#
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:in_routera - [0:0]
:in_routerb - [0:0]
:out_routera - [0:0]
:out_routerb - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,ACK FIN,ACK -m conntrack --ctstate INVALID,NEW -j DROP
-A INPUT -p tcp -m tcp --tcp-flags RST,ACK RST,ACK -m conntrack --ctstate INVALID,NEW -j DROP
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -m conntrack --ctstate INVALID,NEW -j DROP
-A INPUT -p tcp -m tcp --tcp-flags RST RST -m conntrack --ctstate INVALID,NEW -j DROP
-A INPUT -m conntrack --ctstate INVALID -m limit --limit 1/sec -j LOG --log-prefix "BLOCKED INVALID INPUT:"
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT
-A INPUT -m limit --limit 1/sec -j LOG --log-prefix "IN-unknown:"
-A INPUT -j DROP
-A FORWARD -p tcp -m tcp --tcp-flags FIN,ACK FIN,ACK -m conntrack --ctstate INVALID,NEW -j DROP
-A FORWARD -p tcp -m tcp --tcp-flags RST,ACK RST,ACK -m conntrack --ctstate INVALID,NEW -j DROP
-A FORWARD -p tcp -m tcp --tcp-flags ACK ACK -m conntrack --ctstate INVALID,NEW -j DROP
-A FORWARD -p tcp -m tcp --tcp-flags RST RST -m conntrack --ctstate INVALID,NEW -j DROP
-A FORWARD -m conntrack --ctstate INVALID -m limit --limit 1/sec -j LOG --log-prefix "BLOCKED INVALID FORWARD:"
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -s ::/8 -j in_routera
-A FORWARD -s 100::/8 -j in_routera
-A FORWARD -s 200::/7 -j in_routera
-A FORWARD -s 400::/6 -j in_routera
-A FORWARD -s 800::/5 -j in_routera
-A FORWARD -s 1000::/4 -j in_routera
-A FORWARD -s 4000::/3 -j in_routera
-A FORWARD -s 6000::/3 -j in_routera
-A FORWARD -s 8000::/3 -j in_routera
-A FORWARD -s a000::/3 -j in_routera
-A FORWARD -s c000::/3 -j in_routera
-A FORWARD -s e000::/4 -j in_routera
-A FORWARD -s f000::/5 -j in_routera
-A FORWARD -s f800::/6 -j in_routera
-A FORWARD -s fe00::/9 -j in_routera
-A FORWARD -s fec0::/10 -j in_routera
-A FORWARD -s fc00::/7 -j in_routera
-A FORWARD -s fe80::/10 -j in_routera
-A FORWARD -d ::/8 -j out_routera
-A FORWARD -d 100::/8 -j out_routera
-A FORWARD -d 200::/7 -j out_routera
-A FORWARD -d 400::/6 -j out_routera
-A FORWARD -d 800::/5 -j out_routera
-A FORWARD -d 1000::/4 -j out_routera
-A FORWARD -d 4000::/3 -j out_routera
-A FORWARD -d 6000::/3 -j out_routera
-A FORWARD -d 8000::/3 -j out_routera
-A FORWARD -d a000::/3 -j out_routera
-A FORWARD -d c000::/3 -j out_routera
-A FORWARD -d e000::/4 -j out_routera
-A FORWARD -d f000::/5 -j out_routera
-A FORWARD -d f800::/6 -j out_routera
-A FORWARD -d fe00::/9 -j out_routera
-A FORWARD -d fec0::/10 -j out_routera
-A FORWARD -d fc00::/7 -j out_routera
-A FORWARD -d fe80::/10 -j out_routera
-A FORWARD -j in_routerb
-A FORWARD -j out_routerb
-A FORWARD -p icmp -m conntrack --ctstate RELATED -j ACCEPT
-A FORWARD -p tcp -m conntrack --ctstate RELATED -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG RST,ACK -j ACCEPT
-A FORWARD -m limit --limit 1/sec -j LOG --log-prefix "PASS-unknown:"
-A FORWARD -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,ACK FIN,ACK -m conntrack --ctstate INVALID,NEW -j DROP
-A OUTPUT -p tcp -m tcp --tcp-flags RST,ACK RST,ACK -m conntrack --ctstate INVALID,NEW -j DROP
-A OUTPUT -p tcp -m tcp --tcp-flags ACK ACK -m conntrack --ctstate INVALID,NEW -j DROP
-A OUTPUT -p tcp -m tcp --tcp-flags RST RST -m conntrack --ctstate INVALID,NEW -j DROP
-A OUTPUT -m conntrack --ctstate INVALID -m limit --limit 1/sec -j LOG --log-prefix "BLOCKED INVALID OUTPUT:"
-A OUTPUT -m conntrack --ctstate INVALID -j DROP
-A OUTPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT
-A OUTPUT -p tcp -m conntrack --ctstate RELATED -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG RST,ACK -j ACCEPT
-A OUTPUT -m limit --limit 1/sec -j LOG --log-prefix "OUT-unknown:"
-A OUTPUT -j DROP
-A in_routera -p icmp -m conntrack --ctstate RELATED -j ACCEPT
-A in_routera -p tcp -m conntrack --ctstate RELATED -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG RST,ACK -j ACCEPT
-A in_routerb -s ::/8 -j RETURN
-A in_routerb -s 100::/8 -j RETURN
-A in_routerb -s 200::/7 -j RETURN
-A in_routerb -s 400::/6 -j RETURN
-A in_routerb -s 800::/5 -j RETURN
-A in_routerb -s 1000::/4 -j RETURN
-A in_routerb -s 4000::/3 -j RETURN
-A in_routerb -s 6000::/3 -j RETURN
-A in_routerb -s 8000::/3 -j RETURN
-A in_routerb -s a000::/3 -j RETURN
-A in_routerb -s c000::/3 -j RETURN
-A in_routerb -s e000::/4 -j RETURN
-A in_routerb -s f000::/5 -j RETURN
-A in_routerb -s f800::/6 -j RETURN
-A in_routerb -s fe00::/9 -j RETURN
-A in_routerb -s fec0::/10 -j RETURN
-A in_routerb -s fc00::/7 -j RETURN
-A in_routerb -s fe80::/10 -j RETURN
-A in_routerb -p icmp -m conntrack --ctstate RELATED -j ACCEPT
-A in_routerb -p tcp -m conntrack --ctstate RELATED -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG RST,ACK -j ACCEPT
-A out_routera -p icmp -m conntrack --ctstate RELATED -j ACCEPT
-A out_routera -p tcp -m conntrack --ctstate RELATED -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG RST,ACK -j ACCEPT
-A out_routerb -d ::/8 -j RETURN
-A out_routerb -d 100::/8 -j RETURN
-A out_routerb -d 200::/7 -j RETURN
-A out_routerb -d 400::/6 -j RETURN
-A out_routerb -d 800::/5 -j RETURN
-A out_routerb -d 1000::/4 -j RETURN
-A out_routerb -d 4000::/3 -j RETURN
-A out_routerb -d 6000::/3 -j RETURN
-A out_routerb -d 8000::/3 -j RETURN
-A out_routerb -d a000::/3 -j RETURN
-A out_routerb -d c000::/3 -j RETURN
-A out_routerb -d e000::/4 -j RETURN
-A out_routerb -d f000::/5 -j RETURN
-A out_routerb -d f800::/6 -j RETURN
-A out_routerb -d fe00::/9 -j RETURN
-A out_routerb -d fec0::/10 -j RETURN
-A out_routerb -d fc00::/7 -j RETURN
-A out_routerb -d fe80::/10 -j RETURN
-A out_routerb -p icmp -m conntrack --ctstate RELATED -j ACCEPT
-A out_routerb -p tcp -m conntrack --ctstate RELATED -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG RST,ACK -j ACCEPT
COMMIT
#
#
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -m conntrack --ctstate RELATED,ESTABLISHED -j CONNMARK --restore-mark --nfmask 0x1fff --ctmask 0x1fff
-A INPUT -m conntrack --ctstate NEW -j CONNMARK --save-mark --nfmask 0x1fff --ctmask 0x1fff
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j CONNMARK --restore-mark --nfmask 0x1fff --ctmask 0x1fff
-A POSTROUTING -m conntrack --ctstate NEW -j CONNMARK --save-mark --nfmask 0x1fff --ctmask 0x1fff
COMMIT
#
#
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
#
#
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
#
