# Generated by iptables-save v1.6.0 on Fri Oct 14 14:47:44 2016 *nat :PREROUTING ACCEPT [2:433] :INPUT ACCEPT [1:105] :OUTPUT ACCEPT [235:15814] :POSTROUTING ACCEPT [234:15619] :OUTPUT_direct - [0:0] :POSTROUTING_ZONES - [0:0] :POSTROUTING_ZONES_SOURCE - [0:0] :POSTROUTING_direct - [0:0] :POST_FedoraWorkstation - [0:0] :POST_FedoraWorkstation_allow - [0:0] :POST_FedoraWorkstation_deny - [0:0] :POST_FedoraWorkstation_log - [0:0] :POST_dmz - [0:0] :POST_dmz_allow - [0:0] :POST_dmz_deny - [0:0] :POST_dmz_log - [0:0] :POST_trusted - [0:0] :POST_trusted_allow - [0:0] :POST_trusted_deny - [0:0] :POST_trusted_log - [0:0] :PREROUTING_ZONES - [0:0] :PREROUTING_ZONES_SOURCE - [0:0] :PREROUTING_direct - [0:0] :PRE_FedoraWorkstation - [0:0] :PRE_FedoraWorkstation_allow - [0:0] :PRE_FedoraWorkstation_deny - [0:0] :PRE_FedoraWorkstation_log - [0:0] :PRE_dmz - [0:0] :PRE_dmz_allow - [0:0] :PRE_dmz_deny - [0:0] :PRE_dmz_log - [0:0] :PRE_trusted - [0:0] :PRE_trusted_allow - [0:0] :PRE_trusted_deny - [0:0] :PRE_trusted_log - [0:0] -A PREROUTING -j PREROUTING_direct -A PREROUTING -j PREROUTING_ZONES_SOURCE -A PREROUTING -j PREROUTING_ZONES -A OUTPUT -j OUTPUT_direct -A POSTROUTING -s 192.168.121.0/24 -d 224.0.0.0/24 -j RETURN -A POSTROUTING -s 192.168.121.0/24 -d 255.255.255.255/32 -j RETURN -A POSTROUTING -s 192.168.121.0/24 ! -d 192.168.121.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.121.0/24 ! -d 192.168.121.0/24 -p udp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.121.0/24 ! -d 192.168.121.0/24 -j MASQUERADE -A POSTROUTING -j POSTROUTING_direct -A POSTROUTING -j POSTROUTING_ZONES_SOURCE -A POSTROUTING -j POSTROUTING_ZONES -A POSTROUTING_ZONES -o em1 -g POST_dmz -A POSTROUTING_ZONES -o bridge0 -g POST_dmz -A POSTROUTING_ZONES -o virbr0 -j POST_trusted -A POSTROUTING_ZONES -o virbr0-nic -j POST_trusted -A POSTROUTING_ZONES -g POST_FedoraWorkstation -A POSTROUTING_ZONES_SOURCE -d 192.168.121.0/24 -g POST_dmz -A POSTROUTING_ZONES_SOURCE -d 192.168.4.0/24 -g POST_dmz -A POST_FedoraWorkstation -j POST_FedoraWorkstation_log -A POST_FedoraWorkstation -j POST_FedoraWorkstation_deny -A POST_FedoraWorkstation -j POST_FedoraWorkstation_allow -A POST_dmz -j POST_dmz_log -A POST_dmz -j POST_dmz_deny -A POST_dmz -j POST_dmz_allow -A POST_trusted -j POST_trusted_log -A POST_trusted -j POST_trusted_deny -A POST_trusted -j POST_trusted_allow -A PREROUTING_ZONES -i em1 -g PRE_dmz -A PREROUTING_ZONES -i bridge0 -g PRE_dmz -A PREROUTING_ZONES -i virbr0 -j PRE_trusted -A PREROUTING_ZONES -i virbr0-nic -j PRE_trusted -A PREROUTING_ZONES -g PRE_FedoraWorkstation -A PREROUTING_ZONES_SOURCE -s 192.168.121.0/24 -g PRE_dmz -A PREROUTING_ZONES_SOURCE -s 192.168.4.0/24 -g PRE_dmz -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_log -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_deny -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_allow -A PRE_dmz -j PRE_dmz_log -A PRE_dmz -j PRE_dmz_deny -A PRE_dmz -j PRE_dmz_allow -A PRE_trusted -j PRE_trusted_log -A PRE_trusted -j PRE_trusted_deny -A PRE_trusted -j PRE_trusted_allow COMMIT # Completed on Fri Oct 14 14:47:44 2016 # Generated by iptables-save v1.6.0 on Fri Oct 14 14:47:44 2016 *security :INPUT ACCEPT [1923:1481804] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1848:237711] :FORWARD_direct - [0:0] :INPUT_direct - [0:0] :OUTPUT_direct - [0:0] -A INPUT -j INPUT_direct -A FORWARD -j FORWARD_direct -A OUTPUT -j OUTPUT_direct COMMIT # Completed on Fri Oct 14 14:47:44 2016 # Generated by iptables-save v1.6.0 on Fri Oct 14 14:47:44 2016 *raw :PREROUTING ACCEPT [1931:1482877] :OUTPUT ACCEPT [1848:237711] :OUTPUT_direct - [0:0] :PREROUTING_direct - [0:0] -A PREROUTING -j PREROUTING_direct -A OUTPUT -j OUTPUT_direct COMMIT # Completed on Fri Oct 14 14:47:44 2016 # Generated by iptables-save v1.6.0 on Fri Oct 14 14:47:44 2016 *mangle :PREROUTING ACCEPT [1931:1482877] :INPUT ACCEPT [1926:1482389] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1848:237711] :POSTROUTING ACCEPT [1912:246559] :FORWARD_direct - [0:0] :INPUT_direct - [0:0] :OUTPUT_direct - [0:0] :POSTROUTING_direct - [0:0] :PREROUTING_ZONES - [0:0] :PREROUTING_ZONES_SOURCE - [0:0] :PREROUTING_direct - [0:0] :PRE_FedoraWorkstation - [0:0] :PRE_FedoraWorkstation_allow - [0:0] :PRE_FedoraWorkstation_deny - [0:0] :PRE_FedoraWorkstation_log - [0:0] :PRE_dmz - [0:0] :PRE_dmz_allow - [0:0] :PRE_dmz_deny - [0:0] :PRE_dmz_log - [0:0] :PRE_trusted - [0:0] :PRE_trusted_allow - [0:0] :PRE_trusted_deny - [0:0] :PRE_trusted_log - [0:0] -A PREROUTING -j PREROUTING_direct -A PREROUTING -j PREROUTING_ZONES_SOURCE -A PREROUTING -j PREROUTING_ZONES -A INPUT -j INPUT_direct -A FORWARD -j FORWARD_direct -A OUTPUT -j OUTPUT_direct -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill -A POSTROUTING -j POSTROUTING_direct -A PREROUTING_ZONES -i em1 -g PRE_dmz -A PREROUTING_ZONES -i bridge0 -g PRE_dmz -A PREROUTING_ZONES -i virbr0 -j PRE_trusted -A PREROUTING_ZONES -i virbr0-nic -j PRE_trusted -A PREROUTING_ZONES -g PRE_FedoraWorkstation -A PREROUTING_ZONES_SOURCE -s 192.168.121.0/24 -g PRE_dmz -A PREROUTING_ZONES_SOURCE -s 192.168.4.0/24 -g PRE_dmz -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_log -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_deny -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_allow -A PRE_dmz -j PRE_dmz_log -A PRE_dmz -j PRE_dmz_deny -A PRE_dmz -j PRE_dmz_allow -A PRE_trusted -j PRE_trusted_log -A PRE_trusted -j PRE_trusted_deny -A PRE_trusted -j PRE_trusted_allow COMMIT # Completed on Fri Oct 14 14:47:44 2016 # Generated by iptables-save v1.6.0 on Fri Oct 14 14:47:44 2016 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1848:237711] :FORWARD_IN_ZONES - [0:0] :FORWARD_IN_ZONES_SOURCE - [0:0] :FORWARD_OUT_ZONES - [0:0] :FORWARD_OUT_ZONES_SOURCE - [0:0] :FORWARD_direct - [0:0] :FWDI_FedoraWorkstation - [0:0] :FWDI_FedoraWorkstation_allow - [0:0] :FWDI_FedoraWorkstation_deny - [0:0] :FWDI_FedoraWorkstation_log - [0:0] :FWDI_dmz - [0:0] :FWDI_dmz_allow - [0:0] :FWDI_dmz_deny - [0:0] :FWDI_dmz_log - [0:0] :FWDI_trusted - [0:0] :FWDI_trusted_allow - [0:0] :FWDI_trusted_deny - [0:0] :FWDI_trusted_log - [0:0] :FWDO_FedoraWorkstation - [0:0] :FWDO_FedoraWorkstation_allow - [0:0] :FWDO_FedoraWorkstation_deny - [0:0] :FWDO_FedoraWorkstation_log - [0:0] :FWDO_dmz - [0:0] :FWDO_dmz_allow - [0:0] :FWDO_dmz_deny - [0:0] :FWDO_dmz_log - [0:0] :FWDO_trusted - [0:0] :FWDO_trusted_allow - [0:0] :FWDO_trusted_deny - [0:0] :FWDO_trusted_log - [0:0] :INPUT_ZONES - [0:0] :INPUT_ZONES_SOURCE - [0:0] :INPUT_direct - [0:0] :IN_FedoraWorkstation - [0:0] :IN_FedoraWorkstation_allow - [0:0] :IN_FedoraWorkstation_deny - [0:0] :IN_FedoraWorkstation_log - [0:0] :IN_dmz - [0:0] :IN_dmz_allow - [0:0] :IN_dmz_deny - [0:0] :IN_dmz_log - [0:0] :IN_trusted - [0:0] :IN_trusted_allow - [0:0] :IN_trusted_deny - [0:0] :IN_trusted_log - [0:0] :OUTPUT_direct - [0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -j INPUT_direct -A INPUT -j INPUT_ZONES_SOURCE -A INPUT -j INPUT_ZONES -A INPUT -m conntrack --ctstate INVALID -j DROP -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -d 192.168.121.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 192.168.121.0/24 -i virbr0 -j ACCEPT -A FORWARD -i virbr0 -o virbr0 -j ACCEPT -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i lo -j ACCEPT -A FORWARD -j FORWARD_direct -A FORWARD -j FORWARD_IN_ZONES_SOURCE -A FORWARD -j FORWARD_IN_ZONES -A FORWARD -j FORWARD_OUT_ZONES_SOURCE -A FORWARD -j FORWARD_OUT_ZONES -A FORWARD -m conntrack --ctstate INVALID -j DROP -A FORWARD -j REJECT --reject-with icmp-host-prohibited -A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT -A OUTPUT -j OUTPUT_direct -A FORWARD_IN_ZONES -i em1 -g FWDI_dmz -A FORWARD_IN_ZONES -i bridge0 -g FWDI_dmz -A FORWARD_IN_ZONES -i virbr0 -j FWDI_trusted -A FORWARD_IN_ZONES -i virbr0-nic -j FWDI_trusted -A FORWARD_IN_ZONES -g FWDI_FedoraWorkstation -A FORWARD_IN_ZONES_SOURCE -s 192.168.121.0/24 -g FWDI_dmz -A FORWARD_IN_ZONES_SOURCE -s 192.168.4.0/24 -g FWDI_dmz -A FORWARD_OUT_ZONES -o em1 -g FWDO_dmz -A FORWARD_OUT_ZONES -o bridge0 -g FWDO_dmz -A FORWARD_OUT_ZONES -o virbr0 -j FWDO_trusted -A FORWARD_OUT_ZONES -o virbr0-nic -j FWDO_trusted -A FORWARD_OUT_ZONES -g FWDO_FedoraWorkstation -A FORWARD_OUT_ZONES_SOURCE -d 192.168.121.0/24 -g FWDO_dmz -A FORWARD_OUT_ZONES_SOURCE -d 192.168.4.0/24 -g FWDO_dmz -A FWDI_FedoraWorkstation -j FWDI_FedoraWorkstation_log -A FWDI_FedoraWorkstation -j FWDI_FedoraWorkstation_deny -A FWDI_FedoraWorkstation -j FWDI_FedoraWorkstation_allow -A FWDI_FedoraWorkstation -p icmp -j ACCEPT -A FWDI_dmz -j FWDI_dmz_log -A FWDI_dmz -j FWDI_dmz_deny -A FWDI_dmz -j FWDI_dmz_allow -A FWDI_dmz -p icmp -j ACCEPT -A FWDI_trusted -j FWDI_trusted_log -A FWDI_trusted -j FWDI_trusted_deny -A FWDI_trusted -j FWDI_trusted_allow -A FWDI_trusted -j ACCEPT -A FWDO_FedoraWorkstation -j FWDO_FedoraWorkstation_log -A FWDO_FedoraWorkstation -j FWDO_FedoraWorkstation_deny -A FWDO_FedoraWorkstation -j FWDO_FedoraWorkstation_allow -A FWDO_dmz -j FWDO_dmz_log -A FWDO_dmz -j FWDO_dmz_deny -A FWDO_dmz -j FWDO_dmz_allow -A FWDO_trusted -j FWDO_trusted_log -A FWDO_trusted -j FWDO_trusted_deny -A FWDO_trusted -j FWDO_trusted_allow -A FWDO_trusted -j ACCEPT -A INPUT_ZONES -i em1 -g IN_dmz -A INPUT_ZONES -i bridge0 -g IN_dmz -A INPUT_ZONES -i virbr0 -j IN_trusted -A INPUT_ZONES -i virbr0-nic -j IN_trusted -A INPUT_ZONES -g IN_FedoraWorkstation -A INPUT_ZONES_SOURCE -s 192.168.121.0/24 -g IN_dmz -A INPUT_ZONES_SOURCE -s 192.168.4.0/24 -g IN_dmz -A IN_FedoraWorkstation -j IN_FedoraWorkstation_log -A IN_FedoraWorkstation -j IN_FedoraWorkstation_deny -A IN_FedoraWorkstation -j IN_FedoraWorkstation_allow -A IN_FedoraWorkstation -p icmp -j ACCEPT -A IN_FedoraWorkstation_allow -p tcp -m tcp --dport 111 -m conntrack --ctstate NEW -j ACCEPT -A IN_FedoraWorkstation_allow -p udp -m udp --dport 111 -m conntrack --ctstate NEW -j ACCEPT -A IN_FedoraWorkstation_allow -p tcp -m tcp --dport 20048 -m conntrack --ctstate NEW -j ACCEPT -A IN_FedoraWorkstation_allow -p udp -m udp --dport 20048 -m conntrack --ctstate NEW -j ACCEPT -A IN_FedoraWorkstation_allow -p tcp -m tcp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT -A IN_FedoraWorkstation_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT -A IN_FedoraWorkstation_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j ACCEPT -A IN_FedoraWorkstation_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j ACCEPT -A IN_FedoraWorkstation_allow -p udp -m udp --dport 1025:65535 -m conntrack --ctstate NEW -j ACCEPT -A IN_FedoraWorkstation_allow -p tcp -m tcp --dport 1025:65535 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz -j IN_dmz_log -A IN_dmz -j IN_dmz_deny -A IN_dmz -j IN_dmz_allow -A IN_dmz -p icmp -j ACCEPT -A IN_dmz_allow -p tcp -m tcp --dport 5900:5903 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -p tcp -m tcp --dport 5500 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -p tcp -m tcp --dport 2222 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -p tcp -m tcp --dport 6881:6890 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -s 192.168.4.0/24 -p tcp -m tcp --dport 9091 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -s 192.168.4.0/24 -p tcp -m tcp --dport 20048 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -s 192.168.4.0/24 -p udp -m udp --dport 20048 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -s 192.168.4.0/24 -p tcp -m tcp --dport 111 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -s 192.168.4.0/24 -p udp -m udp --dport 111 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -s 192.168.4.0/24 -p tcp -m tcp --dport 5001 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -s 192.168.4.0/24 -p tcp -m tcp --dport 9000 -m conntrack --ctstate NEW -j ACCEPT -A IN_dmz_allow -s 192.168.4.0/24 -p tcp -m tcp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT -A IN_trusted -j IN_trusted_log -A IN_trusted -j IN_trusted_deny -A IN_trusted -j IN_trusted_allow -A IN_trusted -j ACCEPT -A IN_trusted_allow -p tcp -m tcp --dport 111 -m conntrack --ctstate NEW -j ACCEPT -A IN_trusted_allow -p udp -m udp --dport 111 -m conntrack --ctstate NEW -j ACCEPT -A IN_trusted_allow -p tcp -m tcp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT -A IN_trusted_allow -p tcp -m tcp --dport 20048 -m conntrack --ctstate NEW -j ACCEPT -A IN_trusted_allow -p udp -m udp --dport 20048 -m conntrack --ctstate NEW -j ACCEPT COMMIT # Completed on Fri Oct 14 14:47:44 2016