From f23abd53fd7bcc5aab8e2e5fc17fdef0e7b6aeda Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Wed, 27 Jun 2018 15:37:47 +0200 Subject: tests: add another ipv4 only ruleset Signed-off-by: Florian Westphal --- .../shell/testcases/ipt-save/0001load-dumps_0 | 1 + .../shell/testcases/ipt-save/dumps/wireless.txt | 81 ++++++++++++++++++++++ 2 files changed, 82 insertions(+) create mode 100644 iptables/tests/shell/testcases/ipt-save/dumps/wireless.txt diff --git a/iptables/tests/shell/testcases/ipt-save/0001load-dumps_0 b/iptables/tests/shell/testcases/ipt-save/0001load-dumps_0 index acbc7b73..4e0be51c 100755 --- a/iptables/tests/shell/testcases/ipt-save/0001load-dumps_0 +++ b/iptables/tests/shell/testcases/ipt-save/0001load-dumps_0 @@ -48,5 +48,6 @@ do_simple() do_simple "iptables" $(dirname "$0")/dumps/ipt-save-filter.txt do_simple "iptables" $(dirname "$0")/dumps/policy-drop.txt +do_simple "iptables" $(dirname "$0")/dumps/wireless.txt exit $RET diff --git a/iptables/tests/shell/testcases/ipt-save/dumps/wireless.txt b/iptables/tests/shell/testcases/ipt-save/dumps/wireless.txt new file mode 100644 index 00000000..2bd3832a --- /dev/null +++ b/iptables/tests/shell/testcases/ipt-save/dumps/wireless.txt @@ -0,0 +1,81 @@ +# Generated by iptables-save v1.4.21 on Thu Jun 29 18:03:06 2017 +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:port_assignment - [0:0] +-A PREROUTING -j port_assignment +-A OUTPUT -j port_assignment +-A port_assignment -p tcp -m tcp --dport 1723 -j CT --helper pptp +COMMIT +# Completed on Thu Jun 29 18:03:06 2017 +# Generated by iptables-save v1.4.21 on Thu Jun 29 18:03:06 2017 +*filter +:INPUT DROP [0:0] +:FORWARD DROP [0:0] +:OUTPUT ACCEPT [0:0] +:CUST_I15_IN - [0:0] +:CUST_I15_OUT - [0:0] +:CUST_I16_IN - [0:0] +:CUST_I16_OUT - [0:0] +:L_ACCEPT - [0:0] +:L_DROP - [0:0] +:L_REJECT - [0:0] +:VPN_USERS_IN - [0:0] +:VPN_USERS_OUT - [0:0] +-A INPUT -m conntrack --ctstate INVALID -j L_DROP +-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j L_ACCEPT +-A INPUT -i lo -j L_ACCEPT +-A INPUT -s 10.78.129.130/32 -p tcp -m tcp --dport 5666 -j L_ACCEPT +-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --dports 22,80,443,873,1723 -j L_ACCEPT +-A INPUT -p udp -m udp -m multiport --dports 500,1701,4500 -j L_ACCEPT +-A INPUT -p icmp -m icmp --icmp-type 8 -j L_ACCEPT +-A INPUT -s 10.31.70.8/29 -i bond0.208 -p tcp -m tcp --dport 179 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT +-A INPUT -s 10.44.224.8/29 -i bond0.686 -p tcp -m tcp --dport 179 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT +-A INPUT -p esp -j L_ACCEPT +-A INPUT -s 168.209.255.75/32 -p gre -j L_ACCEPT +-A INPUT -s 168.209.255.106/32 -p gre -j L_ACCEPT +-A INPUT -s 10.35.167.46/32 -p gre -j L_ACCEPT +-A INPUT -s 10.35.167.45/32 -p gre -j L_ACCEPT +-A INPUT -i gre-wbcore -j L_ACCEPT +-A INPUT -i gre-davo-+ -j L_ACCEPT +-A INPUT -i bond0.208 -j L_DROP +-A INPUT -i bond0.686 -j L_DROP +-A INPUT -j L_ACCEPT +-A FORWARD -i bond0.10 -j ACCEPT +-A FORWARD -m conntrack --ctstate INVALID -j L_DROP +-A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu +-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j L_ACCEPT +-A FORWARD -d 10.31.63.80/30 -o bond0.10 -j L_ACCEPT +-A FORWARD -o bond0.11 -j CUST_I16_IN +-A FORWARD -i bond0.11 -j CUST_I16_OUT +-A FORWARD -o bond0.12 -j CUST_I15_IN +-A FORWARD -i bond0.12 -j CUST_I15_OUT +-A FORWARD -s 192.168.255.0/24 -i ppp+ -o bond0.208 -j L_DROP +-A FORWARD -s 192.168.255.0/24 -i ppp+ -o bond0.686 -j L_DROP +-A FORWARD -j L_ACCEPT +-A CUST_I15_IN -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT +-A CUST_I15_IN -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT +-A CUST_I15_IN -p tcp -m tcp --dport 433 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT +-A CUST_I15_IN -p tcp -m tcp --dport 3306 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT +-A CUST_I15_IN -p tcp -m tcp --dport 3390 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT +-A CUST_I15_IN -j L_DROP +-A CUST_I15_OUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --dports 80,443 -j L_ACCEPT +-A CUST_I15_OUT -j L_DROP +-A CUST_I16_IN -p tcp -m tcp --dport 3390 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT +-A CUST_I16_IN -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT +-A CUST_I16_IN -p icmp -m icmp --icmp-type 8 -j L_ACCEPT +-A CUST_I16_IN -j L_DROP +-A CUST_I16_OUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --dports 80,443 -j L_ACCEPT +-A CUST_I16_OUT -d 154.73.34.12/32 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --dports 25 -j L_ACCEPT +-A CUST_I16_OUT -j L_DROP +-A L_ACCEPT -j NFLOG --nflog-group 1 --nflog-threshold 5 +-A L_ACCEPT -j ACCEPT +-A L_DROP -j LOG --log-prefix "L_DROP: " +-A L_DROP -j NFLOG --nflog-group 2 --nflog-threshold 5 +-A L_DROP -j DROP +-A L_REJECT -j NFLOG --nflog-group 3 --nflog-threshold 5 +-A L_REJECT -j REJECT --reject-with icmp-port-unreachable +-A VPN_USERS_IN -i ppp0 -m comment --comment "User: " -j ACCEPT +-A VPN_USERS_OUT -o ppp0 -m comment --comment "User: " -j ACCEPT +COMMIT +# Completed on Thu Jun 29 18:03:06 2017 -- cgit v1.2.3