*nat
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# allow localhost and loopback traffic
-A OUTPUT -o lo -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s 127.0.0.1 -d 127.0.0.1 -i lo -j ACCEPT

#source and destination check
#---------------------------------------------------------------
#user-define chains, efficient chain repetition
-N check-src
-N check-dst

#--------------------------------------------------------------
# Verify valid source and destination addresses for all packets
#---------------------------------------------------------------
-A INPUT   -i eth1 -j check-src
-A OUTPUT  -o eth1 -j check-dst

#---------------------------------------------------------------
# Drop packets from external interface IP, spoofing attempt
#---------------------------------------------------------------
-A check-src -s 10.0.0.0/8      -j DROP
-A check-src -s 172.16.0.0/12   -j DROP
-A check-src -s 192.168.0.0/16  -j DROP
-A check-src -s 224.0.0.0/4     -j DROP
-A check-src -s 240.0.0.0/5     -j DROP
-A check-src -s 127.0.0.0/8     -j DROP
-A check-src -s 0.0.0.0/8       -j DROP
-A check-src -s 169.254.0.0/16  -j DROP

# do we want outgoing multicast? maybe...
-A check-dst -d 224.0.0.0/4     -j DROP
-A check-dst -d 255.255.255.255 -j DROP
#---------------------------------------------------------------

#allowed ICMP echo reply, do we want to allow ICMP in?
#-A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
# allow any icmp to make intermapper happy
-A INPUT -p icmp --icmp-type any -j ACCEPT

# allow private data traffic - for kickstarting gcomps and such 
-A INPUT -s 10.0.0.0/16 -d 10.0.0.0/16 -i eth0 -j ACCEPT


# allow private vpn traffic - for vpn access
#-A INPUT -s 172.31.0.0/16 -d 172.31.0.0/16 -i  -j ACCEPT

#Deny compaq utilities externally
-A INPUT -i eth1 -p tcp -m tcp --dport 2381 -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 2301 -j DROP

#Deny internal nets from public net
-A INPUT -i eth1 -s 10.0.0.0/8 -j REJECT
-A INPUT -i eth1 -s 172.31.0.0/16 -j REJECT
-A INPUT -i eth1 -s 192.168.0.0/24 -j REJECT

#allow all incoming, established connections. (e.g. packets from a connected that originated
#as an outgoing connection).
-A INPUT -i eth1 -p tcp -m state --state RELATED,ESTABLISHED -s 0/0 -j ACCEPT
-A INPUT -i eth1 -p udp -m state --state RELATED,ESTABLISHED -s 0/0 -j ACCEPT

#ssh is allowed, of course.
-A INPUT -i eth1 -p tcp -m tcp --dport ssh -j ACCEPT

#Proper NTP function is essential for correct Kerberos and GSI authentication
-A INPUT -i eth1 -p tcp -m tcp --dport ntp -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --dport ntp -j ACCEPT

#Daytime: for monitoring sites who do not accept ICMP
-A INPUT -i eth1 -p tcp -m tcp --dport 13 -j ACCEPT

# Allow forwarding for established connections, and allow all outgoing connections from
#masquaraded machines
-A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j ACCEPT

# Uncomment the line below to activate web access to the cluster.
#-A INPUT -i eth1 -p tcp -m tcp --dport www -j ACCEPT
#-A INPUT -i eth1 -p tcp -m tcp --dport https -j ACCEPT

#SRB
#  5825 for production
#  5925 for staging
-A INPUT -i eth1 -p tcp -m tcp --dport 5825 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 5925 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 6025 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 20000:20200 -j ACCEPT

#POSTGRES
-A INPUT -s 198.202.95.0/24 -i eth1 -p tcp -m tcp --dport 5432 -j ACCEPT
-A INPUT -s 198.202.95.0/24 -i eth1 -p udp -m udp --dport 5432 -j ACCEPT
-A INPUT -s 132.239.132.230/24 -i eth1 -p tcp -m tcp --dport 5432 -j ACCEPT
-A INPUT -s 132.239.132.230/24 -i eth1 -p udp -m udp --dport 5432 -j ACCEPT

#ORACLE
-A INPUT -i eth1 -p tcp -m tcp --dport 1521 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 1525 -j ACCEPT
#ORACLE FOR UMN
-A INPUT -i eth1 -p tcp -m tcp --dport 10025 -j ACCEPT

#Iperf
-A INPUT -i eth1 -p tcp -m tcp --dport 5001 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 5000 -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --dport 5000 -j ACCEPT

#Globus
-A INPUT -i eth1 -p tcp -m tcp --dport 2811 -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --dport 2811 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 2119 -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --dport 2119 -j ACCEPT

#Ganglia
-A INPUT -s 198.202.95.214 -i eth1 -p tcp -m tcp --dport 8649 -j ACCEPT
-A INPUT -s 198.202.95.214 -i eth1 -p udp -m udp --dport 8649 -j ACCEPT

# TOMCAT
-A INPUT -i eth1 -p tcp -m tcp --dport www -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport https -j ACCEPT 
-A INPUT -i eth1 -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 2401 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport webcache -j ACCEPT

#Kerberos (need for at least AFS)
-A INPUT -i eth1 -p tcp --dport kerberos -j ACCEPT
-A INPUT -i eth1 -p udp --dport kerberos -j ACCEPT
-A INPUT -i eth1 -p tcp --dport kerberos-iv -j ACCEPT
-A INPUT -i eth1 -p udp --dport kerberos-iv -j ACCEPT

#AFS
-A INPUT -i eth1 -p tcp --dport 7000:7009 -j ACCEPT
-A INPUT -i eth1 -p udp --dport 7000:7009 -j ACCEPT

#CONDOR
-A INPUT -i eth1 -p tcp -m tcp --dport 9000:9700 -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --dport 9000:9700 -j ACCEPT

# Needed for tripwire
-A INPUT -i eth1 -p tcp  --dport 1169 -j ACCEPT
-A INPUT -i eth1 -p udp  --dport 1169 -j ACCEPT
#-A OUTPUT -i eth1 -p tcp --sport -j ACCEPT
#-A OUTPUT -i eth1 -p udp --sport -j ACCEPT

# Bacula
-A INPUT -s bacula.nbirn.net -i eth1 -p tcp -m tcp --dport 9102 -j ACCEPT

COMMIT

