-P FORWARD DROP
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -i ppp+ -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i eth2.2 -m state --state NEW -j doslimit
-A FORWARD -i br0 -j ACCEPT
-A FORWARD -o eth2.2 -j vpnlist
-A FORWARD -d 88.198.46.60/32 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
Chain FORWARD (policy DROP)
num target prot opt source destination
1 ACCEPT all -- anywhere anywhere
2 TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
3 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
4 DROP all -- anywhere anywhere state INVALID
5 doslimit all -- anywhere anywhere state NEW
6 ACCEPT all -- anywhere anywhere
7 vpnlist all -- anywhere anywhere
8 REJECT all -- anywhere faces.eu reject-with icmp-port-unreachable
9 ACCEPT all -- anywhere anywhere ctstate DNAT
# Generated by iptables-save v1.4.16.3 on Wed Mar 1 20:44:25 2017
*filter
:INPUT DROP [464:65696]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [970859:42779044]
:bfplimit - [0:0]
:doslimit - [0:0]
:upnp - [0:0]
:vpnlist - [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i br0 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -i eth2.2 -m state --state NEW -j doslimit
-A INPUT -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A INPUT -d 192.168.1.1/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 51413 -j ACCEPT
-A INPUT -p udp -m udp --dport 51413 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT
-A INPUT -p gre -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j vpnlist
-A INPUT -p icmp -m icmp ! --icmp-type 8 -j ACCEPT
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -i ppp+ -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i eth2.2 -m state --state NEW -j doslimit
-A FORWARD -i br0 -j ACCEPT
-A FORWARD -o eth2.2 -j vpnlist
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
-A doslimit -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 20/sec --limit-burst 30 -j RETURN
-A doslimit -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A doslimit -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN
-A doslimit -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP
-A doslimit -p icmp -m icmp --icmp-type 8 -m limit --limit 2/sec -j RETURN
-A doslimit -p icmp -m icmp --icmp-type 8 -j DROP
-A upnp -d 192.168.1.2/32 -p udp -m udp --dport 4500 -j ACCEPT
-A upnp -d 192.168.1.2/32 -p udp -m udp --dport 5353 -j ACCEPT
-A upnp -d 192.168.1.2/32 -p tcp -m tcp --dport 51413 -j ACCEPT
-A upnp -d 192.168.1.2/32 -p udp -m udp --dport 51413 -j ACCEPT
-A upnp -d 192.168.1.3/32 -p udp -m udp --dport 5353 -j ACCEPT
-A upnp -d 192.168.1.3/32 -p udp -m udp --dport 4500 -j ACCEPT
-A vpnlist -d 5.255.255.77/32 -i ppp10 -j ACCEPT
-A vpnlist -d 77.88.55.77/32 -i ppp10 -j ACCEPT
-A vpnlist -d 77.88.55.60/32 -i ppp10 -j ACCEPT
COMMIT