HGE3Q9gS

1#!/bin/sh
2#
3# Generated iptables firewall script for the Linux 2.4 kernel
4# Script generated by Easy Firewall Generator for IPTables 1.15
5# copyright 2002 Timothy Scott Morizot
6# 
7# Redhat chkconfig comments - firewall applied early,
8#                             removed late
9# chkconfig: 2345 08 92
10# description: This script applies or removes iptables firewall rules
11# 
12# This generator is primarily designed for RedHat installations,
13# although it should be adaptable for others.
14#
15# It can be executed with the typical start and stop arguments.
16# If used with stop, it will stop after flushing the firewall.
17# The save and restore arguments will save or restore the rules
18# from the /etc/sysconfig/iptables file.  The save and restore
19# arguments are included to preserve compatibility with
20# Redhat's or Fedora's init.d script if you prefer to use it.
21
22# Redhat/Fedora installation instructions
23#
24# 1. Have the system link the iptables init.d startup script into run states
25#    2, 3, and 5.
26#    chkconfig --level 235 iptables on
27#
28# 2. Save this script and execute it to load the ruleset from this file.
29#    You may need to run the dos2unix command on it to remove carraige returns.
30#
31# 3. To have it applied at startup, copy this script to
32#    /etc/init.d/iptables.  It accepts stop, start, save, and restore
33#    arguments.  (You may wish to save the existing one first.)
34#    Alternatively, if you issue the 'service iptables save' command
35#    the init.d script should save the rules and reload them at runtime.
36#
37# 4. For non-Redhat systems (or Redhat systems if you have a problem), you
38#    may want to append the command to execute this script to rc.local.
39#    rc.local is typically located in /etc and /etc/rc.d and is usually
40#    the last thing executed on startup.  Simply add /path/to/script/script_name
41#    on its own line in the rc.local file.
42
43###############################################################################
44# 
45# Local Settings
46#
47
48# sysctl location.  If set, it will use sysctl to adjust the kernel parameters.
49# If this is set to the empty string (or is unset), the use of sysctl
50# is disabled.
51
52SYSCTL="/sbin/sysctl -w" 
53
54# To echo the value directly to the /proc file instead
55# SYSCTL=""
56
57# IPTables Location - adjust if needed
58
59IPT="/sbin/iptables"
60IPTS="/sbin/iptables-save"
61IPTR="/sbin/iptables-restore"
62
63# Internet Interface
64INET_IFACE="eth0"
65INET_ADDRESS="107.191.46.113"
66
67# Localhost Interface
68
69LO_IFACE="lo"
70LO_IP="127.0.0.1"
71
72# Save and Restore arguments handled here
73if [ "$1" = "save" ]
74then
75	echo -n "Saving firewall to /etc/iptables/rules.v4 ... "
76	$IPTS > /etc/iptables/rules.v4
77	echo "done"
78	exit 0
79elif [ "$1" = "restore" ]
80then
81	echo -n "Restoring firewall from /etc/iptables/rules.v4 ... "
82	$IPTR < /etc/iptables/rules.v4
83	echo "done"
84	exit 0
85fi
86
87###############################################################################
88#
89# Load Modules
90#
91
92echo "Loading kernel modules ..."
93
94# You should uncomment the line below and run it the first time just to
95# ensure all kernel module dependencies are OK.  There is no need to run
96# every time, however.
97
98# /sbin/depmod -a
99
100# Unless you have kernel module auto-loading disabled, you should not
101# need to manually load each of these modules.  Other than ip_tables,
102# ip_conntrack, and some of the optional modules, I've left these
103# commented by default.  Uncomment if you have any problems or if
104# you have disabled module autoload.  Note that some modules must
105# be loaded by another kernel module.
106
107# core netfilter module
108/sbin/modprobe ip_tables
109
110# the stateful connection tracking module
111/sbin/modprobe ip_conntrack
112
113# filter table module
114# /sbin/modprobe iptable_filter
115
116# mangle table module
117# /sbin/modprobe iptable_mangle
118
119# nat table module
120# /sbin/modprobe iptable_nat
121
122# LOG target module
123# /sbin/modprobe ipt_LOG
124
125# This is used to limit the number of packets per sec/min/hr
126# /sbin/modprobe ipt_limit
127
128# masquerade target module
129# /sbin/modprobe ipt_MASQUERADE
130
131# filter using owner as part of the match
132# /sbin/modprobe ipt_owner
133
134# REJECT target drops the packet and returns an ICMP response.
135# The response is configurable.  By default, connection refused.
136# /sbin/modprobe ipt_REJECT
137
138# This target allows packets to be marked in the mangle table
139# /sbin/modprobe ipt_mark
140
141# This target affects the TCP MSS
142# /sbin/modprobe ipt_tcpmss
143
144# This match allows multiple ports instead of a single port or range
145# /sbin/modprobe multiport
146
147# This match checks against the TCP flags
148# /sbin/modprobe ipt_state
149
150# This match catches packets with invalid flags
151# /sbin/modprobe ipt_unclean
152
153# The ftp nat module is required for non-PASV ftp support
154#/sbin/modprobe ip_nat_ftp
155
156# the module for full ftp connection tracking
157#/sbin/modprobe ip_conntrack_ftp
158
159# the module for full irc connection tracking
160#/sbin/modprobe ip_conntrack_irc
161
162
163###############################################################################
164#
165# Kernel Parameter Configuration
166#
167# See http://ipsysctl-tutorial.frozentux.net/chunkyhtml/index.html
168# for a detailed tutorial on sysctl and the various settings
169# available.
170
171# Required to enable IPv4 forwarding.
172# Redhat users can try setting FORWARD_IPV4 in /etc/sysconfig/network to true
173# Alternatively, it can be set in /etc/sysctl.conf
174if [ "$SYSCTL" = "" ]
175then
176    echo "1" > /proc/sys/net/ipv4/ip_forward
177else
178    $SYSCTL net.ipv4.ip_forward="1"
179fi
180
181# This enables dynamic address hacking.
182# This may help if you have a dynamic IP address \(e.g. slip, ppp, dhcp\).
183#if [ "$SYSCTL" = "" ]
184#then
185#    echo "1" > /proc/sys/net/ipv4/ip_dynaddr
186#else
187#    $SYSCTL net.ipv4.ip_dynaddr="1"
188#fi
189
190# This enables SYN flood protection.
191# The SYN cookies activation allows your system to accept an unlimited
192# number of TCP connections while still trying to give reasonable
193# service during a denial of service attack.
194if [ "$SYSCTL" = "" ]
195then
196    echo "1" > /proc/sys/net/ipv4/tcp_syncookies
197else
198    $SYSCTL net.ipv4.tcp_syncookies="1"
199fi
200
201# This enables source validation by reversed path according to RFC1812.
202# In other words, did the response packet originate from the same interface
203# through which the source packet was sent?  It's recommended for single-homed
204# systems and routers on stub networks.  Since those are the configurations
205# this firewall is designed to support, I turn it on by default.
206# Turn it off if you use multiple NICs connected to the same network.
207if [ "$SYSCTL" = "" ]
208then
209    echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
210else
211    $SYSCTL net.ipv4.conf.all.rp_filter="1"
212fi
213
214# This option allows a subnet to be firewalled with a single IP address.
215# It's used to build a DMZ.  Since that's not a focus of this firewall
216# script, it's not enabled by default, but is included for reference.
217# See: http://www.sjdjweis.com/linux/proxyarp/ 
218#if [ "$SYSCTL" = "" ]
219#then
220#    echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
221#else
222#    $SYSCTL net.ipv4.conf.all.proxy_arp="1"
223#fi
224
225# The following kernel settings were suggested by Alex Weeks. Thanks!
226
227# This kernel parameter instructs the kernel to ignore all ICMP
228# echo requests sent to the broadcast address.  This prevents
229# a number of smurfs and similar DoS nasty attacks.
230if [ "$SYSCTL" = "" ]
231then
232    echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
233else
234    $SYSCTL net.ipv4.icmp_echo_ignore_broadcasts="1"
235fi
236
237# This option can be used to accept or refuse source routed
238# packets.  It is usually on by default, but is generally
239# considered a security risk.  This option turns it off.
240if [ "$SYSCTL" = "" ]
241then
242    echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
243else
244    $SYSCTL net.ipv4.conf.all.accept_source_route="0"
245fi
246
247# This option can disable ICMP redirects.  ICMP redirects
248# are generally considered a security risk and shouldn't be
249# needed by most systems using this generator.
250#if [ "$SYSCTL" = "" ]
251#then
252#    echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
253#else
254#    $SYSCTL net.ipv4.conf.all.accept_redirects="0"
255#fi
256
257# However, we'll ensure the secure_redirects option is on instead.
258# This option accepts only from gateways in the default gateways list.
259if [ "$SYSCTL" = "" ]
260then
261    echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
262else
263    $SYSCTL net.ipv4.conf.all.secure_redirects="1"
264fi
265
266# This option logs packets from impossible addresses.
267if [ "$SYSCTL" = "" ]
268then
269    echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
270else
271    $SYSCTL net.ipv4.conf.all.log_martians="1"
272fi
273
274
275###############################################################################
276#
277# Flush Any Existing Rules or Chains
278#
279
280echo "Flushing Tables ..."
281
282# Reset Default Policies
283$IPT -P INPUT ACCEPT
284$IPT -P FORWARD ACCEPT
285$IPT -P OUTPUT ACCEPT
286$IPT -t nat -P PREROUTING ACCEPT
287$IPT -t nat -P POSTROUTING ACCEPT
288$IPT -t nat -P OUTPUT ACCEPT
289$IPT -t mangle -P PREROUTING ACCEPT
290$IPT -t mangle -P OUTPUT ACCEPT
291
292# Flush all rules
293$IPT -F
294$IPT -t nat -F
295$IPT -t mangle -F
296
297# Erase all non-default chains
298$IPT -X
299$IPT -t nat -X
300$IPT -t mangle -X
301
302if [ "$1" = "stop" ]
303then
304	echo "Firewall completely flushed!  Now running with no firewall."
305	exit 0
306fi
307
308###############################################################################
309#
310# Rules Configuration
311#
312
313###############################################################################
314#
315# Filter Table
316#
317###############################################################################
318
319# Set Policies
320
321$IPT -P INPUT DROP
322$IPT -P OUTPUT DROP
323$IPT -P FORWARD DROP
324
325###############################################################################
326#
327# User-Specified Chains
328#
329# Create user chains to reduce the number of rules each packet
330# must traverse.
331
332echo "Create and populate custom rule chains ..."
333
334# Create a chain to filter INVALID packets
335
336$IPT -N bad_packets
337
338# Create another chain to filter bad tcp packets
339
340$IPT -N bad_tcp_packets
341
342# Create separate chains for icmp, tcp (incoming and outgoing),
343# and incoming udp packets.
344
345$IPT -N icmp_packets
346
347# Used for UDP packets inbound from the Internet
348$IPT -N udp_inbound
349
350# Used to block outbound UDP services from internal network
351# Default to allow all
352$IPT -N udp_outbound
353
354# Used to allow inbound services if desired
355# Default fail except for established sessions
356$IPT -N tcp_inbound
357
358# Used to block outbound services from internal network
359# Default to allow all
360$IPT -N tcp_outbound
361
362
363###############################################################################
364#
365# Populate User Chains
366#
367
368# bad_packets chain
369#
370
371# Drop INVALID packets immediately
372$IPT -A bad_packets -p ALL -m state --state INVALID -j LOG \
373    --log-prefix "Invalid packet: "
374
375$IPT -A bad_packets -p ALL -m state --state INVALID -j DROP
376
377# Then check the tcp packets for additional problems
378$IPT -A bad_packets -p tcp -j bad_tcp_packets
379
380# All good, so return
381$IPT -A bad_packets -p ALL -j RETURN
382
383# bad_tcp_packets chain
384#
385# All tcp packets will traverse this chain.
386# Every new connection attempt should begin with
387# a syn packet.  If it doesn't, it is likely a
388# port scan.  This drops packets in state
389# NEW that are not flagged as syn packets.
390
391
392$IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
393    --log-prefix "New not syn: "
394$IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
395
396$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j LOG \
397    --log-prefix "Stealth scan: "
398$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j DROP
399
400$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j LOG \
401    --log-prefix "Stealth scan: "
402$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j DROP
403
404$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG \
405    --log-prefix "Stealth scan: "
406$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
407
408$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG \
409    --log-prefix "Stealth scan: "
410$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
411
412$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j LOG \
413    --log-prefix "Stealth scan: "
414$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
415
416$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG \
417    --log-prefix "Stealth scan: "
418$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
419
420# All good, so return
421$IPT -A bad_tcp_packets -p tcp -j RETURN
422
423# icmp_packets chain
424#
425# This chain is for inbound (from the Internet) icmp packets only.
426# Type 8 (Echo Request) is not accepted by default
427# Enable it if you want remote hosts to be able to reach you.
428# 11 (Time Exceeded) is the only one accepted
429# that would not already be covered by the established
430# connection rule.  Applied to INPUT on the external interface.
431# 
432# See: http://www.ee.siue.edu/~rwalden/networking/icmp.html
433# for more info on ICMP types.
434#
435# Note that the stateful settings allow replies to ICMP packets.
436# These rules allow new packets of the specified types.
437
438# ICMP packets should fit in a Layer 2 frame, thus they should
439# never be fragmented.  Fragmented ICMP packets are a typical sign
440# of a denial of service attack.
441$IPT -A icmp_packets --fragment -p ICMP -j LOG \
442    --log-prefix "ICMP Fragment: "
443$IPT -A icmp_packets --fragment -p ICMP -j DROP
444
445# Echo - uncomment to allow your system to be pinged.
446# Uncomment the LOG command if you also want to log PING attempts
447# 
448# $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j LOG \
449#    --log-prefix "Ping detected: "
450# $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
451
452$IPT -A icmp_packets -p ICMP -s 39.52.0.0/16 --icmp-type 8 -j ACCEPT
453
454# By default, however, drop pings without logging. Blaster
455# and other worms have infected systems blasting pings.
456# Comment the line below if you want pings logged, but it
457# will likely fill your logs.
458$IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j DROP
459
460# Time Exceeded
461$IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
462
463# Not matched, so return so it will be logged
464$IPT -A icmp_packets -p ICMP -j RETURN
465
466# TCP & UDP
467# Identify ports at:
468#    http://www.chebucto.ns.ca/~rakerman/port-table.html
469#    http://www.iana.org/assignments/port-numbers
470
471# udp_inbound chain
472#
473# This chain describes the inbound UDP packets it will accept.
474# It's applied to INPUT on the external or Internet interface.
475# Note that the stateful settings allow replies.
476# These rules are for new requests.
477# It drops netbios packets (windows) immediately without logging.
478
479# Drop netbios calls
480# Please note that these rules do not really change the way the firewall
481# treats netbios connections.  Connections from the localhost and
482# internal interface (if one exists) are accepted by default.
483# Responses from the Internet to requests initiated by or through
484# the firewall are also accepted by default.  To get here, the
485# packets would have to be part of a new request received by the
486# Internet interface.  You would have to manually add rules to
487# accept these.  I added these rules because some network connections,
488# such as those via cable modems, tend to be filled with noise from
489# unprotected Windows machines.  These rules drop those packets
490# quickly and without logging them.  This prevents them from traversing
491# the whole chain and keeps the log from getting cluttered with
492# chatter from Windows systems.
493$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 137 -j DROP
494$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 138 -j DROP
495
496#OpenVPN UDP
497$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 1195 -j ACCEPT
498
499#COD 1 Server Connect
500$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 31788 -j ACCEPT
501
502#COD 1 Server Master
503$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 20500 -j ACCEPT
504
505#COD 1 Server Heartbeat
506$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 20510 -j ACCEPT
507
508
509# Not matched, so return for logging
510$IPT -A udp_inbound -p UDP -j RETURN
511
512# udp_outbound chain
513#
514# This chain is used with a private network to prevent forwarding for
515# UDP requests on specific protocols.  Applied to the FORWARD rule from
516# the internal network.  Ends with an ACCEPT
517
518
519# No match, so ACCEPT
520$IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT
521
522# tcp_inbound chain
523#
524# This chain is used to allow inbound connections to the
525# system/gateway.  Use with care.  It defaults to none.
526# It's applied on INPUT from the external or Internet interface.
527
528# Web Server
529
530# HTTP
531$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 80 -j ACCEPT
532
533# HTTPS (Secure Web Server)
534$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 443 -j ACCEPT
535
536# sshd
537$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -j ACCEPT
538
539# openvpn TCP
540$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 1194 -j ACCEPT
541
542#sinusbot WEB interface
543$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 8087 -j ACCEPT
544
545#transmission client WEB
546$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 31788 -j ACCEPT
547
548#Allow Danted daemon
549$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 1080 -j ACCEPT
550
551# Not matched, so return so it will be logged
552$IPT -A tcp_inbound -p TCP -j RETURN
553
554# tcp_outbound chain
555#
556# This chain is used with a private network to prevent forwarding for
557# requests on specific protocols.  Applied to the FORWARD rule from
558# the internal network.  Ends with an ACCEPT
559
560
561# No match, so ACCEPT
562$IPT -A tcp_outbound -p TCP -s 0/0 -j ACCEPT
563
564###############################################################################
565#
566# INPUT Chain
567#
568
569echo "Process INPUT chain ..."
570
571# Allow all on localhost interface
572$IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
573
574# Drop bad packets
575$IPT -A INPUT -p ALL -j bad_packets
576
577# DOCSIS compliant cable modems
578# Some DOCSIS compliant cable modems send IGMP multicasts to find
579# connected PCs.  The multicast packets have the destination address
580# 224.0.0.1.  You can accept them.  If you choose to do so,
581# Uncomment the rule to ACCEPT them and comment the rule to DROP
582# them  The firewall will drop them here by default to avoid
583# cluttering the log.  The firewall will drop all multicasts
584# to the entire subnet (224.0.0.1) by default.  To only affect
585# IGMP multicasts, change '-p ALL' to '-p 2'.  Of course,
586# if they aren't accepted elsewhere, it will only ensure that
587# multicasts on other protocols are logged.
588# Drop them without logging.
589$IPT -A INPUT -p ALL -d 224.0.0.1 -j DROP
590# The rule to accept the packets.
591# $IPT -A INPUT -p ALL -d 224.0.0.1 -j ACCEPT
592
593
594# Inbound Internet Packet Rules
595
596# Accept Established Connections
597$IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
598     -j ACCEPT
599
600# Route the rest to the appropriate user chain
601$IPT -A INPUT -p TCP -i $INET_IFACE -j tcp_inbound
602$IPT -A INPUT -p UDP -i $INET_IFACE -j udp_inbound
603$IPT -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
604
605# Drop without logging broadcasts that get this far.
606# Cuts down on log clutter.
607# Comment this line if testing new rules that impact
608# broadcast protocols.
609$IPT -A INPUT -m pkttype --pkt-type broadcast -j DROP
610
611# Log packets that still don't match
612$IPT -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
613    --log-prefix "INPUT packet died: "
614
615###############################################################################
616#
617# FORWARD Chain
618#
619
620echo "Process FORWARD chain ..."
621
622# Used if forwarding for a private network
623
624
625
626iptables -A FORWARD -s 10.9.0.0/24 -p ALL -j ACCEPT
627iptables -A FORWARD -d 10.9.0.0/24 -p ALL -j ACCEPT
628# iptables -A FORWARD -s 10.9.0.0/24 -p ALL -j LOG \
629    # --log-prefix "FORWARD -s: "
630
631# iptables -A FORWARD -d 10.9.0.0/24 -p ALL -j LOG \
632    # --log-prefix "FORWARD -d: "
633
634
635iptables -A FORWARD -s 10.8.0.0/24 -p ALL -j ACCEPT
636iptables -A FORWARD -d 10.8.0.0/24 -p ALL -j ACCEPT
637
638###############################################################################
639#
640# OUTPUT Chain
641#
642
643echo "Process OUTPUT chain ..."
644
645# Generally trust the firewall on output
646
647# However, invalid icmp packets need to be dropped
648# to prevent a possible exploit.
649$IPT -A OUTPUT -m state -p icmp --state INVALID -j DROP
650
651# Localhost
652$IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
653$IPT -A OUTPUT -p ALL -o $LO_IFACE -j ACCEPT
654
655# To internet
656$IPT -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT
657
658# Log packets that still don't match
659$IPT -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
660    --log-prefix "OUTPUT packet died: "
661
662###############################################################################
663#
664# nat table
665#
666###############################################################################
667
668# The nat table is where network address translation occurs if there
669# is a private network.  If the gateway is connected to the Internet
670# with a static IP, snat is used.  If the gateway has a dynamic address,
671# masquerade must be used instead.  There is more overhead associated
672# with masquerade, so snat is better when it can be used.
673# The nat table has a builtin chain, PREROUTING, for dnat and redirects.
674# Another, POSTROUTING, handles snat and masquerade.
675
676echo "Load rules for nat table ..."
677
678###############################################################################
679#
680# PREROUTING chain
681#
682
683
684###############################################################################
685#
686# POSTROUTING chain
687#
688
689$IPT -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source $INET_ADDRESS
690$IPT -t nat -A POSTROUTING -s 10.9.0.0/24 -j SNAT --to-source $INET_ADDRESS
691
692
693###############################################################################
694#
695# mangle table
696#
697###############################################################################
698
699# The mangle table is used to alter packets.  It can alter or mangle them in
700# several ways.  For the purposes of this generator, we only use its ability
701# to alter the TTL in packets.  However, it can be used to set netfilter
702# mark values on specific packets.  Those marks could then be used in another
703# table like filter, to limit activities associated with a specific host, for
704# instance.  The TOS target can be used to set the Type of Service field in
705# the IP header.  Note that the TTL target might not be included in the
706# distribution on your system.  If it is not and you require it, you will
707# have to add it.  That may require that you build from source.
708
709echo "Load rules for mangle table ..."