Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
c2826ec0c4
core-admin/netvm/iptables

23 lines
672 B
Plaintext
Raw Normal View History

Get rid of /sbin/iptables from qubes_core in netvm
2010-06-04 13:28:29 +02:00
# Generated by iptables-save v1.4.5 on Fri Jun 4 07:17:12 2010
Initial public commit. (c) 2010 Invisible Things Lab Authors: ========= Joanna Rutkowska <joanna@invisiblethingslab.com> Rafal Wojtczuk <rafal@invisiblethingslab.com>
2010-04-05 20:58:57 +02:00
*nat
Get rid of /sbin/iptables from qubes_core in netvm
2010-06-04 13:28:29 +02:00
:PREROUTING ACCEPT [8:818]
:POSTROUTING ACCEPT [1:84]
Get rid of dnsmasq in netvm. qubes_setup_dnat_to_ns script sets up DNAT rules for DNS traffic; it is triggered by dhclient or NetworkManager, and manually (in case there is a static resolv.conf). Put IP-dependent rules in qubes-core, after local ip is known. It could be further improved by introducing custom chains, to enable iptables save. Restrict FORWARD.
2010-05-19 16:19:01 +02:00
:OUTPUT ACCEPT [0:0]
Get rid of /sbin/iptables from qubes_core in netvm
2010-06-04 13:28:29 +02:00
-A POSTROUTING -o br+ -j ACCEPT
-A POSTROUTING -j MASQUERADE
Initial public commit. (c) 2010 Invisible Things Lab Authors: ========= Joanna Rutkowska <joanna@invisiblethingslab.com> Rafal Wojtczuk <rafal@invisiblethingslab.com>
2010-04-05 20:58:57 +02:00
COMMIT
Get rid of /sbin/iptables from qubes_core in netvm
2010-06-04 13:28:29 +02:00
# Completed on Fri Jun 4 07:17:12 2010
# Generated by iptables-save v1.4.5 on Fri Jun 4 07:17:12 2010
Initial public commit. (c) 2010 Invisible Things Lab Authors: ========= Joanna Rutkowska <joanna@invisiblethingslab.com> Rafal Wojtczuk <rafal@invisiblethingslab.com>
2010-04-05 20:58:57 +02:00
*filter
Get rid of /sbin/iptables from qubes_core in netvm
2010-06-04 13:28:29 +02:00
:INPUT ACCEPT [168:4704]
Initial public commit. (c) 2010 Invisible Things Lab Authors: ========= Joanna Rutkowska <joanna@invisiblethingslab.com> Rafal Wojtczuk <rafal@invisiblethingslab.com>
2010-04-05 20:58:57 +02:00
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
Get rid of dnsmasq in netvm. qubes_setup_dnat_to_ns script sets up DNAT rules for DNS traffic; it is triggered by dhclient or NetworkManager, and manually (in case there is a static resolv.conf). Put IP-dependent rules in qubes-core, after local ip is known. It could be further improved by introducing custom chains, to enable iptables save. Restrict FORWARD.
2010-05-19 16:19:01 +02:00
-A INPUT -i br+ -p udp -m udp --dport 68 -j DROP
Initial public commit. (c) 2010 Invisible Things Lab Authors: ========= Joanna Rutkowska <joanna@invisiblethingslab.com> Rafal Wojtczuk <rafal@invisiblethingslab.com>
2010-04-05 20:58:57 +02:00
-A INPUT -i vif+ -p udp -m udp --dport 68 -j DROP
Get rid of dnsmasq in netvm. qubes_setup_dnat_to_ns script sets up DNAT rules for DNS traffic; it is triggered by dhclient or NetworkManager, and manually (in case there is a static resolv.conf). Put IP-dependent rules in qubes-core, after local ip is known. It could be further improved by introducing custom chains, to enable iptables save. Restrict FORWARD.
2010-05-19 16:19:01 +02:00
-A FORWARD -i vif+ -j ACCEPT
-A FORWARD -i br+ -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j DROP
Initial public commit. (c) 2010 Invisible Things Lab Authors: ========= Joanna Rutkowska <joanna@invisiblethingslab.com> Rafal Wojtczuk <rafal@invisiblethingslab.com>
2010-04-05 20:58:57 +02:00
COMMIT
Get rid of /sbin/iptables from qubes_core in netvm
2010-06-04 13:28:29 +02:00
# Completed on Fri Jun 4 07:17:12 2010
Reference in New Issue Copy Permalink