_public_log
jump raw_PRE_public_deny
jump raw_PRE_public_allow
jump raw_PRE_public_post
}
chain raw_PRE_public_pre {
}
chain raw_PRE_public_log {
}
chain raw_PRE_public_deny {
}
chain raw_PRE_public_allow {
}
chain raw_PRE_public_post {
}
chain filter_IN_public {
jump filter_IN_public_pre
jump filter_IN_public_log
jump filter_IN_public_deny
jump filter_IN_public_allow
jump filter_IN_public_post
meta l4proto { icmp, ipv6-icmp } accept
}
chain filter_IN_public_pre {
}
chain filter_IN_public_log {
}
chain filter_IN_public_deny {
}
chain filter_IN_public_allow {
tcp dport ssh ct state new,untracked accept
ip6 daddr fe80::/64 udp dport dhcpv6-client ct state new,untracked accept
tcp dport 3389 ct state new,untracked accept
tcp dport 5201 ct state new,untracked accept
}
chain filter_IN_public_post {
}
chain filter_FWDI_public {
jump filter_FWDI_public_pre
jump filter_FWDI_public_log
jump filter_FWDI_public_deny
jump filter_FWDI_public_allow
jump filter_FWDI_public_post
meta l4proto { icmp, ipv6-icmp } accept
}
chain filter_FWDI_public_pre {
}
chain filter_FWDI_public_log {
}
chain filter_FWDI_public_deny {
}
chain filter_FWDI_public_allow {
}
chain filter_FWDI_public_post {
}
chain mangle_PRE_public {
jump mangle_PRE_public_pre
jump mangle_PRE_public_log
jump mangle_PRE_public_deny
jump mangle_PRE_public_allow
jump mangle_PRE_public_post
}
chain mangle_PRE_public_pre {
}
chain mangle_PRE_public_log {
}
chain mangle_PRE_public_deny {
}
chain mangle_PRE_public_allow {
}
chain mangle_PRE_public_post {
}
chain filter_FWDO_public {
jump filter_FWDO_public_pre
jump filter_FWDO_public_log
jump filter_FWDO_public_deny
jump filter_FWDO_public_allow
jump filter_FWDO_public_post
}
chain filter_FWDO_public_pre {
}
chain filter_FWDO_public_log {
}
chain filter_FWDO_public_deny {
}
chain filter_FWDO_public_allow {
}
chain filter_FWDO_public_post {
}
chain raw_PRE_external {
jump raw_PRE_external_pre
jump raw_PRE_external_log
jump raw_PRE_external_deny
jump raw_PRE_external_allow
jump raw_PRE_external_post
}
chain raw_PRE_external_pre {
}
chain raw_PRE_external_log {
}
chain raw_PRE_external_deny {
}
chain raw_PRE_external_allow {
}
chain raw_PRE_external_post {
}
chain filter_IN_external {
jump filter_IN_external_pre
jump filter_IN_external_log
jump filter_IN_external_deny
jump filter_IN_external_allow
jump filter_IN_external_post
log prefix "filter_IN_external_REJECT: "
reject with icmpx type admin-prohibited
}
chain filter_IN_external_pre {
}
chain filter_IN_external_log {
ip saddr 205.166.94.0/24 tcp dport ssh ct state new,untracked log level notice
}
chain filter_IN_external_deny {
}
chain filter_IN_external_allow {
tcp dport https ct state new,untracked accept
tcp dport http ct state new,untracked accept
tcp dport smtp ct state new,untracked accept
tcp dport urd ct state new,untracked accept
tcp dport imap2 ct state new,untracked accept
tcp dport imaps ct state new,untracked accept
ip saddr 205.166.94.0/24 tcp dport ssh ct state new,untracked accept
}
chain filter_IN_external_post {
}
chain filter_FWDO_external {
jump filter_FWDO_external_pre
jump filter_FWDO_external_log
jump filter_FWDO_external_deny
jump filter_FWDO_external_allow
jump filter_FWDO_external_post
log prefix "filter_FWDO_external_REJECT: "
reject with icmpx type admin-prohibited
}
chain filter_FWDO_external_pre {
}
chain filter_FWDO_external_log {
}
chain filter_FWDO_external_deny {
}
chain filter_FWDO_external_allow {
ct state new,untracked accept
}
chain filter_FWDO_external_post {
}
chain mangle_PRE_external {
jump mangle_PRE_external_pre
jump mangle_PRE_external_log
jump mangle_PRE_external_deny
jump mangle_PRE_external_allow
jump mangle_PRE_external_post
}
chain mangle_PRE_external_pre {
}
chain mangle_PRE_external_log {
}
chain mangle_PRE_external_deny {
}
chain mangle_PRE_external_allow {
}
chain mangle_PRE_external_post {
}
chain filter_FWDI_external {
jump filter_FWDI_external_pre
jump filter_FWDI_external_log
jump filter_FWDI_external_deny
jump filter_FWDI_external_allow
jump filter_FWDI_external_post
log prefix "filter_FWDI_external_REJECT: "
reject with icmpx type admin-prohibited
}
chain filter_FWDI_external_pre {
}
chain filter_FWDI_external_log {
}
chain filter_FWDI_external_deny {
}
chain filter_FWDI_external_allow {
}
chain filter_FWDI_external_post {
}
chain raw_PRE_internal {
jump raw_PRE_internal_pre
jump raw_PRE_internal_log
jump raw_PRE_internal_deny
jump raw_PRE_internal_allow
jump raw_PRE_internal_post
}
chain raw_PRE_internal_pre {
}
chain raw_PRE_internal_log {
}
chain raw_PRE_internal_deny {
}
chain raw_PRE_internal_allow {
}
chain raw_PRE_internal_post {
}
chain filter_IN_internal {
jump filter_IN_internal_pre
jump filter_IN_internal_log
jump filter_IN_internal_deny
jump filter_IN_internal_allow
jump filter_IN_internal_post
accept
}
chain filter_IN_internal_pre {
}
chain filter_IN_internal_log {
}
chain filter_IN_internal_deny {
}
chain filter_IN_internal_allow {
tcp dport ssh ct state new,untracked accept
ip daddr 224.0.0.251 udp dport mdns ct state new,untracked accept
ip6 daddr ff02::fb udp dport mdns ct state new,untracked accept
udp dport netbios-ns ct helper set "helper-netbios-ns-udp"
udp dport netbios-ns ct state new,untracked accept
udp dport netbios-dgm ct state new,untracked accept
ip6 daddr fe80::/64 udp dport dhcpv6-client ct state new,untracked accept
udp dport dhcpv6-server ct state new,untracked accept
udp dport bootps ct state new,untracked accept
tcp dport domain ct state new,untracked accept
udp dport domain ct state new,untracked accept
tcp dport imaps ct state new,untracked accept
udp dport isakmp ct state new,untracked accept
udp dport ipsec-nat-t ct state new,untracked accept
meta l4proto ah ct state new,untracked accept
meta l4proto esp ct state new,untracked accept
tcp dport ircd ct state new,untracked accept
tcp dport 6697 ct state new,untracked accept
tcp dport kerberos-adm ct state new,untracked accept
tcp dport klogin ct state new,untracked accept
tcp dport kpasswd ct state new,untracked accept
udp dport kpasswd ct state new,untracked accept
tcp dport krb-prop ct state new,untracked accept
tcp dport kshell ct state new,untracked accept
tcp dport mysql ct state new,untracked accept
udp dport ntp ct state new,untracked accept
udp dport openvpn ct state new,untracked accept
tcp dport pop3 ct state new,untracked accept
tcp dport pop3s ct state new,untracked accept
tcp dport shell ct state new,untracked accept
tcp dport rsync ct state new,untracked accept
udp dport rsync ct state new,untracked accept
tcp dport netbios-ssn ct state new,untracked accept
tcp dport microsoft-ds ct state new,untracked accept
tcp dport smtp ct state new,untracked accept
tcp dport urd ct state new,untracked accept
tcp dport submission ct state new,untracked accept
tcp dport snmp ct state new,untracked accept
udp dport snmp ct state new,untracked accept
tcp dport syslog-tls ct state new,untracked accept
udp dport syslog-tls ct state new,untracked accept
tcp dport telnet ct state new,untracked accept
udp dport tftp ct helper set "helper-tftp-udp"
udp dport tftp ct state new,untracked accept
tcp dport 51413 ct state new,untracked accept
udp dport 51413 ct state new,untracked accept
tcp dport 5900-5903 ct state new,untracked accept
tcp dport 3389 ct state new,untracked accept
udp dport amanda ct helper set "helper-amanda-udp"
udp dport amanda ct state new,untracked accept
tcp dport amanda ct state new,untracked accept
tcp dport amandaidx ct state new,untracked accept
tcp dport amqp ct state new,untracked accept
tcp dport amqps ct state new,untracked accept
tcp dport 3551 ct state new,untracked accept
tcp dport 60 ct state new,untracked accept
tcp dport bacula-dir ct state new,untracked accept
tcp dport bacula-fd ct state new,untracked accept
tcp dport bacula-sd ct state new,untracked accept
tcp dport 1984 ct state new,untracked accept
udp dport 1984 ct state new,untracked accept
tcp dport bgp ct state new,untracked accept
tcp dport 8333 ct state new,untracked accept
tcp dport 8332 ct state new,untracked accept
tcp dport 18333 ct state new,untracked accept
tcp dport 18332 ct state new,untracked accept
ip daddr 239.192.152.143 udp dport 6771 ct state new,untracked accept
ip6 daddr ff15::efc0:988f udp dport 6771 ct state new,untracked accept
tcp dport 6800-7300 ct state new,untracked accept
tcp dport 3300 ct state new,untracked accept
tcp dport 6789 ct state new,untracked accept
tcp dport cfengine ct state new,untracked accept
tcp dport 9090 ct state new,untracked accept
tcp dport 9618 ct state new,untracked accept
tcp dport 4379 ct state new,untracked accept
udp dport 4379 ct state new,untracked accept
tcp dport distcc ct state new,untracked accept
tcp dport 853 ct state new,untracked accept
tcp dport 5000 ct state new,untracked accept
udp dport db-lsp ct state new,untracked accept
tcp dport db-lsp ct state new,untracked accept
tcp dport 2377 ct state new,untracked accept
tcp dport 7946 ct state new,untracked accept
udp dport 7946 ct state new,untracked accept
udp dport 4789 ct state new,untracked accept
tcp dport 9300 ct state new,untracked accept
tcp dport 9200 ct state new,untracked accept
tcp dport 2379 ct state new,untracked accept
tcp dport 2380 ct state new,untracked accept
tcp dport finger ct state new,untracked accept
tcp dport http ct state new,untracked accept
tcp dport https ct state new,untracked accept
tcp dport kerberos ct state new,untracked accept
udp dport kerberos ct state new,untracked accept
tcp dport ldap ct state new,untracked accept
tcp dport ldaps ct state new,untracked accept
tcp dport 7389 ct state new,untracked accept
tcp dport loc-srv ct state new,untracked accept
tcp dport 138-139 ct state new,untracked accept
udp dport 138-139 ct state new,untracked accept
udp dport ldap ct state new,untracked accept
udp dport microsoft-ds ct state new,untracked accept
tcp dport 1024-1300 ct state new,untracked accept
tcp dport 3268 ct state new,untracked accept
tcp dport ftp ct helper set "helper-ftp-tcp"
tcp dport ftp ct state new,untracked accept
tcp dport 8660 ct state new,untracked accept
tcp dport 8651 ct state new,untracked accept
tcp dport git ct state new,untracked accept
tcp dport 3000 ct state new,untracked accept
meta l4proto gre ct state new,untracked accept
tcp dport 2224 ct state new,untracked accept
tcp dport 3121 ct state new,untracked accept
tcp dport 5403 ct state new,untracked accept
udp dport 5404 ct state new,untracked accept
udp dport 5405-5412 ct state new,untracked accept
tcp dport 9929 ct state new,untracked accept
udp dport 9929 ct state new,untracked accept
tcp dport 21064 ct state new,untracked accept
tcp dport imap2 ct state new,untracked accept
tcp dport ipp ct state new,untracked accept
udp dport ipp ct state new,untracked accept
tcp dport iscsi-target ct state new,untracked accept
udp dport iscsi-target ct state new,untracked accept
tcp dport 3205 ct state new,untracked accept
udp dport 3205 ct state new,untracked accept
tcp dport http-alt ct state new,untracked accept
tcp dport 1714-1764 ct state new,untracked accept
udp dport 1714-1764 ct state new,untracked accept
tcp dport 5601 ct state new,untracked accept
tcp dport 16509 ct state new,untracked accept
tcp dport 16514 ct state new,untracked accept
tcp dport 9735 ct state new,untracked accept
tcp dport hostmon ct state new,untracked accept
udp dport hostmon ct state new,untracked accept
tcp dport sieve ct state new,untracked accept
tcp dport 8448 ct state new,untracked accept
tcp dport 11211 ct state new,untracked accept
udp dport 11211 ct state new,untracked accept
tcp dport 8200 ct state new,untracked accept
udp dport 1900 ct state new,untracked accept
tcp dport 27017 ct state new,untracked accept
udp dport 60000-61000 ct state new,untracked accept
tcp dport 20048 ct state new,untracked accept
udp dport 20048 ct state new,untracked accept
tcp dport 1883 ct state new,untracked accept
tcp dport 8883 ct state new,untracked accept
tcp dport ms-sql-s ct state new,untracked accept
tcp dport 64738 ct state new,untracked accept
udp dport 64738 ct state new,untracked accept
tcp dport nfs ct state new,untracked accept
udp dport nfs ct state new,untracked accept
tcp dport 10110 ct state new,untracked accept
udp dport 10110 ct state new,untracked accept
tcp dport nrpe ct state new,untracked accept
tcp dport nut ct state new,untracked accept
tcp dport 54322 ct state new,untracked accept
tcp dport 55863 ct state new,untracked accept
tcp dport 39543 ct state new,untracked accept
tcp dport 2223 ct state new,untracked accept
tcp dport 32400 ct state new,untracked accept
udp dport 32400 ct state new,untracked accept
tcp dport 32469 ct state new,untracked accept
tcp dport 3005 ct state new,untracked accept
tcp dport 8324 ct state new,untracked accept
udp dport 32410 ct state new,untracked accept
udp dport 32412 ct state new,untracked accept
udp dport 32413 ct state new,untracked accept
udp dport 32414 ct state new,untracked accept
tcp dport 44321 ct state new,untracked accept
tcp dport 44322 ct state new,untracked accept
tcp dport 44323 ct state new,untracked accept
tcp dport 44324 ct state new,untracked accept
tcp dport postgresql ct state new,untracked accept
tcp dport 8118 ct state new,untracked accept
udp dport 4011 ct state new,untracked accept
udp dport 319 ct state new,untracked accept
udp dport 320 ct state new,untracked accept
tcp dport 4713 ct state new,untracked accept
tcp dport 8140 ct state new,untracked accept
tcp dport 4242 ct state new,untracked accept
tcp dport radius ct state new,untracked accept
udp dport radius ct state new,untracked accept
tcp dport radius-acct ct state new,untracked accept
udp dport radius-acct ct state new,untracked accept
tcp dport 6379 ct state new,untracked accept
tcp dport 26379 ct state new,untracked accept
udp dport bootpc ct state new,untracked accept
tcp dport 5646-5647 ct state new,untracked accept
tcp dport 8000 ct state new,untracked accept
tcp dport sunrpc ct state new,untracked accept
udp dport sunrpc ct state new,untracked accept
tcp dport rtsp ct state new,untracked accept
udp dport rtsp ct state new,untracked accept
tcp dport 4505 ct state new,untracked accept
tcp dport 4506 ct state new,untracked accept
tcp dport 49152-65535 ct state new,untracked accept
tcp dport 3269 ct state new,untracked accept
tcp dport sane-port ct helper set "helper-sane-tcp"
tcp dport sane-port ct state new,untracked accept
tcp dport sip ct helper set "helper-sip-tcp"
udp dport sip ct helper set "helper-sip-udp"
tcp dport sip ct state new,untracked accept
udp dport sip ct state new,untracked accept
tcp dport sip-tls ct state new,untracked accept
udp dport sip-tls ct state new,untracked accept
tcp dport svrloc ct state new,untracked accept
udp dport svrloc ct state new,untracked accept
tcp dport snmp-trap ct state new,untracked accept
udp dport snmp-trap ct state new,untracked accept
udp dport 21327 ct state new,untracked accept
udp dport 21328 ct state new,untracked accept
udp dport 57621 ct state new,untracked accept
tcp dport 57621 ct state new,untracked accept
tcp dport 3128 ct state new,untracked accept
ip daddr 239.255.255.250 udp dport 1900 ct state new,untracked accept
ip6 daddr ff02::c udp dport 1900 ct state new,untracked accept
tcp dport 27036 ct state new,untracked accept
tcp dport 27037 ct state new,untracked accept
udp dport 27031-27036 ct state new,untracked accept
tcp dport 6419 ct state new,untracked accept
udp dport 6419 ct state new,untracked accept
tcp dport svn ct state new,untracked accept
tcp dport 22000 ct state new,untracked accept
udp dport 21027 ct state new,untracked accept
tcp dport 8384 ct state new,untracked accept
tcp dport 24800 ct state new,untracked accept
udp dport shell ct state new,untracked accept
tcp dport 41121 ct state new,untracked accept
tcp dport 9851 ct state new,untracked accept
tcp dport tinc ct state new,untracked accept
udp dport tinc ct state new,untracked accept
tcp dport 9050 ct state new,untracked accept
udp sport 1900 ct state new,untracked accept
tcp dport 54321 ct state new,untracked accept
tcp dport 5900-6923 ct state new,untracked accept
tcp dport 49152-49216 ct state new,untracked accept
tcp dport 5988 ct state new,untracked accept
tcp dport 5989 ct state new,untracked accept
tcp dport 5985 ct state new,untracked accept
tcp dport 5986 ct state new,untracked accept
tcp dport xdmcp ct state new,untracked accept
udp dport xdmcp ct state new,untracked accept
tcp dport 5280 ct state new,untracked accept
tcp dport xmpp-client ct state new,untracked accept
tcp dport 5298 ct state new,untracked accept
tcp dport xmpp-server ct state new,untracked accept
tcp dport zabbix-agent ct state new,untracked accept
tcp dport zabbix-trapper ct state new,untracked accept
tcp dport 5201 ct state new,untracked accept
}
chain filter_IN_internal_post {
}
chain mangle_PRE_internal {
jump mangle_PRE_internal_pre
jump mangle_PRE_internal_log
jump mangle_PRE_internal_deny
jump mangle_PRE_internal_allow
jump mangle_PRE_internal_post
}
chain mangle_PRE_internal_pre {
}
chain mangle_PRE_internal_log {
}
chain mangle_PRE_internal_deny {
}
chain mangle_PRE_internal_allow {
}
chain mangle_PRE_internal_post {
}
chain filter_FWDI_internal {
jump filter_FWDI_internal_pre
jump filter_FWDI_internal_log
jump filter_FWDI_internal_deny
jump filter_FWDI_internal_allow
jump filter_FWDI_internal_post
accept
}
chain filter_FWDI_internal_pre {
}
chain filter_FWDI_internal_log {
}
chain filter_FWDI_internal_deny {
}
chain filter_FWDI_internal_allow {
}
chain filter_FWDI_internal_post {
}
chain filter_FWDO_internal {
jump filter_FWDO_internal_pre
jump filter_FWDO_internal_log
jump filter_FWDO_internal_deny
jump filter_FWDO_internal_allow
jump filter_FWDO_internal_post
accept
}
chain filter_FWDO_internal_pre {
}
chain filter_FWDO_internal_log {
}
chain filter_FWDO_internal_deny {
}
chain filter_FWDO_internal_allow {
}
chain filter_FWDO_internal_post {
}
}
table ip firewalld {
chain nat_PREROUTING {
type nat hook prerouting priority -90; policy accept;
jump nat_PREROUTING_ZONES
}
chain nat_PREROUTING_ZONES {
iifname "enp2s0" goto nat_PRE_internal
iifname "enp3s0" goto nat_PRE_external
goto nat_PRE_public
}
chain nat_POSTROUTING {
type nat hook postrouting priority 110; policy accept;
jump nat_POSTROUTING_ZONES
}
chain nat_POSTROUTING_ZONES {
oifname "enp2s0" goto nat_POST_internal
oifname "enp3s0" goto nat_POST_external
goto nat_POST_public
}
chain nat_PRE_public {
jump nat_PRE_public_pre
jump nat_PRE_public_log
jump nat_PRE_public_deny
jump nat_PRE_public_allow
jump nat_PRE_public_post
}
chain nat_PRE_public_pre {
}
chain nat_PRE_public_log {
}
chain nat_PRE_public_deny {
}
chain nat_PRE_public_allow {
}
chain nat_PRE_public_post {
}
chain nat_POST_public {
jump nat_POST_public_pre
jump nat_POST_public_log
jump nat_POST_public_deny
jump nat_POST_public_allow
jump nat_POST_public_post
}
chain nat_POST_public_pre {
}
chain nat_POST_public_log {
}
chain nat_POST_public_deny {
}
chain nat_POST_public_allow {
}
chain nat_POST_public_post {
}
chain nat_POST_external {
jump nat_POST_external_pre
jump nat_POST_external_log
jump nat_POST_external_deny
jump nat_POST_external_allow
jump nat_POST_external_post
}
chain nat_POST_external_pre {
}
chain nat_POST_external_log {
}
chain nat_POST_external_deny {
}
chain nat_POST_external_allow {
oifname != "lo" masquerade
}
chain nat_POST_external_post {
}
chain nat_PRE_external {
jump nat_PRE_external_pre
jump nat_PRE_external_log
jump nat_PRE_external_deny
jump nat_PRE_external_allow
jump nat_PRE_external_post
}
chain nat_PRE_external_pre {
}
chain nat_PRE_external_log {
}
chain nat_PRE_external_deny {
}
chain nat_PRE_external_allow {
}
chain nat_PRE_external_post {
}
chain nat_PRE_internal {
jump nat_PRE_internal_pre
jump nat_PRE_internal_log
jump nat_PRE_internal_deny
jump nat_PRE_internal_allow
jump nat_PRE_internal_post
}
chain nat_PRE_internal_pre {
}
chain nat_PRE_internal_log {
}
chain nat_PRE_internal_deny {
}
chain nat_PRE_internal_allow {
}
chain nat_PRE_internal_post {
}
chain nat_POST_internal {
jump nat_POST_internal_pre
jump nat_POST_internal_log
jump nat_POST_internal_deny
jump nat_POST_internal_allow
jump nat_POST_internal_post
}
chain nat_POST_internal_pre {
}
chain nat_POST_internal_log {
}
chain nat_POST_internal_deny {
}
chain nat_POST_internal_allow {
}
chain nat_POST_internal_post {
}
}
table ip6 firewalld {
chain nat_PREROUTING {
type nat hook prerouting priority -90; policy accept;
jump nat_PREROUTING_ZONES
}
chain nat_PREROUTING_ZONES {
iifname "enp2s0" goto nat_PRE_internal
iifname "enp3s0" goto nat_PRE_external
goto nat_PRE_public
}
chain nat_POSTROUTING {
type nat hook postrouting priority 110; policy accept;
jump nat_POSTROUTING_ZONES
}
chain nat_POSTROUTING_ZONES {
oifname "enp2s0" goto nat_POST_internal
oifname "enp3s0" goto nat_POST_external
goto nat_POST_public
}
chain nat_PRE_public {
jump nat_PRE_public_pre
jump nat_PRE_public_log
jump nat_PRE_public_deny
jump nat_PRE_public_allow
jump nat_PRE_public_post
}
chain nat_PRE_public_pre {
}
chain nat_PRE_public_log {
}
chain nat_PRE_public_deny {
}
chain nat_PRE_public_allow {
}
chain nat_PRE_public_post {
}
chain nat_POST_public {
jump nat_POST_public_pre
jump nat_POST_public_log
jump nat_POST_public_deny
jump nat_POST_public_allow
jump nat_POST_public_post
}
chain nat_POST_public_pre {
}
chain nat_POST_public_log {
}
chain nat_POST_public_deny {
}
chain nat_POST_public_allow {
}
chain nat_POST_public_post {
}
chain nat_POST_external {
jump nat_POST_external_pre
jump nat_POST_external_log
jump nat_POST_external_deny
jump nat_POST_external_allow
jump nat_POST_external_post
}
chain nat_POST_external_pre {
}
chain nat_POST_external_log {
}
chain nat_POST_external_deny {
}
chain nat_POST_external_allow {
oifname != "lo" masquerade
}
chain nat_POST_external_post {
}
chain nat_PRE_external {
jump nat_PRE_external_pre
jump nat_PRE_external_log
jump nat_PRE_external_deny
jump nat_PRE_external_allow
jump nat_PRE_external_post
}
chain nat_PRE_external_pre {
}
chain nat_PRE_external_log {
}
chain nat_PRE_external_deny {
}
chain nat_PRE_external_allow {
}
chain nat_PRE_external_post {
}
chain nat_PRE_internal {
jump nat_PRE_internal_pre
jump nat_PRE_internal_log
jump nat_PRE_internal_deny
jump nat_PRE_internal_allow
jump nat_PRE_internal_post
}
chain nat_PRE_internal_pre {
}
chain nat_PRE_internal_log {
}
chain nat_PRE_internal_deny {
}
chain nat_PRE_internal_allow {
}
chain nat_PRE_internal_post {
}
chain nat_POST_internal {
jump nat_POST_internal_pre
jump nat_POST_internal_log
jump nat_POST_internal_deny
jump nat_POST_internal_allow
jump nat_POST_internal_post
}
chain nat_POST_internal_pre {
}
chain nat_POST_internal_log {
}
chain nat_POST_internal_deny {
}
chain nat_POST_internal_allow {
}
chain nat_POST_internal_post {
}
}