Competitions/public_ccdc
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added

Browse Source
This commit is contained in:
Rahul Gupta
2018-01-27 07:50:48 -08:00
parent a711414ebb
commit eea2215b24
112 changed files with 18359 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
file.txt
View File
general-ccdc/README.md
Executable
+4
View File
@@ -0,0 +1,4 @@
scripts
=======
Scripts for use
general-ccdc/bastion/bro/etc/broctl.cfg
Executable
+9
View File
@@ -0,0 +1,9 @@
## Bro configuration
MailTo = root@localhost
SitePolicyStandalone = local.bro
CfgDir = /opt/bro/etc
SpoolDir = /opt/bro/spool
LogDir = /opt/bro/logs
LogRotationInterval = 3600
MinDiskSpace = 5
general-ccdc/bastion/bro/etc/networks.cfg
Executable
+6
View File
@@ -0,0 +1,6 @@
# List of local networks in CIDR notation, optionally followed by a
# descriptive tag.
# For example, "10.0.0.0/8" or "fe80::/64" are valid prefixes.
10.0.0.0/8 Private IP space
192.168.0.0/16 Private IP space
general-ccdc/bastion/bro/etc/node.cfg
Executable
+37
View File
@@ -0,0 +1,37 @@
# Example BroControl node configuration.
#
# This example has a standalone node ready to go except for possibly changing
# the sniffing interface.
# This is a complete standalone configuration. Most likely you will
# only need to change the interface.
[bro]
type=standalone
host=localhost
interface=eth0
## Below is an example clustered configuration. If you use this,
## remove the [bro] node above.
#[manager]
#type=manager
#host=host1
#
#[proxy-1]
#type=proxy
#host=host1
#
#[worker-1]
#type=worker
#host=host2
#interface=eth0
#
#[worker-2]
#type=worker
#host=host3
#interface=eth0
#
#[worker-3]
#type=worker
#host=host4
#interface=eth0
general-ccdc/bastion/bro/scripts/local.bro
Executable
+87
View File
@@ -0,0 +1,87 @@
# Local Bro policy optimized for full monitorinng.
#
# Author: Matthias Vallentin
#
@load misc/loaded-scripts
@load tuning/defaults
# Process packets despite bad checksums.
redef ignore_checksums = T;
#
# File Analysis
#
const executables = /application\/.*/ &redef;
# Extract these files.
redef IRC::extract_file_types = executables;
redef FTP::extract_file_types = executables;
redef HTTP::extract_file_types = executables;
redef SMTP::extract_file_types = executables;
# Generate MD5 digests for certain files.
redef HTTP::generate_md5 = executables;
redef SMTP::generate_md5 = executables;
#
# Protocl Analysis
#
@load protocols/ftp/detect
@load protocols/conn/known-hosts
@load protocols/conn/known-services
@load protocols/ssl/known-certs
@load protocols/ssl/validate-certs
@load protocols/ssh/geo-data
@load protocols/ssh/detect-bruteforcing
@load protocols/ssh/interesting-hostnames
@load protocols/http/detect-MHR
@load protocols/http/detect-sqli
# Log plain-text passwords.
redef FTP::default_capture_password = T;
redef HTTP::default_capture_password = T;
# Log HTTP cookies.
redef record HTTP::Info += { cookie: string &log &optional; };
event http_header(c: connection, is_orig: bool, name: string, value: string)
{
if ( is_orig && name == "COOKIE" )
c$http$cookie = value;
}
#
# Software framework
#
@load frameworks/software/version-changes
@load frameworks/software/vulnerable
redef Software::vulnerable_versions += {
["Flash"] = [$major=10, $minor=2, $minor2=153, $addl="1"],
["Java"] = [$major=1, $minor=6, $minor2=0, $addl="22"],
};
@load protocols/ftp/software
@load protocols/smtp/software
@load protocols/ssh/software
@load protocols/http/software
@load-sigs frameworks/signatures/detect-windows-shells
@load protocols/http/detect-webapps # Performance-hungry!
#
# Notice Policy
#
hook Notice::policy(n: Notice::Info)
{
if ( n$note == SSL::Invalid_Server_Cert && Site::is_local_addr(n$id$orig_h) )
break;
}
hook Notice::policy(n: Notice::Info)
{
add n$actions[Notice::ACTION_ALARM];
}
general-ccdc/bastion/firewall/firewall.fwb
Executable
+1281
View File
File diff suppressed because it is too large Load Diff
general-ccdc/bastion/firewall/nccdc14/NETWORK.net
Executable
+181
View File
@@ -0,0 +1,181 @@
# ----------------------------------------------------------------------------
# Hosts
# ----------------------------------------------------------------------------
#
# We use the following format for host definitions:
#
# HOSTNAME = IP # dns-label-1, ...: OS - service-1, ...
#
# TODO: replace <66> with our team number plus a zero, e.g., <20> for Team #2.
# Unkown IP address
XXX = 0.0.0.0/32
# Networking Gear
SWITCH = XXX # - Switch: Juniper EX2200
ROUTER = XXX # - Router: Juniper SRX210
# - Wifi: Juniper WLC2
# - Wifi: Juniper WLA522
# Servers
CORTANA = 10.66.66.4/32 # dns: Windows 2012 - DNS
FAITH = 10.66.66.10/32 # mail, blog: Fedora - Mail, POP3, HTTP
ELLIE = 10.66.66.20/32 # store: Windows 2008 - IIS
DESMOND = 10.66.66.21/32 # sql: BSD - MySQL, SSH
ESXI = 10.66.66.30/32 # n/a: ESXi
PHONE = 10.66.66.252/32 # n/a: Cisco IP phone
# Workstations / Laptops
PEACH = XXX # n/a: Windows 7 x86
ZELDA = XXX # n/a: Windows XP SP3
YOSHI = XXX # n/a: Windows 8
GORDON = XXX # n/a: NO OS
TOAD = XXX # n/a: Windows XP SP2
# Internal Cloud
VM_GUIDANCE = 10.66.66.201/32 # n/a: n/a
VM_IDM = 10.66.66.202/32 # n/a: n/a
VM_OPENBUILD = 10.66.66.204/32 # n/a: n/a
# External Cloud
VM_DNS = 172.16.66.201/32 # n/a: NetBSD
VM_MINECRAFT = 172.16.66.202/32 # n/a: Ubuntu
VM_UNREAL_TOURNAMENT = 172.16.66.203/32 # n/a: Mandriva
VM_TICKET_SYSTEM = 172.16.66.204/32 # n/a: Debian
VM_MEDAL_OF_HONOR = 172.16.66.210/32 # n/a: Windows XP
VM_QUAKE2 = 172.16.66.211/32 # n/a: Windows Vista
VM_VENTRILO = 172.16.66.212/32 # n/a: Solaris
VM_TEAMSPEAK2 = 172.16.66.213/32 # n/a: Windows 2003
VM_SPLUNK = 172.16.66.220/32 # n/a: ?
# Devises
NEXUS = XXX
GALAXY = XXX
# Competition Infrastructure
TEAM_PORTAL_SERVER = 10.120.0.5/32
SOFTWARE_SERVER = 10.120.0.9/32 # Software/patch server
NTP_SERVER = 10.120.0.10/32
VOIP_SERVER = 10.120.0.100/32
INTERNET_PROXY = 10.120.0.200/32
PRINTER1 = 10.110.0.200/32 # Printer 1: 2300dn
PRINTER2 = 10.110.0.201/32 # Printer 2: 2300dn
PRINTER3 = 10.110.0.202/32 # Printer 3: 2300dn
# ----------------------------------------------------------------------------
# Groups
# ----------------------------------------------------------------------------
COMP_SERVERS = TEAM_PORTAL_SERVER
SOFTWARE_SERVER
NTP_SERVER
VOIP_SERVER
INTERNET_PROXY
PRINTER1
PRINTER2
PRINTER3
INTERNAL_CLOUD = VM_GUIDANCE
VM_IDM
VM_OPENBUILD
EXTERNAL_CLOUD = VM_DNS
VM_MINECRAFT
VM_UNREAL_TOURNAMENT
VM_TICKET_SYSTEM
VM_MEDAL_OF_HONOR
VM_QUAKE2
VM_VENTRILO
VM_TEAMSPEAK2
VM_SPLUNK
# ----------------------------------------------------------------------------
# Subnets
# ----------------------------------------------------------------------------
COMP_NET = 10.110.0.0/16
10.120.0.0/16
DEFAULT_ROUTE_CORE = 10.66.66.1/32
DEFAULT_ROUTE_VIRTUAL = 172.16.66.1/32
INTERNAL_CLOUD_NET = 10.66.66.200/27 # 10.66.66.200-225
EXTERNAL_CLOUD_NET = 172.16.66.200/27 # 172.16.66.200-225
INTERNAL_NET = 10.66.66.0/24
EXTERNAL_NET = 176.16.66.0/24
POD = INTERNAL_NET
EXTERNAL_NET
# ----------------------------------------------------------------------------
# Defaults
# ----------------------------------------------------------------------------
RFC1918 = 10.0.0.0/8 # non-public
172.16.0.0/12 # non-public
192.168.0.0/16 # non-public
INTERNAL = RFC1918
LOOPBACK = 127.0.0.0/8 # loopback
::1/128 # ipv6 loopback
RFC_3330 = 169.254.0.0/16 # special use IPv4 addresses - netdeploy
LINKLOCAL = FE80::/10 # IPv6 link-local
SITELOCAL = FEC0::/10 # Ipv6 Site-local
MULTICAST = 224.0.0.0/4 # IP multicast
FF00::/8 # IPv6 multicast
CLASS-E = 240.0.0.0/4
RESERVED = 0.0.0.0/8 # reserved
RFC1918
LOOPBACK
RFC_3330
MULTICAST
CLASS-E
0000::/8 # reserved by IETF
0100::/8 # reserved by IETF
0200::/7 # reserved by IETF
0400::/6 # reserved by IETF
0800::/5 # reserved by IETF
1000::/4 # reserved by IETF
4000::/3 # reserved by IETF
6000::/3 # reserved by IETF
8000::/3 # reserved by IETF
A000::/3 # reserved by IETF
C000::/3 # reserved by IETF
E000::/4 # reserved by IETF
F000::/5 # reserved by IETF
F800::/6 # reserved by IETF
FC00::/7 # unique local unicast
FE00::/9 # reserved by IETF
LINKLOCAL # link local unicast
SITELOCAL # IPv6 site-local
# http://www.team-cymru.org/Services/Bogons/bogon-bn-agg.txt
# 22-Apr-2011
BOGON = 0.0.0.0/8
192.0.0.0/24
192.0.2.0/24
192.18.0.0/15
198.51.100.0/24
203.0.113.0/24
MULTICAST
CLASS-E
3FFE::/16 # 6bone
5F00::/8 # 6bone
2001:DB8::/32 # IPv6 documentation prefix
GOOGLE_PUBLIC_DNS_ANYCAST = 8.8.4.4/32 # IPv4 Anycast
8.8.8.8/32 # IPv4 Anycast
2001:4860:4860::8844/128 # IPv6 Anycast
2001:4860:4860::8888/128 # IPv6 Anycast
GOOGLE_DNS = GOOGLE_PUBLIC_DNS_ANYCAST
general-ccdc/bastion/firewall/nccdc14/SERVICES.svc
Executable
+79
View File
@@ -0,0 +1,79 @@
#
# Services
#
# TODO: Figure out ports
CISCO_VOIP = 1/tcp 1/udp
MINECRAFT_PORTS = 25565/tcp
UNREAL_TOURNAMENT_PORTS = 7777-7783/udp 27900/udp
MEDAL_OF_HONOR_PORTS = 12203-12218/udp 12300/udp 23000-23009/udp
QUAKE2_PORTS = 27910/tcp 27910/udp
VENTRILO_PORTS = 3784/tcp 3784/udp
TEAMSPEAK2_PORTS = 8767/tcp 8767/udp
# 14535/tcp # web interface
# 51234/tcp # query/telnet
#
# Defaults
#
WHOIS = 43/udp
SSH = 22/tcp
TELNET = 23/tcp
SMTP = 25/tcp
MAIL_SERVICES = SMTP
ESMTP
SMTP_SSL
POP_SSL
TIME = 37/tcp 37/udp
TACACS = 49/tcp
DNS = 53/tcp 53/udp
BOOTPS = 67/udp # BOOTP server
BOOTPC = 68/udp # BOOTP client
DHCP = BOOTPS
BOOTPC
TFTP = 69/tcp 69/udp
HTTP = 80/tcp
WEB_SERVICES = HTTP HTTPS
POP3 = 110/tcp
RPC = 111/udp
IDENT = 113/tcp 113/udp
NNTP = 119/tcp
NTP = 123/tcp 123/udp
MS_RPC_EPMAP = 135/udp 135/tcp
MS_137 = 137/udp
MS_138 = 138/udp
MS_139 = 139/tcp
IMAP = 143/tcp
SNMP = 161/udp
SNMP_TRAP = 162/udp
BGP = 179/tcp
IMAP3 = 220/tcp
LDAP = 389/tcp
LDAP_SERVICE = LDAP
LDAPS
HTTPS = 443/tcp
MS_445 = 445/tcp
SMTP_SSL = 465/tcp
IKE = 500/udp
SYSLOG = 514/udp
RTSP = 554/tcp
ESMTP = 587/tcp
LDAPS = 636/tcp
IMAPS = 993/tcp
POP_SSL = 995/tcp
HIGH_PORTS = 1024-65535/tcp 1024-65535/udp
MSSQL = 1433/tcp
MSSQL_MONITOR = 1434/tcp
RADIUS = 1812/tcp 1812/udp
HSRP = 1985/udp
NFSD = 2049/tcp 2049/udp
NETFLOW = 2056/udp
SQUID_PROXY = 3128/tcp
MYSQL = 3306/tcp
RDP = 3389/tcp
IPSEC = 4500/udp
POSTGRESQL = 5432/tcp
TRACEROUTE = 33434-33534/udp
general-ccdc/bastion/firewall/nccdc14/nccdc14.ipt
Executable
+87
View File
@@ -0,0 +1,87 @@
*filter
# Speedway FORWARD Policy
# ingress filter
#
# $Id: ./nccdc14.ipt $
# $Date: 2014/04/24 $
# inet
:FORWARD DROP
-N F_permit-icmp
-A F_permit-icmp -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-icmp
-N F_permit-voip
-A F_permit-voip -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-voip
-N F_permit-mail
-A F_permit-mail -p tcp --dport 25 -d 10.66.66.10/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-mail
-N F_permit-pop3
-A F_permit-pop3 -p tcp --dport 110 -d 10.66.66.10/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-pop3
-N F_permit-dns
-A F_permit-dns -p udp --dport 53 -d 10.66.66.4/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A F_permit-dns -p udp --dport 53 -d 172.16.66.201/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-dns
-N F_permit-http
-A F_permit-http -p tcp --dport 80 -d 10.66.66.4/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A F_permit-http -p tcp --dport 80 -d 172.16.66.204/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-http
-N F_permit-https
-A F_permit-https -p tcp --dport 443 -d 10.66.66.20/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-https
-N F_permit-ssh
-A F_permit-ssh -p tcp --dport 22 -d 10.66.66.21/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-ssh
-N F_permit-minecraft
-A F_permit-minecraft -p tcp --dport 25565 -d 172.16.66.202/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-minecraft
-N F_permit-unreal-tournament
-A F_permit-unreal-tournament -p udp -m multiport --dports 7777:7783,27900 -d 172.16.66.203/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-unreal-tournament
-N F_permit-moh
-A F_permit-moh -p udp -m multiport --dports 12203:12218,12300,23000:23009 -d 172.16.66.210/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-moh
-N F_permit-quake2
-A F_permit-quake2 -p tcp --dport 27910 -d 172.16.66.211/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A F_permit-quake2 -p udp --dport 27910 -d 172.16.66.211/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-quake2
-N F_permit-ventrilo
-A F_permit-ventrilo -p tcp --dport 3784 -d 172.16.66.212/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A F_permit-ventrilo -p udp --dport 3784 -d 172.16.66.212/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-ventrilo
-N F_permit-teamspeak
-A F_permit-teamspeak -p tcp --dport 8767 -d 172.16.66.213/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A F_permit-teamspeak -p udp --dport 8767 -d 172.16.66.213/32 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-teamspeak
-N F_permit-udp-established
-A F_permit-udp-established -p udp --sport 1024:65535 -d 10.66.66.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A F_permit-udp-established -p udp --sport 1024:65535 -d 176.16.66.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_permit-udp-established
-N F_default-deny
-A F_default-deny -p all -j DROP
-A FORWARD -j F_default-deny
# Speedway FORWARD Policy
# egress filter
#
# $Id: ./nccdc14.ipt $
# $Date: 2014/04/24 $
# inet
:FORWARD DROP
-N F_deny-to-bad-destinations
-A F_deny-to-bad-destinations -p all -d 0.0.0.0/8 -j DROP
-A F_deny-to-bad-destinations -p all -d 10.0.0.0/8 -j DROP
-A F_deny-to-bad-destinations -p all -d 127.0.0.0/8 -j DROP
-A F_deny-to-bad-destinations -p all -d 169.254.0.0/16 -j DROP
-A F_deny-to-bad-destinations -p all -d 172.16.0.0/12 -j DROP
-A F_deny-to-bad-destinations -p all -d 192.0.0.0/24 -j DROP
-A F_deny-to-bad-destinations -p all -d 192.0.2.0/24 -j DROP
-A F_deny-to-bad-destinations -p all -d 192.18.0.0/15 -j DROP
-A F_deny-to-bad-destinations -p all -d 192.168.0.0/16 -j DROP
-A F_deny-to-bad-destinations -p all -d 198.51.100.0/24 -j DROP
-A F_deny-to-bad-destinations -p all -d 203.0.113.0/24 -j DROP
-A F_deny-to-bad-destinations -p all -d 224.0.0.0/3 -j DROP
-A FORWARD -j F_deny-to-bad-destinations
-N F_default-accept
-A F_default-accept -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j F_default-accept
COMMIT
general-ccdc/bastion/firewall/nccdc14/nccdc14.jcl
Executable
+235
View File
@@ -0,0 +1,235 @@
firewall {
family inet {
replace:
/*
** $Id: ./nccdc14.jcl $
** $Date: 2014/04/24 $
**
** ingress filter
*/
filter edge-inbound {
interface-specific;
term permit-icmp {
from {
protocol icmp;
}
then {
accept;
}
}
term permit-voip {
from {
protocol icmp;
}
then {
accept;
}
}
term permit-mail {
from {
destination-address {
10.66.66.10/32; /* mail, blog: Fedora - Mail, POP3, HTTP */
}
protocol tcp;
destination-port 25;
}
then {
accept;
}
}
term permit-pop3 {
from {
destination-address {
10.66.66.10/32; /* mail, blog: Fedora - Mail, POP3, HTTP */
}
protocol tcp;
destination-port 110;
}
then {
accept;
}
}
term permit-dns {
from {
destination-address {
10.66.66.4/32; /* dns: Windows 2012 - DNS */
172.16.66.201/32; /* n/a: NetBSD */
}
protocol udp;
destination-port 53;
}
then {
accept;
}
}
term permit-http {
from {
destination-address {
10.66.66.4/32; /* dns: Windows 2012 - DNS */
172.16.66.204/32; /* n/a: Debian */
}
protocol tcp;
destination-port 80;
}
then {
accept;
}
}
term permit-https {
from {
destination-address {
10.66.66.20/32; /* store: Windows 2008 - IIS */
}
protocol tcp;
destination-port 443;
}
then {
accept;
}
}
term permit-ssh {
from {
destination-address {
10.66.66.21/32; /* sql: BSD - MySQL, SSH */
}
protocol tcp;
destination-port 22;
}
then {
accept;
}
}
term permit-minecraft {
from {
destination-address {
172.16.66.202/32; /* n/a: Ubuntu */
}
protocol tcp;
destination-port 25565;
}
then {
accept;
}
}
term permit-unreal-tournament {
from {
destination-address {
172.16.66.203/32; /* n/a: Mandriva */
}
protocol udp;
destination-port [ 7777-7783 27900 ];
}
then {
accept;
}
}
term permit-moh {
from {
destination-address {
172.16.66.210/32; /* n/a: Windows XP */
}
protocol udp;
destination-port [ 12203-12218 12300 23000-23009 ];
}
then {
accept;
}
}
term permit-quake2 {
from {
destination-address {
172.16.66.211/32; /* n/a: Windows Vista */
}
protocol [ tcp udp ];
destination-port 27910;
}
then {
accept;
}
}
term permit-ventrilo {
from {
destination-address {
172.16.66.212/32; /* n/a: Solaris */
}
protocol [ tcp udp ];
destination-port 3784;
}
then {
accept;
}
}
term permit-teamspeak {
from {
destination-address {
172.16.66.213/32; /* n/a: Windows 2003 */
}
protocol [ tcp udp ];
destination-port 8767;
}
then {
accept;
}
}
term permit-udp-established {
from {
destination-address {
10.66.66.0/24;
176.16.66.0/24;
}
protocol udp;
source-port 1024-65535;
}
then {
accept;
}
}
term default-deny {
then {
discard;
}
}
}
}
}
firewall {
family inet {
replace:
/*
** $Id: ./nccdc14.jcl $
** $Date: 2014/04/24 $
**
** egress filter
*/
filter edge-outbound {
interface-specific;
term deny-to-bad-destinations {
from {
destination-address {
0.0.0.0/8; /* reserved */
10.0.0.0/8; /* non-public */
127.0.0.0/8; /* loopback */
169.254.0.0/16; /* special use IPv4 addresses -
** netdeploy */
172.16.0.0/12; /* non-public */
192.0.0.0/24;
192.0.2.0/24;
192.18.0.0/15;
192.168.0.0/16; /* non-public */
198.51.100.0/24;
203.0.113.0/24;
224.0.0.0/3; /* IP multicast */
}
}
then {
discard;
}
}
term default-accept {
then {
accept;
}
}
}
}
}
general-ccdc/bastion/firewall/nccdc14/nccdc14.pol
Executable
+177
View File
@@ -0,0 +1,177 @@
# -----------------------------------------------------------------------------
# INGRESS
# -----------------------------------------------------------------------------
header {
comment:: "ingress filter"
target:: juniper edge-inbound inet
target:: srx from-zone outside to-zone pod
target:: speedway FORWARD DROP inet
}
term permit-icmp {
protocol:: icmp
action:: accept
}
term permit-voip {
protocol:: icmp
action:: accept
}
term permit-mail {
destination-address:: FAITH
protocol:: tcp
destination-port:: SMTP
action:: accept
}
term permit-pop3 {
destination-address:: FAITH
protocol:: tcp
destination-port:: POP3
action:: accept
}
term permit-dns {
destination-address:: CORTANA VM_DNS
protocol:: udp
destination-port:: DNS
action:: accept
}
term permit-http {
destination-address:: CORTANA VM_TICKET_SYSTEM
protocol:: tcp
destination-port:: HTTP
action:: accept
}
term permit-https {
destination-address:: ELLIE
protocol:: tcp
destination-port:: HTTPS
action:: accept
}
term permit-ssh {
destination-address:: DESMOND
protocol:: tcp
destination-port:: SSH
action:: accept
}
term permit-minecraft {
destination-address:: VM_MINECRAFT
protocol:: tcp
destination-port:: MINECRAFT_PORTS
action:: accept
}
term permit-unreal-tournament {
destination-address:: VM_UNREAL_TOURNAMENT
protocol:: udp
destination-port:: UNREAL_TOURNAMENT_PORTS
action:: accept
}
term permit-moh {
destination-address:: VM_MEDAL_OF_HONOR
protocol:: udp
destination-port:: MEDAL_OF_HONOR_PORTS
action:: accept
}
term permit-quake2 {
destination-address:: VM_QUAKE2
protocol:: tcp udp
destination-port:: QUAKE2_PORTS
action:: accept
}
term permit-ventrilo {
destination-address:: VM_VENTRILO
protocol:: tcp udp
destination-port:: VENTRILO_PORTS
action:: accept
}
term permit-teamspeak {
destination-address:: VM_TEAMSPEAK2
protocol:: tcp udp
destination-port:: TEAMSPEAK2_PORTS
action:: accept
}
# Does not compile for SRX. Uncomment for iptables.
#term permit-tcp-established {
# destination-address:: POD
# protocol:: tcp
# option:: tcp-established
# action:: accept
#}
# Probably not needed
#term permit-udp-established {
# destination-address:: POD
# protocol:: udp
# source-port:: HIGH_PORTS
# action:: accept
#}
term default-deny {
action:: deny
}
# -----------------------------------------------------------------------------
# EGRESS
# -----------------------------------------------------------------------------
header {
comment:: "egress filter"
target:: juniper edge-outbound
target:: speedway FORWARD DROP inet
}
term deny-to-bad-destinations {
destination-address:: RFC1918 BOGON RESERVED
action:: deny
}
term permit-comp-servers {
destination-address:: COMP_SERVERS GOOGLE_DNS
protocol:: tcp udp
action:: accept
}
term permit-voip-phone {
source-address:: PHONE
destination-address:: COMP_NET
protocol:: tcp udp
port:: CISCO_VOIP
target:: accept
}
term default-deny {
action:: deny
}
# -----------------------------------------------------------------------------
# INPUT
# -----------------------------------------------------------------------------
header {
comment:: "input filter"
target:: juniper edge-filter
target:: speedway INPUT DROP inet
}
term permit-admin {
source-address:: POD
destination-address:: ROUTER
protocol:: tcp
port:: TELNET SSH
target:: accept
}
# TODO: DHCP?
general-ccdc/bastion/firewall/nccdc14/nccdc14.srx
Executable
+346
View File
@@ -0,0 +1,346 @@
security {
zones {
security-zone pod {
replace: address-book {
address FAITH_0 10.66.66.10/32;
address CORTANA_0 10.66.66.4/32;
address VM_DNS_0 172.16.66.201/32;
address VM_TICKET_SYSTEM_0 172.16.66.204/32;
address ELLIE_0 10.66.66.20/32;
address DESMOND_0 10.66.66.21/32;
address VM_MINECRAFT_0 172.16.66.202/32;
address VM_UNREAL_TOURNAMENT_0 172.16.66.203/32;
address VM_MEDAL_OF_HONOR_0 172.16.66.210/32;
address VM_QUAKE2_0 172.16.66.211/32;
address VM_VENTRILO_0 172.16.66.212/32;
address VM_TEAMSPEAK2_0 172.16.66.213/32;
address NET_0 10.66.66.0/24;
address NET_1 176.16.66.0/24;
address-set FAITH {
address FAITH_0;
}
address-set CORTANA {
address CORTANA_0;
}
address-set VM_DNS {
address VM_DNS_0;
}
address-set VM_TICKET_SYSTEM {
address VM_TICKET_SYSTEM_0;
}
address-set ELLIE {
address ELLIE_0;
}
address-set DESMOND {
address DESMOND_0;
}
address-set VM_MINECRAFT {
address VM_MINECRAFT_0;
}
address-set VM_UNREAL_TOURNAMENT {
address VM_UNREAL_TOURNAMENT_0;
}
address-set VM_MEDAL_OF_HONOR {
address VM_MEDAL_OF_HONOR_0;
}
address-set VM_QUAKE2 {
address VM_QUAKE2_0;
}
address-set VM_VENTRILO {
address VM_VENTRILO_0;
}
address-set VM_TEAMSPEAK2 {
address VM_TEAMSPEAK2_0;
}
address-set NET {
address NET_0;
address NET_1;
}
}
}
}
replace: policies {
/*
$Id: ./nccdc14.srx $
$Date: 2014/04/24 $
*/
from-zone outside to-zone pod {
policy permit-icmp {
match {
source-address any;
destination-address any;
application permit-icmp-app;
}
then {
permit;
}
}
policy permit-voip {
match {
source-address any;
destination-address any;
application permit-voip-app;
}
then {
permit;
}
}
policy permit-mail {
match {
source-address any;
destination-address [ FAITH ];
application permit-mail-app;
}
then {
permit;
}
}
policy permit-pop3 {
match {
source-address any;
destination-address [ FAITH ];
application permit-pop3-app;
}
then {
permit;
}
}
policy permit-dns {
match {
source-address any;
destination-address [ CORTANA VM_DNS ];
application permit-dns-app;
}
then {
permit;
}
}
policy permit-http {
match {
source-address any;
destination-address [ CORTANA VM_TICKET_SYSTEM ];
application permit-http-app;
}
then {
permit;
}
}
policy permit-https {
match {
source-address any;
destination-address [ ELLIE ];
application permit-https-app;
}
then {
permit;
}
}
policy permit-ssh {
match {
source-address any;
destination-address [ DESMOND ];
application permit-ssh-app;
}
then {
permit;
}
}
policy permit-minecraft {
match {
source-address any;
destination-address [ VM_MINECRAFT ];
application permit-minecraft-app;
}
then {
permit;
}
}
policy permit-unreal-tournament {
match {
source-address any;
destination-address [ VM_UNREAL_TOURNAMENT ];
application permit-unreal-tournament-app;
}
then {
permit;
}
}
policy permit-moh {
match {
source-address any;
destination-address [ VM_MEDAL_OF_HONOR ];
application permit-moh-app;
}
then {
permit;
}
}
policy permit-quake2 {
match {
source-address any;
destination-address [ VM_QUAKE2 ];
application permit-quake2-app;
}
then {
permit;
}
}
policy permit-ventrilo {
match {
source-address any;
destination-address [ VM_VENTRILO ];
application permit-ventrilo-app;
}
then {
permit;
}
}
policy permit-teamspeak {
match {
source-address any;
destination-address [ VM_TEAMSPEAK2 ];
application permit-teamspeak-app;
}
then {
permit;
}
}
policy permit-udp-established {
match {
source-address any;
destination-address [ NET ];
application permit-udp-established-app;
}
then {
permit;
}
}
policy default-deny {
match {
source-address any;
destination-address any;
application any;
}
then {
deny;
}
}
}
}
}
replace: applications {
application-set permit-icmp-app {
application permit-icmp-app1;
}
application permit-icmp-app1 {
term t1 protocol icmp;
}
application-set permit-voip-app {
application permit-voip-app1;
}
application permit-voip-app1 {
term t1 protocol icmp;
}
application-set permit-mail-app {
application permit-mail-app1;
}
application permit-mail-app1 {
term t1 protocol tcp destination-port 25;
}
application-set permit-pop3-app {
application permit-pop3-app1;
}
application permit-pop3-app1 {
term t1 protocol tcp destination-port 110;
}
application-set permit-dns-app {
application permit-dns-app1;
}
application permit-dns-app1 {
term t1 protocol udp destination-port 53;
}
application-set permit-http-app {
application permit-http-app1;
}
application permit-http-app1 {
term t1 protocol tcp destination-port 80;
}
application-set permit-https-app {
application permit-https-app1;
}
application permit-https-app1 {
term t1 protocol tcp destination-port 443;
}
application-set permit-ssh-app {
application permit-ssh-app1;
}
application permit-ssh-app1 {
term t1 protocol tcp destination-port 22;
}
application-set permit-minecraft-app {
application permit-minecraft-app1;
}
application permit-minecraft-app1 {
term t1 protocol tcp destination-port 25565;
}
application-set permit-unreal-tournament-app {
application permit-unreal-tournament-app1;
application permit-unreal-tournament-app2;
}
application permit-unreal-tournament-app1 {
term t1 protocol udp destination-port 7777-7783;
}
application permit-unreal-tournament-app2 {
term t2 protocol udp destination-port 27900;
}
application-set permit-moh-app {
application permit-moh-app1;
application permit-moh-app2;
application permit-moh-app3;
}
application permit-moh-app1 {
term t1 protocol udp destination-port 12203-12218;
}
application permit-moh-app2 {
term t2 protocol udp destination-port 12300;
}
application permit-moh-app3 {
term t3 protocol udp destination-port 23000-23009;
}
application-set permit-quake2-app {
application permit-quake2-app1;
application permit-quake2-app2;
}
application permit-quake2-app1 {
term t1 protocol tcp destination-port 27910;
}
application permit-quake2-app2 {
term t2 protocol udp destination-port 27910;
}
application-set permit-ventrilo-app {
application permit-ventrilo-app1;
application permit-ventrilo-app2;
}
application permit-ventrilo-app1 {
term t1 protocol tcp destination-port 3784;
}
application permit-ventrilo-app2 {
term t2 protocol udp destination-port 3784;
}
application-set permit-teamspeak-app {
application permit-teamspeak-app1;
application permit-teamspeak-app2;
}
application permit-teamspeak-app1 {
term t1 protocol tcp destination-port 8767;
}
application permit-teamspeak-app2 {
term t2 protocol udp destination-port 8767;
}
application-set permit-udp-established-app {
application permit-udp-established-app1;
}
application permit-udp-established-app1 {
term t1 protocol udp source-port 1024-65535;
}
}
general-ccdc/bastion/firewall/nccdc15/NETWORK.net
Executable
+161
View File
@@ -0,0 +1,161 @@
XXX = 0.0.0.0/32
PUBLIC_DNS = 8.8.8.8/32
8.8.4.4/32
12.127.17.71/32
12.127.17.72/32
# --------------------------------
# Corporate
# --------------------------------
SWITCH = 10.70.70.77/32
THUNDERBOLTS = 10.70.70.5/32
INITIATIVE = 10.70.70.10/32
ANTHONY = 10.70.70.15/32 # e-commerce
HELLFIRE = 10.70.70.20/32
MONGER = 10.70.70.200/32
NATASHA = 10.70.70.107/32
CLINT = 10.70.70.105/32
NICK = 10.70.70.106/32
BRUCE = 10.70.70.104/32
WSUS = 10.70.70.21/32
KALI = 10.70.70.78/32
SV_APPLIANCE = 10.70.70.109/32
SV_WORKBENCH = 10.70.70.110/32
CANARY = 10.70.70.250/32
CANARY_NET = 192.168.251.0/24
FOXBOX = 10.70.70.251/32
FOXBOX_NET = 10.16.0.0/16 10.130.0.0/16
PHONE = 10.70.70.252/32
ESXI_SERVER = MONGER
VSPHERE_CLIENTS = HELLFIRE
CLINT
WINDOWS_WORKSTATIONS = CLINT
NICK
BRUCE
WSUS
WINDOWS_AD_SERVER = HELLFIRE
POD = THUNDERBOLTS
INITIATIVE
ANTHONY
HELLFIRE
MONGER
NATASHA
CLINT
NICK
BRUCE
WSUS
CANARY
FOXBOX
PHONE
KALI
SWITCH
SV_APPLIANCE
SV_WORKBENCH
# Internal Cloud
GUIDANCE = 10.70.70.201/32
SUREVIEW = 10.70.70.202/32
RESILIENT = 10.70.70.205/32 # ticketing system (Solaris)
INTERNAL_CLOUD = GUIDANCE
SUREVIEW
RESILIENT
CORPORATE = POD
INTERNAL_CLOUD
CORPORATE_NET = 10.70.70.0/24
# --------------------------------
# Control
# --------------------------------
ARP_SPOOFER = 172.16.70.137/32
172.16.200.137/32
SRX = 172.16.70.1/32
172.16.70.2/32
SRX_DNS_SERVERS = 208.67.222.220/32
208.67.222.222/32
HMI = 172.16.70.202/32
172.16.200.202/32
HISTORIAN = 172.16.70.203/32
172.16.200.203/32
OPC = 172.16.70.204/32
172.16.200.204/32
HMI_WRKS = 172.16.70.205/32
172.16.200.205/32
ENGINEER_WRKS = 172.16.70.210/32
172.16.200.210/32
NMIS = 172.16.70.211/32
172.16.200.211/32
IDS = 172.16.70.253/32
172.16.200.253/32
CONTROL = HMI
HISTORIAN
OPC
HMI_WRKS
ENGINEER_WRKS
NMIS
IDS
CONTROL_NET = 172.16.70.0/24
# --------------------------------
# Plant
# --------------------------------
PLC240 = 172.16.201.240
PLC241 = 172.16.201.241
PLC242 = 172.16.201.242
PLANT = PLC240
PLC241
PLC242
# --------------------------------
# Blackteam
# --------------------------------
SPLUNK_SERVER = 192.168.7.70/32
BLACKTEAM_VSPHERE_NET = 192.168.224.0/24
BLACKTEAM_PORTAL = 10.120.0.5/32
BLACKTEAM_FILEREPO = 10.120.0.9/32
BLACKTEAM_TIME = 10.120.0.10/32
BLACKTEAM_VOIP_SERVER = 10.120.0.100/32
BLACKTEAM_VOIP_NET = 10.120.0.0/24
BLACKTEAM_PROXY = 10.120.0.200/32
BLACKTEAM_PRINTERS = 10.110.0.200/32
10.110.0.201/32
BLACKTEAM = BLACKTEAM_PORTAL
BLACKTEAM_FILEREPO
BLACKTEAM_TIME
BLACKTEAM_VOIP_SERVER
BLACKTEAM_PROXY
BLACKTEAM_PRINTERS
BLACKTEAM_NET = 10.110.0.0/16
10.120.0.0/16
192.168.251.0/24
# -----
# Other
# -----
DNS_SERVERS = PUBLIC_DNS
THUNDERBOLTS
SRX_DNS_SERVERS
general-ccdc/bastion/firewall/nccdc15/SERVICES.svc
Executable
+75
View File
@@ -0,0 +1,75 @@
FTP_CTRL = 21/tcp
FTP_DATA = 20/tcp
FTP_PASV = 42000-42100/tcp
HTTP_PROXY = 8080/tcp
SPLUNK_WEB = 8000/tcp
WEB_SERVICES = HTTP HTTPS HTTP_PROXY
VOIP = 5060/udp
SPLUNK = 9997/tcp
VSPHERE_IN = 443/tcp 902/tcp 903/tcp
VSPHERE_OUT = 902/tcp 902/udp
RAYTHEON = 9091/tcp
SCADA = 502/tcp
#
# Sample naming service definitions
#
WHOIS = 43/udp
SSH = 22/tcp
TELNET = 23/tcp
SMTP = 25/tcp
MAIL_SERVICES = SMTP
ESMTP
SMTP_SSL
POP_SSL
TIME = 37/tcp 37/udp
TACACS = 49/tcp
DNS = 53/tcp 53/udp
BOOTPS = 67/udp # BOOTP server
BOOTPC = 68/udp # BOOTP client
DHCP = BOOTPS
BOOTPC
TFTP = 69/tcp 69/udp
HTTP = 80/tcp
POP3 = 110/tcp
RPC = 111/udp
IDENT = 113/tcp 113/udp
NNTP = 119/tcp
NTP = 123/tcp 123/udp
MS_RPC_EPMAP = 135/udp 135/tcp
MS_137 = 137/udp
MS_138 = 138/udp
MS_139 = 139/tcp
IMAP = 143/tcp
SNMP = 161/udp
SNMP_TRAP = 162/udp
BGP = 179/tcp
IMAP3 = 220/tcp
LDAP = 389/tcp
LDAP_SERVICE = LDAP
LDAPS
HTTPS = 443/tcp
MS_445 = 445/tcp
SMTP_SSL = 465/tcp
IKE = 500/udp
SYSLOG = 514/udp
RTSP = 554/tcp
ESMTP = 587/tcp
LDAPS = 636/tcp
IMAPS = 993/tcp
POP_SSL = 995/tcp
HIGH_PORTS = 1024-65535/tcp 1024-65535/udp
MSSQL = 1433/tcp
MSSQL_MONITOR = 1434/tcp
RADIUS = 1812/tcp 1812/udp
HSRP = 1985/udp
NFSD = 2049/tcp 2049/udp
NETFLOW = 2056/udp
SQUID_PROXY = 3128/tcp
MYSQL = 3306/tcp
RDP = 3389/tcp
IPSEC = 4500/udp
POSTGRESQL = 5432/tcp
TRACEROUTE = 33434-33534/udp
general-ccdc/bastion/firewall/nccdc15/capirca.diff
Executable
+16
View File
@@ -0,0 +1,16 @@
--- capirca/lib/packetfilter.py 2013-09-10 17:13:47.000000000 -0500
+++ capirca/lib/packetfilter.py 2015-04-25 12:56:33.000000000 -0500
@@ -240,8 +240,10 @@
def _GeneratePortStatement(self, ports):
port_list = []
for port_tuple in ports:
- for port in port_tuple:
- port_list.append(str(port))
+ if port_tuple[0]==port_tuple[1]:
+ port_list.append(str(port_tuple[0]))
+ else:
+ port_list.append(str(port_tuple[0])+':'+str(port_tuple[1]))
return '{ %s }' % ' '.join(list(set(port_list)))
general-ccdc/bastion/firewall/nccdc15/deploy.sh
Executable
+10
View File
@@ -0,0 +1,10 @@
#!/bin/sh
set -e
echo "*** generating firewalls"
python /opt/capirca/aclgen.py -d /fw -o /fw -p /fw/nccdc15-corporate.pol
python /opt/capirca/aclgen.py -d /fw -o /fw -p /fw/nccdc15-control.pol
echo "*** enabling corporate firewall"
pfctl -f /fw/nccdc15-corporate.pf
echo "*** corporate firewall enabled"
general-ccdc/bastion/firewall/nccdc15/nccdc15-control.pol
Executable
+111
View File
@@ -0,0 +1,111 @@
header {
target:: srx from-zone Internal to-zone Internet
}
# Allow every box except ARP spoofer.
term default-allow {
source-address:: CONTROL
action:: accept
}
header {
target:: srx from-zone Internet to-zone Internal
}
term allow-icmp {
protocol:: icmp
action:: accept
}
term allow-ssh-srx {
destination-address:: SRX
destination-port:: SSH
protocol:: tcp
action:: accept
}
term allow-ssh-corporate {
source-address:: CORPORATE
destination-port:: SSH
protocol:: tcp
action:: accept
}
term allow-rdp-public {
destination-address:: HMI HMI_WRKS
destination-port:: RDP
protocol:: tcp
action:: accept
}
term allow-rdp-corporate {
source-address:: CORPORATE
destination-address:: HISTORIAN OPC ENGINEER_WRKS
destination-port:: RDP
protocol:: tcp
action:: accept
}
term rem-ssh {
destination-address:: OPC ENGINEER_WRKS
destination-port:: SSH
protocol:: tcp
action:: accept
}
term rem-ftp {
destination-address:: HISTORIAN
destination-port:: FTP_CTRL FTP_DATA FTP_PASV
protocol:: tcp
action:: accept
}
term rem-http {
destination-address:: NMIS
destination-port:: HTTP
protocol:: tcp
action:: accept
}
term allow-splunk {
comment:: "Splunk inject"
source-address:: SPLUNK_SERVER
destination-address:: OPC HMI
destination-port:: SPLUNK
protocol:: tcp
action:: accept
}
header {
target:: srx from-zone Internal to-zone Plant
}
term allow-icmp {
protocol:: icmp
action:: accept
}
term allow-plc-in {
source-address:: OPC
destination-address:: PLANT
destination-port:: SSH SCADA
protocol:: tcp
action:: accept
}
header {
target:: srx from-zone Plant to-zone Internal
}
term allow-icmp {
protocol:: icmp
action:: accept
}
term allow-plc-out {
source-address:: PLANT
destination-address:: OPC
destination-port:: SCADA
protocol:: tcp
action:: accept
}
general-ccdc/bastion/firewall/nccdc15/nccdc15-corporate.pol
Executable
+275
View File
@@ -0,0 +1,275 @@
header {
target:: packetfilter NCCDC
}
# ----------
# Quarantine
# ----------
term disallow-resilient {
source-address:: RESILIENT
destination-address:: CORPORATE_NET
protocol:: tcp udp
action:: deny
}
# -------
# General
# -------
term allow-icmp-out {
source-address:: CORPORATE_NET
protocol:: icmp
action:: accept
}
term allow-icmp-in {
source-address:: BLACKTEAM_NET
destination-address:: CORPORATE_NET
protocol:: icmp
action:: accept
}
term allow-dhcp {
source-address:: CORPORATE_NET
destination-address:: CORPORATE_NET
destination-port:: DHCP
protocol:: udp
action:: accept
}
term allow-dns-out {
source-address:: CORPORATE_NET
destination-address:: DNS_SERVERS
destination-port:: DNS
protocol:: tcp udp
action:: accept
}
# ----------------------
# Corporate-to-Control
# ----------------------
# TODO: lock down
term allow-control {
source-address:: CORPORATE
destination-address:: CONTROL_NET
action:: accept
}
term cloud-tcpdump {
source-address:: SRX
destination-address:: NATASHA
destination-port:: SSH
protocol:: tcp
action:: accept
}
# ----------------------
# Corporate-to-Corporate
# ----------------------
term allow-icmp-corp {
source-address:: CORPORATE
destination-address:: CORPORATE
protocol:: icmp
action:: accept
}
# FIXME: remove when Skyler says so
term tmp-allow-windows-crap {
source-address:: HELLFIRE WINDOWS_WORKSTATIONS
destination-address:: HELLFIRE WINDOWS_WORKSTATIONS
protocol:: tcp
action:: accept
}
#term allow-http-ticketing {
# source-address:: CORPORATE
# destination-address:: RESILIENT
# destination-port:: HTTP
# protocol:: tcp
# action:: accept
#}
term allow-ssh {
source-address:: CORPORATE
destination-address:: CORPORATE
destination-port:: SSH
protocol:: tcp
action:: accept
}
# AD + Updates
# TODO: lock down ports
term wsus-hellfire {
source-address:: WSUS HELLFIRE
destination-address:: WSUS HELLFIRE
protocol:: tcp udp
action:: accept
}
term allow-vsphere-in {
source-address:: VSPHERE_CLIENTS
destination-address:: ESXI_SERVER
destination-port:: VSPHERE_IN
protocol:: tcp
action:: accept
}
term allow-vsphere-out {
source-address:: ESXI_SERVER
destination-address:: VSPHERE_CLIENTS
destination-port:: VSPHERE_OUT
protocol:: tcp udp
action:: accept
}
# ---------
# Blackteam
# ---------
# TODO: restrict destination ports
term allow-vsphere {
source-address:: CORPORATE
destination-address:: BLACKTEAM_VSPHERE_NET
protocol:: tcp
action:: accept
}
# TODO: narrow
term allow-blackteam-out {
source-address:: CORPORATE
destination-address:: BLACKTEAM
protocol:: tcp udp
action:: accept
}
term allow-phone-in {
source-address:: BLACKTEAM_VOIP_NET
destination-address:: PHONE
protocol:: udp
action:: accept
}
term allow-phone-out {
source-address:: PHONE
destination-address:: BLACKTEAM_VOIP_NET
# destination-address:: BLACKTEAM_VOIP_SERVER
destination-port:: VOIP DHCP
protocol:: udp
action:: accept
}
term allow-proxy {
source-address:: CORPORATE
destination-address:: BLACKTEAM_PROXY
destination-port:: HTTP_PROXY
protocol:: tcp
action:: accept
}
term allow-canary-out {
source-address:: CANARY
destination-address:: CANARY_NET
action:: accept
}
term allow-canary-in {
source-address:: CANARY_NET
destination-address:: CANARY
action:: accept
}
term allow-foxbox-out {
source-address:: FOXBOX
destination-address:: FOXBOX_NET
destination-port:: HTTP
protocol:: tcp
action:: accept
}
term allow-foxbox-in {
source-address:: FOXBOX_NET
destination-address:: FOXBOX
destination-port:: HTTP
protocol:: tcp
action:: accept
}
# --------------
# Service Checks
# --------------
# 3 HTTP service checks
term allow-http {
destination-address:: ANTHONY INITIATIVE RESILIENT
destination-port:: HTTP HTTPS
protocol:: tcp
action:: accept
}
term allow-mail {
destination-address:: INITIATIVE
destination-port:: SMTP POP3
protocol:: tcp
action:: accept
}
term allow-dns {
destination-address:: THUNDERBOLTS
destination-port:: DNS
protocol:: udp
action:: accept
}
term allow-ftp {
destination-address:: HELLFIRE
destination-port:: FTP_CTRL FTP_DATA FTP_PASV
protocol:: tcp
action:: accept
}
# Splunk inject.
term allow-splunk {
source-address:: SPLUNK_SERVER
destination-address:: HELLFIRE
destination-port:: SPLUNK
protocol:: tcp
action:: accept
}
term allow-splunk-web {
destination-address:: SPLUNK_SERVER
destination-port:: SPLUNK_WEB
protocol:: tcp
action:: accept
}
# TODO: lock this down more!
term allow-shareview-globally-out {
source-address:: SV_APPLIANCE SV_WORKBENCH
protocol:: tcp udp
action:: accept
}
term allow-shareview-globally-in {
destination-address:: SV_APPLIANCE SV_WORKBENCH
protocol:: tcp udp
action:: accept
}
term allow-shareview-clients {
source-address:: WINDOWS_WORKSTATIONS
destination-address:: HELLFIRE
destination-port:: RAYTHEON
protocol:: tcp
action:: accept
}
# ------------
# Default Deny
# ------------
term default-deny {
action:: deny
}
general-ccdc/bastion/firewall/nccdc15/router-config.txt
Executable
+793
View File
@@ -0,0 +1,793 @@
## Last changed: 2015-04-25 22:03:23 UTC
version 12.1X44-D45.2;
system {
host-name Team7Remote;
time-zone Americas/Chicago;
root-authentication {
encrypted-password "$1$4d0Ly4sP$ZBrsXkC0UQygWn3jfM3ai."; ## SECRET-DATA
}
name-server {
10.70.70.5;
8.8.4.4;
208.67.222.222;
208.67.220.220;
}
services {
ssh;
dhcp {
pool 172.16.200.0/24 {
address-range low 172.16.200.11 high 172.16.200.22;
router {
172.16.200.1;
}
}
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
filter {
input PCAP;
output PCAP;
}
address 172.16.70.2/24;
}
}
}
ge-0/0/4 {
unit 0 {
family ethernet-switching {
vlan {
members vlan1;
}
}
}
}
ge-0/0/5 {
unit 0 {
family ethernet-switching {
vlan {
members vlan1;
}
}
}
}
ge-0/0/6 {
unit 0 {
family ethernet-switching {
vlan {
members vlan1;
}
}
}
}
ge-0/0/11 {
unit 0 {
family ethernet-switching {
vlan {
members vlan0;
}
}
}
}
vlan {
unit 0 {
family inet {
address 172.16.200.1/24 {
arp 172.16.200.203 mac 00:50:56:99:e6:d8;
arp 172.16.200.202 mac 00:50:56:99:70:7b;
arp 172.16.200.204 mac 00:50:56:99:32:e5;
arp 172.16.200.211 mac 00:50:56:99:3d:63;
arp 172.16.200.210 mac 00:50:56:99:38:a4;
arp 172.16.200.205 mac 00:50:56:99:a3:12;
arp 172.16.200.253 mac 00:50:56:99:cd:a8;
}
}
}
unit 1 {
family inet {
address 172.16.201.1/24;
}
}
}
}
forwarding-options {
packet-capture {
file filename pcap;
maximum-capture-size 1500;
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop 172.16.70.1;
}
}
protocols {
stp;
}
security {
screen {
ids-option untrust-screen {
icmp {
fragment;
large;
flood threshold 500;
ping-death;
}
ip {
bad-option;
spoofing;
source-route-option;
unknown-protocol;
block-frag;
tear-drop;
}
tcp {
syn-fin;
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
udp {
flood threshold 500;
}
}
}
nat {
source {
rule-set PlantNat {
from zone Plant;
to zone Internet;
rule PlantNat {
match {
source-address 172.16.201.0/24;
destination-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
static {
rule-set NatControl {
from zone Internet;
rule 202_nat {
match {
destination-address 172.16.70.202/32;
}
then {
static-nat {
prefix {
172.16.200.202/32;
}
}
}
}
rule 203_nat {
match {
destination-address 172.16.70.203/32;
}
then {
static-nat {
prefix {
172.16.200.203/32;
}
}
}
}
rule 204_nat {
match {
destination-address 172.16.70.204/32;
}
then {
static-nat {
prefix {
172.16.200.204/32;
}
}
}
}
rule 205_nat {
match {
destination-address 172.16.70.205/32;
}
then {
static-nat {
prefix {
172.16.200.205/32;
}
}
}
}
rule 210_nat {
match {
destination-address 172.16.70.210/32;
}
then {
static-nat {
prefix {
172.16.200.210/32;
}
}
}
}
rule 211_nat {
match {
destination-address 172.16.70.211/32;
}
then {
static-nat {
prefix {
172.16.200.211/32;
}
}
}
}
rule 253_nat {
match {
destination-address 172.16.70.253/32;
}
then {
static-nat {
prefix {
172.16.200.253/32;
}
}
}
}
}
}
proxy-arp {
interface ge-0/0/0.0 {
address {
172.16.70.3/32 to 172.16.70.254/32;
}
}
}
}
policies {
/*
$Id: /fw/nccdc15-control.srx $
$Date: 2015/04/25 $
*/
from-zone Internal to-zone Internet {
policy default-allow {
match {
source-address [ CONTROL ENGINEER_WRKS HMI OPC ];
destination-address any;
application any;
}
then {
permit;
}
}
}
/*
$Id: /fw/nccdc15-control.srx $
$Date: 2015/04/25 $
*/
from-zone Internet to-zone Internal {
policy allow-icmp {
match {
source-address any;
destination-address any;
application allow-icmp-app;
}
then {
permit;
}
}
policy rem-ssh {
match {
source-address any;
destination-address [ ENGINEER_WRKS OPC ];
application rem-ssh-app;
}
then {
permit;
}
}
policy rem-ftp {
match {
source-address any;
destination-address HISTORIAN;
application rem-ftp-app;
}
then {
permit;
}
}
policy rem-http {
match {
source-address any;
destination-address NMIS;
application rem-http-app;
}
then {
permit;
}
}
policy allow-ssh-srx {
match {
source-address any;
destination-address SRX;
application allow-ssh-srx-app;
}
then {
permit;
}
}
policy allow-ssh-corporate {
match {
source-address [ BRUCE CANARY CORPORATE HELLFIRE MONGER ];
destination-address any;
application allow-ssh-corporate-app;
}
then {
permit;
}
}
/*
Splunk inject
*/
policy allow-splunk {
match {
source-address SPLUNK_SERVER;
destination-address [ HMI OPC ];
application allow-splunk-app;
}
then {
permit;
}
}
policy allow-rdp-public {
match {
source-address any;
destination-address [ HMI HMI_WRKS ];
application allow-rdp-public-app;
}
then {
permit;
}
}
policy allow-rdp-corporate {
match {
source-address [ BRUCE CANARY CORPORATE HELLFIRE MONGER ];
destination-address [ ENGINEER_WRKS HISTORIAN OPC ];
application allow-rdp-corporate-app;
}
then {
permit;
}
}
}
from-zone Internal to-zone Internal {
policy intoin {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone Internet to-zone Internet {
policy Open {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone Plant to-zone Internet {
policy No_Plant_Internet {
match {
source-address any;
destination-address any;
application any;
}
then {
deny;
}
}
}
from-zone Internet to-zone Plant {
policy No_Internet_Plant {
match {
source-address any;
destination-address any;
application any;
}
then {
deny;
}
}
}
from-zone Plant to-zone Internal {
policy allow-plc-out {
match {
source-address [ PLANT PLC240 ];
destination-address OPC;
application allow-plc-out-app;
}
then {
permit;
}
}
policy allow-icmp {
match {
source-address any;
destination-address any;
application allow-icmp-app;
}
then {
permit;
}
}
}
from-zone Internal to-zone Plant {
policy allow-plc-in {
match {
source-address OPC;
destination-address [ PLANT PLC240 ];
application allow-plc-in-app;
}
then {
permit;
}
}
policy allow-icmp {
match {
source-address any;
destination-address any;
application allow-icmp-app;
}
then {
permit;
}
}
}
}
zones {
security-zone Internal {
address-book {
address SRX_0 172.16.70.1/32;
address SRX_1 172.16.70.2/32;
address OPC_0 172.16.70.204/31;
address ENGINEER_WRKS_0 172.16.70.210/31;
address HISTORIAN_0 172.16.70.203/32;
address NMIS_0 172.16.70.211/32;
address HMI_0 172.16.70.202/31;
address OPC_1 172.16.200.204/31;
address HMI_1 172.16.200.202/31;
address OPC_2 172.16.70.204/32;
address OPC_3 172.16.200.204/32;
address ENGINEER_WRKS_1 172.16.200.210/31;
address HISTORIAN_1 172.16.200.203/32;
address NMIS_1 172.16.200.211/32;
address HMI_2 172.16.70.202/32;
address HMI_3 172.16.200.202/32;
address HMI_WRKS_0 172.16.70.205/32;
address HMI_WRKS_1 172.16.200.205/32;
address ENGINEER_WRKS_2 172.16.70.210/32;
address ENGINEER_WRKS_3 172.16.200.210/32;
address CONTROL_0 172.16.70.253/32;
address CONTROL_1 172.16.200.253/32;
address-set SRX {
address SRX_0;
address SRX_1;
}
address-set OPC {
address OPC_0;
address OPC_1;
address OPC_2;
address OPC_3;
}
address-set ENGINEER_WRKS {
address ENGINEER_WRKS_0;
address ENGINEER_WRKS_1;
address ENGINEER_WRKS_2;
address ENGINEER_WRKS_3;
}
address-set HISTORIAN {
address HISTORIAN_0;
address HISTORIAN_1;
}
address-set NMIS {
address NMIS_0;
address NMIS_1;
}
address-set HMI {
address HMI_0;
address HMI_1;
address HMI_2;
address HMI_3;
}
address-set HMI_WRKS {
address HMI_WRKS_0;
address HMI_WRKS_1;
}
address-set CONTROL {
address CONTROL_0;
address CONTROL_1;
}
}
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
vlan.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
}
}
security-zone Internet {
address-book {
address 10_5 172.16.200.5/32;
address CORPORATE_0 10.70.70.5/32;
address CORPORATE_1 10.70.70.10/32;
address CORPORATE_2 10.70.70.15/32;
address CORPORATE_3 10.70.70.77/32;
address CORPORATE_4 10.70.70.78/32;
address CORPORATE_5 10.70.70.109/32;
address HELLFIRE_0 10.70.70.20/31;
address BRUCE_0 10.70.70.104/30;
address MONGER_0 10.70.70.200/31;
address CANARY_0 10.70.70.250/31;
address CORPORATE_6 10.70.70.110/32;
address CORPORATE_7 10.70.70.202/32;
address SPLUNK_SERVER_0 192.168.7.70/32;
address CORPORATE_8 10.70.70.205/32;
address CORPORATE_9 10.70.70.252/32;
address-set CORPORATE {
address CORPORATE_0;
address CORPORATE_1;
address CORPORATE_2;
address CORPORATE_3;
address CORPORATE_4;
address CORPORATE_5;
address CORPORATE_6;
address CORPORATE_7;
address CORPORATE_8;
address CORPORATE_9;
}
address-set HELLFIRE {
address HELLFIRE_0;
}
address-set BRUCE {
address BRUCE_0;
}
address-set MONGER {
address MONGER_0;
}
address-set CANARY {
address CANARY_0;
}
address-set SPLUNK_SERVER {
address SPLUNK_SERVER_0;
}
}
screen untrust-screen;
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
system-services {
ping;
ssh;
}
}
}
}
}
security-zone Plant {
address-book {
address PLC240_0 172.16.201.240/31;
address PLANT_0 172.16.201.242/32;
address-set PLC240 {
address PLC240_0;
}
address-set PLANT {
address PLANT_0;
}
}
interfaces {
vlan.1;
}
}
}
}
firewall {
filter PCAP {
term no-natasha {
from {
source-address {
10.70.70.107/32;
}
}
then accept;
}
term no-natasha2 {
from {
destination-address {
10.70.70.107/32;
}
}
then accept;
}
term sample-everything {
then {
sample;
accept;
}
}
}
}
applications {
application allow-icmp-app1 {
term t1 protocol icmp;
}
application allow-ssh-app1 {
term t1 protocol tcp destination-port 22;
}
application rem-ssh-app1 {
term t1 protocol tcp destination-port 22;
}
application rem-ftp-app1 {
term t1 protocol tcp destination-port 20-21;
}
application rem-http-app1 {
term t1 protocol tcp destination-port 80;
}
application allow-rdp-app1 {
term t1 protocol tcp destination-port 3389;
}
application rem-ftp-app2 {
term t2 protocol tcp destination-port 42000-42100;
}
application allow-ssh-srx-app1 {
term t1 protocol tcp destination-port 22;
}
application allow-ssh-corporate-app1 {
term t1 protocol tcp destination-port 22;
}
application allow-splunk-app1 {
term t1 protocol tcp destination-port 9997;
}
application allow-public-rdp-app1 {
term t1 protocol tcp destination-port 3389;
}
application allow-corporate-rdp-app1 {
term t1 protocol tcp destination-port 3389;
}
application allow-rdp-public-app1 {
term t1 protocol tcp destination-port 3389;
}
application allow-rdp-corporate-app1 {
term t1 protocol tcp destination-port 3389;
}
application allow-plc-in-app1 {
term t1 protocol tcp destination-port 22;
}
application allow-plc-in-app2 {
term t2 protocol tcp destination-port 502;
}
application allow-plc-out-app1 {
term t1 protocol tcp destination-port 502;
}
application-set allow-icmp-app {
application allow-icmp-app1;
}
application-set allow-ssh-app {
application allow-ssh-app1;
}
application-set rem-ssh-app {
application rem-ssh-app1;
}
application-set rem-ftp-app {
application rem-ftp-app1;
application rem-ftp-app2;
}
application-set rem-http-app {
application rem-http-app1;
}
application-set allow-rdp-app {
application allow-rdp-app1;
}
application-set allow-ssh-srx-app {
application allow-ssh-srx-app1;
}
application-set allow-ssh-corporate-app {
application allow-ssh-corporate-app1;
}
application-set allow-splunk-app {
application allow-splunk-app1;
}
application-set allow-public-rdp-app {
application allow-public-rdp-app1;
}
application-set allow-corporate-rdp-app {
application allow-corporate-rdp-app1;
}
application-set allow-rdp-public-app {
application allow-rdp-public-app1;
}
application-set allow-rdp-corporate-app {
application allow-rdp-corporate-app1;
}
application-set allow-plc-in-app {
application allow-plc-in-app1;
application allow-plc-in-app2;
}
application-set allow-plc-out-app {
application allow-plc-out-app1;
}
}
poe {
interface all;
}
vlans {
vlan0 {
vlan-id 2;
l3-interface vlan.0;
}
vlan1 {
vlan-id 3;
l3-interface vlan.1;
}
}
general-ccdc/bastion/firewall/nccdc15/switch-config.txt
Executable
+460
View File
@@ -0,0 +1,460 @@
## Last changed: 2015-02-14 07:14:46 UTC
version 12.3R9.4;
system {
root-authentication {
encrypted-password "$1$KodNi7VZ$6B2Jgqc2Fcilko8gbcw0O1"; ## SECRET-DATA
}
services {
ssh;
dhcp {
traceoptions {
file dhcp_logfile;
level all;
flag all;
}
}
}
syslog {
user * {
any emergency;
}
file messages {
any notice;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1000;
}
}
}
}
ge-0/0/1 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1001;
}
}
}
}
ge-0/0/2 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1002;
}
}
}
}
ge-0/0/3 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1003;
}
}
}
}
ge-0/0/4 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1004;
}
}
}
}
ge-0/0/5 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1005;
}
}
}
}
ge-0/0/6 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1006;
}
}
}
}
ge-0/0/7 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1007;
}
}
}
}
ge-0/0/8 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1008;
}
}
}
}
ge-0/0/9 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1009;
}
}
}
}
ge-0/0/10 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1010;
}
}
}
}
ge-0/0/11 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1011;
}
}
}
}
ge-0/0/12 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1012;
}
}
}
}
ge-0/0/13 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1013;
}
}
}
}
ge-0/0/14 {
unit 0 {
family ethernet-switching {
port-mode trunk;
vlan {
members [ 100 1000-1013 1015-1022 ];
}
native-vlan-id 1014;
}
}
}
ge-0/0/15 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1015;
}
}
}
}
ge-0/0/16 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1016;
}
}
}
}
ge-0/0/17 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1017;
}
}
}
}
ge-0/0/18 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1018;
}
}
}
}
ge-0/0/19 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1019;
}
}
}
}
ge-0/0/20 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1020;
}
}
}
}
ge-0/0/21 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1021;
}
}
}
}
ge-0/0/22 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v1022;
}
}
}
}
ge-0/0/23 {
hold-time up 0 down 2000;
unit 0 {
family ethernet-switching;
}
}
ge-0/1/0 {
unit 0 {
family ethernet-switching;
}
}
ge-0/1/1 {
unit 0 {
family ethernet-switching;
}
}
ge-0/1/2 {
unit 0 {
family ethernet-switching;
}
}
ge-0/1/3 {
unit 0 {
family ethernet-switching;
}
}
vlan {
unit 100 {
family inet {
address 10.70.70.77/24;
}
}
}
}
protocols {
igmp-snooping {
vlan all;
}
}
ethernet-switching-options {
analyzer span-port {
input {
ingress {
interface ge-0/0/0.0;
interface ge-0/0/1.0;
interface ge-0/0/2.0;
interface ge-0/0/3.0;
interface ge-0/0/4.0;
interface ge-0/0/5.0;
interface ge-0/0/6.0;
interface ge-0/0/7.0;
interface ge-0/0/8.0;
interface ge-0/0/9.0;
interface ge-0/0/11.0;
interface ge-0/0/12.0;
interface ge-0/0/13.0;
interface ge-0/0/14.0;
interface ge-0/0/15.0;
interface ge-0/0/16.0;
interface ge-0/0/17.0;
interface ge-0/0/18.0;
interface ge-0/0/19.0;
interface ge-0/0/20.0;
interface ge-0/0/21.0;
interface ge-0/0/22.0;
}
}
output {
interface {
ge-0/0/23.0;
}
}
}
secure-access-port {
interface ge-0/0/1.0 {
allowed-mac 2c:21:72:a5:0c:4a;
}
interface ge-0/0/2.0 {
allowed-mac 00:e0:4c:68:25:82;
}
interface ge-0/0/4.0 {
allowed-mac 00:1a:a0:fc:7e:63;
}
interface ge-0/0/6.0 {
allowed-mac [ 00:0c:29:30:56:96 00:0c:29:88:7d:72 00:0c:29:d0:71:f7 34:e6:d7:4f:7d:58 ];
}
interface ge-0/0/8.0 {
allowed-mac 00:23:ae:31:ec:0f;
}
interface ge-0/0/10.0 {
allowed-mac d0:67:e5:e9:af:db;
}
interface ge-0/0/12.0 {
allowed-mac 00:23:ae:31:f7:be;
}
interface ge-0/0/15.0 {
allowed-mac d4:ae:52:c7:fe:44;
}
interface ge-0/0/16.0 {
allowed-mac 5c:26:0a:63:30:1f;
}
interface ge-0/0/17.0 {
allowed-mac d0:67:e5:f1:00:7c;
}
interface ge-0/0/18.0 {
allowed-mac d4:be:d9:62:64:7f;
}
interface ge-0/0/19.0 {
allowed-mac 00:23:ae:37:4e:01;
}
interface ge-0/0/20.0 {
allowed-mac 90:a7:d7:5d:85:5c;
}
interface ge-0/0/22.0 {
allowed-mac 00:1a:a2:19:84:32;
}
}
storm-control {
interface all;
}
}
vlans {
v100 {
vlan-id 100;
l3-interface vlan.100;
}
v1000 {
vlan-id 1000;
}
v1001 {
vlan-id 1001;
}
v1002 {
vlan-id 1002;
}
v1003 {
vlan-id 1003;
}
v1004 {
vlan-id 1004;
}
v1005 {
vlan-id 1005;
}
v1006 {
vlan-id 1006;
}
v1007 {
vlan-id 1007;
}
v1008 {
vlan-id 1008;
}
v1009 {
vlan-id 1009;
}
v1010 {
vlan-id 1010;
}
v1011 {
vlan-id 1011;
}
v1012 {
vlan-id 1012;
}
v1013 {
vlan-id 1013;
}
v1014 {
vlan-id 1014;
}
v1015 {
vlan-id 1015;
}
v1016 {
vlan-id 1016;
}
v1017 {
vlan-id 1017;
}
v1018 {
vlan-id 1018;
}
v1019 {
vlan-id 1019;
}
v1020 {
vlan-id 1020;
}
v1021 {
vlan-id 1021;
}
v1022 {
vlan-id 1022;
}
}
poe {
interface all;
}
general-ccdc/bastion/firewall/practice.fwb
Executable
+751
View File
@@ -0,0 +1,751 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1363924596" id="root">
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
<AnyInterval id="sysid2" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1" name="Any" comment="Any Interval" ro="False"/>
<ObjectGroup id="stdid01" name="Objects" comment="" ro="False">
<ObjectGroup id="stdid16" name="Addresses" comment="" ro="False">
<IPv4 id="id2001X88798" name="all-hosts" comment="" ro="False" address="224.0.0.1" netmask="0.0.0.0"/>
<IPv4 id="id2002X88798" name="all-routers" comment="" ro="False" address="224.0.0.2" netmask="0.0.0.0"/>
<IPv4 id="id2003X88798" name="all DVMRP" comment="" ro="False" address="224.0.0.4" netmask="0.0.0.0"/>
<IPv4 id="id2117X88798" name="OSPF (all routers)" comment="RFC2328" ro="False" address="224.0.0.5" netmask="0.0.0.0"/>
<IPv4 id="id2128X88798" name="OSPF (designated routers)" comment="RFC2328" ro="False" address="224.0.0.6" netmask="0.0.0.0"/>
<IPv4 id="id2430X88798" name="RIP" comment="RFC1723" ro="False" address="224.0.0.9" netmask="0.0.0.0"/>
<IPv4 id="id2439X88798" name="EIGRP" comment="" ro="False" address="224.0.0.10" netmask="0.0.0.0"/>
<IPv4 id="id2446X88798" name="DHCP server, relay agent" comment="RFC 1884" ro="False" address="224.0.0.12" netmask="0.0.0.0"/>
<IPv4 id="id2455X88798" name="PIM" comment="" ro="False" address="224.0.0.13" netmask="0.0.0.0"/>
<IPv4 id="id2462X88798" name="RSVP" comment="" ro="False" address="224.0.0.14" netmask="0.0.0.0"/>
<IPv4 id="id2469X88798" name="VRRP" comment="RFC3768" ro="False" address="224.0.0.18" netmask="0.0.0.0"/>
<IPv4 id="id2777X88798" name="IGMP" comment="" ro="False" address="224.0.0.22" netmask="0.0.0.0"/>
<IPv4 id="id2784X88798" name="OSPFIGP-TE" comment="RFC4973" ro="False" address="224.0.0.24" netmask="0.0.0.0"/>
<IPv4 id="id3094X88798" name="HSRP" comment="" ro="False" address="224.0.0.102" netmask="0.0.0.0"/>
<IPv4 id="id3403X88798" name="mDNS" comment="" ro="False" address="224.0.0.251" netmask="0.0.0.0"/>
<IPv4 id="id3410X88798" name="LLMNR" comment="Link-Local Multicast Name Resolution, RFC4795" ro="False" address="224.0.0.252" netmask="0.0.0.0"/>
<IPv4 id="id3411X88798" name="Teredo" comment="" ro="False" address="224.0.0.253" netmask="0.0.0.0"/>
</ObjectGroup>
<ObjectGroup id="stdid17" name="DNS Names" comment="" ro="False"/>
<ObjectGroup id="stdid18" name="Address Tables" comment="" ro="False"/>
<ObjectGroup id="stdid04" name="Groups" comment="" ro="False">
<ObjectGroup id="id3DC75CE8" name="rfc1918-nets" comment="" ro="False">
<ObjectRef ref="id3DC75CE5"/>
<ObjectRef ref="id3DC75CE6"/>
<ObjectRef ref="id3DC75CE7"/>
</ObjectGroup>
<ObjectGroup id="id3292X75851" name="ipv6 private" comment="These are various ipv6 networks that should not be routed on the Internet&#10;" ro="False">
<ObjectRef ref="id2088X75851"/>
<ObjectRef ref="id2986X75851"/>
<ObjectRef ref="id2383X75851"/>
</ObjectGroup>
</ObjectGroup>
<ObjectGroup id="stdid02" name="Hosts" comment="" ro="False">
<Host id="id3D84EECE" name="internal server" comment="This host is used in examples and template objects" ro="False">
<Interface id="id3D84EED2" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
<IPv4 id="id3D84EED3" name="ip" comment="" ro="False" address="192.168.1.10" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="192.168.1.10">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions>
<Option name="snmp_contact"></Option>
<Option name="snmp_description"></Option>
<Option name="snmp_location"></Option>
<Option name="use_mac_addr">false</Option>
<Option name="use_mac_addr_filter">False</Option>
</HostOptions>
</Host>
<Host id="id3D84EECF" name="server on dmz" comment="This host is used in examples and template objects" ro="False">
<Interface id="id3D84EEE3" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
<IPv4 id="id3D84EEE4" name="ip" comment="" ro="False" address="192.168.2.10" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="192.168.2.10">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions>
<Option name="snmp_contact"></Option>
<Option name="snmp_description"></Option>
<Option name="snmp_location"></Option>
<Option name="use_mac_addr">false</Option>
<Option name="use_mac_addr_filter">False</Option>
</HostOptions>
</Host>
</ObjectGroup>
<ObjectGroup id="stdid03" name="Networks" comment="" ro="False">
<Network id="id3DC75CEC" name="all multicasts" comment="224.0.0.0/4 - This block, formerly known as the Class D address&#10;space, is allocated for use in IPv4 multicast address assignments.&#10;The IANA guidelines for assignments from this space are described in&#10;[RFC3171].&#10;" ro="False" address="224.0.0.0" netmask="240.0.0.0"/>
<Network id="id3F4ECE3E" name="link-local" comment="169.254.0.0/16 - This is the &quot;link local&quot; block. It is allocated for&#10;communication between hosts on a single link. Hosts obtain these&#10;addresses by auto-configuration, such as when a DHCP server may not&#10;be found.&#10;" ro="False" address="169.254.0.0" netmask="255.255.0.0"/>
<Network id="id3F4ECE3D" name="loopback-net" comment="127.0.0.0/8 - This block is assigned for use as the Internet host&#10;loopback address. A datagram sent by a higher level protocol to an&#10;address anywhere within this block should loop back inside the host.&#10;This is ordinarily implemented using only 127.0.0.1/32 for loopback,&#10;but no addresses within this block should ever appear on any network&#10;anywhere [RFC1700, page 5].&#10;" ro="False" address="127.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE5" name="net-10.0.0.0" comment="10.0.0.0/8 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet." ro="False" address="10.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE7" name="net-172.16.0.0" comment="172.16.0.0/12 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet.&#10;" ro="False" address="172.16.0.0" netmask="255.240.0.0"/>
<Network id="id3DC75CE6" name="net-192.168.0.0" comment="192.168.0.0/16 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet.&#10;" ro="False" address="192.168.0.0" netmask="255.255.0.0"/>
<Network id="id3F4ECE3F" name="test-net" comment="192.0.2.0/24 - This block is assigned as &quot;TEST-NET&quot; for use in&#10;documentation and example code. It is often used in conjunction with&#10;domain names example.com or example.net in vendor and protocol&#10;documentation. Addresses within this block should not appear on the&#10;public Internet.&#10;" ro="False" address="192.0.2.0" netmask="255.255.255.0"/>
<Network id="id3F4ECE40" name="this-net" comment="0.0.0.0/8 - Addresses in this block refer to source hosts on &quot;this&quot;&#10;network. Address 0.0.0.0/32 may be used as a source address for this&#10;host on this network; other addresses within 0.0.0.0/8 may be used to&#10;refer to specified hosts on this network [RFC1700, page 4]." ro="False" address="0.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE7-1" name="net-192.168.1.0" comment="192.168.1.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
<Network id="id3DC75CE7-2" name="net-192.168.2.0" comment="192.168.2.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
<NetworkIPv6 id="id2088X75851" name="documentation net" comment="RFC3849" ro="False" address="2001:db8::" netmask="32"/>
<NetworkIPv6 id="id2383X75851" name="link-local ipv6" comment="RFC4291 Link-local unicast net" ro="False" address="fe80::" netmask="10"/>
<NetworkIPv6 id="id2685X75851" name="multicast ipv6" comment="RFC4291 ipv6 multicast addresses" ro="False" address="ff00::" netmask="8"/>
<NetworkIPv6 id="id2986X75851" name="experimental ipv6" comment="RFC2928, RFC4773 &#10;&#10;&quot;The block of Sub-TLA IDs assigned to the IANA&#10;(i.e., 2001:0000::/29 - 2001:01F8::/29) is for&#10;assignment for testing and experimental usage to&#10;support activities such as the 6bone, and&#10;for new approaches like exchanges.&quot; [RFC2928]&#10;&#10;" ro="False" address="2001::" netmask="23"/>
</ObjectGroup>
<ObjectGroup id="stdid15" name="Address Ranges" comment="" ro="False">
<AddressRange id="id3F6D115C" name="broadcast" comment="" ro="False" start_address="255.255.255.255" end_address="255.255.255.255"/>
<AddressRange id="id3F6D115D" name="old-broadcast" comment="" ro="False" start_address="0.0.0.0" end_address="0.0.0.0"/>
</ObjectGroup>
</ObjectGroup>
<ServiceGroup id="stdid05" name="Services" comment="" ro="False">
<CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
<CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
</CustomService>
<CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
<CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
</CustomService>
<ServiceGroup id="stdid10" name="Groups" comment="" ro="False">
<ServiceGroup id="sg-DHCP" name="DHCP" comment="" ro="False">
<ServiceRef ref="udp-bootpc"/>
<ServiceRef ref="udp-bootps"/>
</ServiceGroup>
<ServiceGroup id="id3F530CC8" name="DNS" comment="" ro="False">
<ServiceRef ref="udp-DNS"/>
<ServiceRef ref="tcp-DNS"/>
</ServiceGroup>
<ServiceGroup id="id3CB1279B" name="IPSEC" comment="" ro="False">
<ServiceRef ref="id3CB12797"/>
<ServiceRef ref="ip-IPSEC"/>
</ServiceGroup>
<ServiceGroup id="sg-NETBIOS" name="NETBIOS" comment="" ro="False">
<ServiceRef ref="udp-netbios-dgm"/>
<ServiceRef ref="udp-netbios-ns"/>
<ServiceRef ref="id3E755609"/>
</ServiceGroup>
<ServiceGroup id="id3CB131CC" name="PCAnywhere" comment="" ro="False">
<ServiceRef ref="id3CB131CA"/>
<ServiceRef ref="id3CB131C8"/>
</ServiceGroup>
<ServiceGroup id="sg-Useful_ICMP" name="Useful_ICMP" comment="" ro="False">
<ServiceRef ref="icmp-Time_exceeded"/>
<ServiceRef ref="icmp-Time_exceeded_in_transit"/>
<ServiceRef ref="icmp-ping_reply"/>
<ServiceRef ref="icmp-Unreachables"/>
</ServiceGroup>
<ServiceGroup id="id1569X4889" name="Ipv6 unreachable messages" comment="" ro="False">
<ServiceRef ref="idE0D27650"/>
<ServiceRef ref="idCFE27650"/>
<ServiceRef ref="idE0B27650"/>
<ServiceRef ref="id1519Z388"/>
</ServiceGroup>
<ServiceGroup id="id3B4FEDD9" name="kerberos" comment="" ro="False">
<ServiceRef ref="id3B4FEDA5"/>
<ServiceRef ref="id3B4FEDA9"/>
<ServiceRef ref="id3B4FEDA7"/>
<ServiceRef ref="id3B4FEDAB"/>
<ServiceRef ref="id3B4FEDA3"/>
<ServiceRef ref="id3B4FEE21"/>
<ServiceRef ref="id3B4FEE23"/>
<ServiceRef ref="id3E7E3EA2"/>
</ServiceGroup>
<ServiceGroup id="id3B4FF35E" name="nfs" comment="" ro="False">
<ServiceRef ref="id3B4FEE7A"/>
<ServiceRef ref="id3B4FEE78"/>
</ServiceGroup>
<ServiceGroup id="id3B4FEFFA" name="quake" comment="" ro="False">
<ServiceRef ref="id3B4FEF7C"/>
<ServiceRef ref="id3B4FEF7E"/>
</ServiceGroup>
<ServiceGroup id="id3D703C9A" name="Real Player" comment="" ro="False">
<ServiceRef ref="id3D703C99"/>
<ServiceRef ref="id3D703C8B"/>
</ServiceGroup>
<ServiceGroup id="id3E7E3E95" name="WinNT" comment="" ro="False">
<ServiceRef ref="sg-NETBIOS"/>
<ServiceRef ref="id3DC8C8BB"/>
<ServiceRef ref="id3E7E3D58"/>
</ServiceGroup>
<ServiceGroup id="id3E7E3E9A" name="Win2000" comment="" ro="False">
<ServiceRef ref="id3E7E3E95"/>
<ServiceRef ref="udp-DNS"/>
<ServiceRef ref="id3DC8C8BC"/>
<ServiceRef ref="id3E7E3EA2"/>
<ServiceRef ref="id3AECF778"/>
<ServiceRef ref="id3D703C90"/>
<ServiceRef ref="id3E7E4039"/>
<ServiceRef ref="id3E7E403A"/>
<ServiceRef ref="id3B4FEDA5"/>
<ServiceRef ref="tcp-DNS"/>
</ServiceGroup>
<ServiceGroup id="id41291786" name="UPnP" comment="" ro="False">
<ServiceRef ref="id41291784"/>
<ServiceRef ref="id41291785"/>
<ServiceRef ref="id41291783"/>
<ServiceRef ref="id412Z18A9"/>
</ServiceGroup>
</ServiceGroup>
<ServiceGroup id="stdid07" name="ICMP" comment="" ro="False">
<ICMPService id="icmp-Unreachables" code="-1" type="3" name="all ICMP unreachables" comment="" ro="False"/>
<ICMPService id="id3C20EEB5" code="-1" type="-1" name="any ICMP" comment="" ro="False"/>
<ICMPService id="icmp-Host_unreach" code="1" type="3" name="host_unreach" comment="" ro="False"/>
<ICMPService id="icmp-ping_reply" code="0" type="0" name="ping reply" comment="" ro="False"/>
<ICMPService id="icmp-ping_request" code="0" type="8" name="ping request" comment="" ro="False"/>
<ICMPService id="icmp-Port_unreach" code="3" type="3" name="port unreach" comment="Port unreachable" ro="False"/>
<ICMPService id="icmp-Time_exceeded" code="0" type="11" name="time exceeded" comment="ICMP messages of this type are needed for traceroute" ro="False"/>
<ICMPService id="icmp-Time_exceeded_in_transit" code="1" type="11" name="time exceeded in transit" comment="" ro="False"/>
<ICMP6Service id="ipv6-icmp-ping_request" code="0" type="128" name="ipv6 ping request" comment="IPv6 ping request" ro="False"/>
<ICMP6Service id="ipv6-icmp-ping_reply" code="0" type="129" name="ipv6 ping reply" comment="IPv6 ping reply" ro="False"/>
<ICMP6Service id="ipv6-icmp-routersol" code="0" type="133" name="ipv6 routersol" comment="IPv6 router solicitation" ro="False"/>
<ICMP6Service id="ipv6-icmp-routeradv" code="0" type="134" name="ipv6 routeradv" comment="IPv6 router advertisement" ro="False"/>
<ICMP6Service id="ipv6-icmp-neighbrsol" code="0" type="135" name="ipv6 neighbrsol" comment="IPv6 neighbor solicitation" ro="False"/>
<ICMP6Service id="ipv6-icmp-neighbradv" code="0" type="136" name="ipv6 neighbradv" comment="IPv6 neighbor advertisement" ro="False"/>
<ICMP6Service id="ipv6-icmp-redir" code="0" type="137" name="ipv6 redir" comment="IPv6 redirect: shorter route exists" ro="False"/>
<ICMP6Service id="id1519Z388" code="-1" type="4" name="ipv6 parameter problem" comment="IPv6 Parameter Problem: RFC4443" ro="False"/>
<ICMP6Service id="idCFE27650" code="0" type="3" name="ipv6 time exceeded" comment="Time exceeded in transit" ro="False"/>
<ICMP6Service id="idCFF27650" code="1" type="3" name="ipv6 time exceeded in reassembly" comment="Time exceeded in reassembly" ro="False"/>
<ICMP6Service id="idE0B27650" code="-1" type="2" name="ipv6 packet too big" comment="" ro="False"/>
<ICMP6Service id="idE0D27650" code="-1" type="1" name="ipv6 all dest unreachable" comment="All icmpv6 codes for type &quot;destination unreachable&quot;&#10;" ro="False"/>
<ICMP6Service id="idCFE27660" code="-1" type="-1" name="ipv6 any ICMP6" comment="any ICMPv6" ro="False"/>
</ServiceGroup>
<ServiceGroup id="stdid06" name="IP" comment="" ro="False">
<IPService id="id3CB12797" fragm="False" lsrr="False" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False" name="AH" comment="IPSEC Authentication Header Protocol" ro="False"/>
<IPService id="ip-IPSEC" fragm="False" lsrr="False" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False" name="ESP" comment="IPSEC Encapsulating Security Payload Protocol" ro="False"/>
<IPService id="ip-RR" fragm="False" lsrr="False" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False" name="RR" comment="Route recording packets" ro="False"/>
<IPService id="ip-SRR" fragm="False" lsrr="True" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False" name="SRR" comment="All sorts of Source Routing Packets" ro="False"/>
<IPService id="ip-IP_Fragments" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False" name="ip_fragments" comment="'Short' fragments" ro="False"/>
<IPService id="id3D703C8E" fragm="False" lsrr="False" protocol_num="57" rr="False" short_fragm="False" ssrr="False" ts="False" name="SKIP" comment="IPSEC Simple Key Management for Internet Protocols" ro="False"/>
<IPService id="id3D703C8F" fragm="False" lsrr="False" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False" name="GRE" comment="Generic Routing Encapsulation&#10;" ro="False"/>
<IPService id="id3D703C95" fragm="False" lsrr="False" protocol_num="112" rr="False" short_fragm="False" ssrr="False" ts="False" name="vrrp" comment="Virtual Router Redundancy Protocol" ro="False"/>
<IPService id="ip-IGMP" fragm="False" lsrr="False" protocol_num="2" rr="False" rtralt="True" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="IGMP" comment="Internet Group Management Protocol, Version 3, RFC 3376" ro="False"/>
<IPService id="ip-PIM" fragm="False" lsrr="False" protocol_num="103" rr="False" rtralt="False" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="PIM" comment="Protocol Independent Multicast - Dense Mode (PIM-DM), RFC 3973, or Protocol Independent Multicast-Sparse Mode (PIM-SM) RFC 2362" ro="False"/>
</ServiceGroup>
<ServiceGroup id="stdid09" name="TCP" comment="" ro="False">
<TCPService id="tcp-ALL_TCP_Masqueraded" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ALL TCP Masqueraded" comment="ipchains used to use this range of port numbers for masquerading. " ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id3D703C94" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="AOL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5190" dst_range_end="5190"/>
<TCPService id="tcp-All_TCP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id3CB131C4" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Citrix-ICA" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1494" dst_range_end="1494"/>
<TCPService id="id3D703C91" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-Admin" comment="Entrust CA Administration Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="709" dst_range_end="709"/>
<TCPService id="id3D703C92" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-KeyMgmt" comment="Entrust CA Key Management Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="710" dst_range_end="710"/>
<TCPService id="id3AEDBEAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="H323" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1720" dst_range_end="1720"/>
<TCPService id="id412Z18A9" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="icslap" comment="Sometimes this protocol is called icslap, but Microsoft does not call it that and just says that DSPP uses port 2869 in Windows XP SP2" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2869" dst_range_end="2869"/>
<TCPService id="id3E7E4039" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3268" dst_range_end="3268"/>
<TCPService id="id3E7E403A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC SSL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3269" dst_range_end="3269"/>
<TCPService id="id3D703C83" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="OpenWindows" comment="Open Windows" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2000" dst_range_end="2000"/>
<TCPService id="id3CB131C8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="PCAnywhere-data" comment="data channel for PCAnywhere v7.52 and later " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5631" dst_range_end="5631"/>
<TCPService id="id3D703C8B" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Real-Audio" comment="RealNetworks PNA Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7070" dst_range_end="7070"/>
<TCPService id="id3D703C93" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="RealSecure" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2998" dst_range_end="2998"/>
<TCPService id="id3DC8C8BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="SMB" comment="SMB over TCP (without NETBIOS)&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="445" dst_range_end="445"/>
<TCPService id="id3D703C8D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TACACSplus" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="49" dst_range_end="49"/>
<TCPService id="id3D703C84" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TCP high ports" comment="TCP high ports" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
<TCPService id="id3E7E3D58" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="WINS replication" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="42" dst_range_end="42"/>
<TCPService id="id3D703C82" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="X11" comment="X Window System" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6000" dst_range_end="6063"/>
<TCPService id="tcp-Auth" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="auth" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="113" dst_range_end="113"/>
<TCPService id="id3AEDBE6E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
<TCPService id="tcp-DNS" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
<TCPService id="id3B4FEDA3" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="eklogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2105" dst_range_end="2105"/>
<TCPService id="id3AECF774" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="finger" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="79" dst_range_end="79"/>
<TCPService id="tcp-FTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="21" dst_range_end="21"/>
<TCPService id="tcp-FTP_data" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data" comment="FTP data channel.&#10; Note: FTP protocol does not really require server to use source port 20 for the data channel, &#10; but many ftp server implementations do so." ro="False" src_range_start="20" src_range_end="20" dst_range_start="1024" dst_range_end="65535"/>
<TCPService id="id3E7553BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data passive" comment="FTP data channel for passive mode transfers&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="20" dst_range_end="20"/>
<TCPService id="tcp-HTTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="http" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
<TCPService id="id3B4FED69" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="https" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="443" dst_range_end="443"/>
<TCPService id="id3AECF776" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="143" dst_range_end="143"/>
<TCPService id="id3B4FED9F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imaps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="993" dst_range_end="993"/>
<TCPService id="id3B4FF13C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="irc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
<TCPService id="id3E7E3EA2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
<TCPService id="id3B4FEE21" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="klogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="543" dst_range_end="543"/>
<TCPService id="id3B4FEE23" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ksh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="544" dst_range_end="544"/>
<TCPService id="id3AECF778" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="389" dst_range_end="389"/>
<TCPService id="id3D703C90" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldaps" comment="Lightweight Directory Access Protocol over TLS/SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="636" dst_range_end="636"/>
<TCPService id="id3B4FF000" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="linuxconf" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="98" dst_range_end="98"/>
<TCPService id="id3D703C97" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="lpr" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
<TCPService id="id3DC8C8BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
<TCPService id="id3D703C98" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ms-sql" comment="Microsoft SQL Server" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1433" dst_range_end="1433"/>
<TCPService id="id3B4FEEEE" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="mysql" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3306" dst_range_end="3306"/>
<TCPService id="id3E755609" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
<TCPService id="id3B4FEE7A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
<TCPService id="tcp-NNTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="119" dst_range_end="119"/>
<TCPService id="id3E7553BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntps" comment="NNTP over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="563" dst_range_end="563"/>
<TCPService id="id3B4FEE1D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="110" dst_range_end="110"/>
<TCPService id="id3E7553BA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3s" comment="POP-3 over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="995" dst_range_end="995"/>
<TCPService id="id3B4FF0EA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="postgres" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5432" dst_range_end="5432"/>
<TCPService id="id3AECF782" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="printer" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
<TCPService id="id3B4FEF7C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
<TCPService id="id3AECF77A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rexec" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="512" dst_range_end="512"/>
<TCPService id="id3AECF77C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rlogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
<TCPService id="id3AECF77E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rshell" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
<TCPService id="id3D703C99" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtsp" comment="Real Time Streaming Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="554" dst_range_end="554"/>
<TCPService id="id3B4FEF34" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rwhois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4321" dst_range_end="4321"/>
<TCPService id="id3D703C89" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="securidprop" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5510" dst_range_end="5510"/>
<TCPService id="tcp-SMTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
<TCPService id="id3B4FF04C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="465" dst_range_end="465"/>
<TCPService id="id3B4FEE76" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="socks" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
<TCPService id="id3D703C87" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sqlnet1" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1521" dst_range_end="1521"/>
<TCPService id="id3B4FF09A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="squid" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
<TCPService id="tcp-SSH" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ssh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
<TCPService id="id3AEDBE00" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
<TCPService id="tcp-TCP-SYN" ack_flag="False" ack_flag_mask="True" fin_flag="False" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" name="tcp-syn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="tcp-Telnet" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="telnet" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="23" dst_range_end="23"/>
<TCPService id="tcp-uucp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="uucp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="540" dst_range_end="540"/>
<TCPService id="id3CB131C6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="winterm" comment="Windows Terminal Services" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3389" dst_range_end="3389"/>
<TCPService id="id3B4FF1B8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7100" dst_range_end="7100"/>
<TCPService id="id3C685B2B" ack_flag="True" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan - full" comment="This service object matches TCP packet with all six flags set." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id4127E949" ack_flag="False" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="False" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan" comment="This service object matches TCP packet with flags FIN, PSH and URG set and other flags cleared. This is a &quot;christmas scan&quot; as defined in snort rules. Nmap can generate this scan, too." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id4127EA72" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
<TCPService id="id4127EBAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="distcc" comment="distributed compiler" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3632" dst_range_end="3632"/>
<TCPService id="id4127ECF1" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvspserver" comment="CVS client/server operations" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2401" dst_range_end="2401"/>
<TCPService id="id4127ECF2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvsup" comment="CVSup file transfer/John Polstra/FreeBSD" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5999" dst_range_end="5999"/>
<TCPService id="id4127ED5E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="afp" comment="AFP (Apple file sharing) over TCP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="548" dst_range_end="548"/>
<TCPService id="id4127EDF6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="whois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="43" dst_range_end="43"/>
<TCPService id="id4127F04F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="bgp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="179" dst_range_end="179"/>
<TCPService id="id4127F146" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius" comment="Radius protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1812" dst_range_end="1812"/>
<TCPService id="id4127F147" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius acct" comment="Radius Accounting" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1813" dst_range_end="1813"/>
<TCPService id="id41291784" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5000" dst_range_end="5000"/>
<TCPService id="id41291785" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp-5431" comment="Although UPnP specification say it should use TCP port 5000, Linksys running Sveasoft firmware listens on port 5431" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5431" dst_range_end="5431"/>
<TCPService id="id41291787" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-0" comment="Java VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5800" dst_range_end="5800"/>
<TCPService id="id41291788" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-0" comment="Regular VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5900" dst_range_end="5900"/>
<TCPService id="id41291887" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-1" comment="Java VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5801" dst_range_end="5801"/>
<TCPService id="id41291888" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-1" comment="Regular VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5901" dst_range_end="5901"/>
<TCPService id="id463FE5FE11008" ack_flag="False" ack_flag_mask="False" established="True" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP established" comment="Some firewall platforms can match TCP packets with flags ACK or RST set; the option is usually called &quot;established&quot;.&#10;&#10;Note that you can use this object only in the policy rules of the firewall that supports this option.&#10;&#10;If you need to match reply packets for a specific TCP service and wish to use option &quot;established&quot;, make a copy of this object and set source port range to match the service.&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id1577X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtmp" comment="Real Time Messaging Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1935" dst_range_end="1935"/>
<TCPService id="id1590X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5222" dst_range_end="5222"/>
<TCPService id="id1609X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5269" dst_range_end="5269"/>
<TCPService id="id1622X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client-ssl" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5223" dst_range_end="5223"/>
<TCPService id="id1631X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server-ssl" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5270" dst_range_end="5270"/>
<TCPService id="id1644X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nrpe" comment="NRPE add-on for Nagios http://www.nagios.org/&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5666" dst_range_end="5666"/>
</ServiceGroup>
<ServiceGroup id="stdid08" name="UDP" comment="" ro="False">
<UDPService id="udp-ALL_UDP_Masqueraded" name="ALL UDP Masqueraded" comment="ipchains used to use this port range for masqueraded packets" ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
<UDPService id="udp-All_UDP" name="All UDP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<UDPService id="id3D703C96" name="ICQ" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4000" dst_range_end="4000"/>
<UDPService id="id3CB129D2" name="IKE" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="500" dst_range_end="500"/>
<UDPService id="id3CB131CA" name="PCAnywhere-status" comment="status channel for PCAnywhere v7.52 and later" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5632" dst_range_end="5632"/>
<UDPService id="id3AED0D6B" name="RIP" comment="routing protocol RIP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="520" dst_range_end="520"/>
<UDPService id="id3D703C8C" name="Radius" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1645" dst_range_end="1645"/>
<UDPService id="id3D703C85" name="UDP high ports" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
<UDPService id="id3D703C86" name="Who" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
<UDPService id="id3B4FEDA1" name="afs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7000" dst_range_end="7009"/>
<UDPService id="udp-bootpc" name="bootpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="68" dst_range_end="68"/>
<UDPService id="udp-bootps" name="bootps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="67" dst_range_end="67"/>
<UDPService id="id3AEDBE70" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
<UDPService id="udp-DNS" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
<UDPService id="id3D703C8A" name="interphone" comment="VocalTec Internet Phone" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22555" dst_range_end="22555"/>
<UDPService id="id3B4FEDA5" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
<UDPService id="id3B4FEDA9" name="kerberos-adm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="749" dst_range_end="750"/>
<UDPService id="id3B4FEDA7" name="kpasswd" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="464" dst_range_end="464"/>
<UDPService id="id3B4FEDAB" name="krb524" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4444" dst_range_end="4444"/>
<UDPService id="id3F865B0D" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
<UDPService id="udp-netbios-dgm" name="netbios-dgm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="138" dst_range_end="138"/>
<UDPService id="udp-netbios-ns" name="netbios-ns" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="137" dst_range_end="137"/>
<UDPService id="udp-netbios-ssn" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
<UDPService id="id3B4FEE78" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
<UDPService id="udp-ntp" name="ntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="123" dst_range_end="123"/>
<UDPService id="id3B4FEF7E" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
<UDPService id="id3D703C88" name="secureid-udp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="1024"/>
<UDPService id="udp-SNMP" name="snmp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="161" dst_range_end="161"/>
<UDPService id="id3AED0D69" name="snmp-trap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="162" dst_range_end="162"/>
<UDPService id="id3AEDBE19" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
<UDPService id="id3AECF780" name="syslog" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
<UDPService id="id3AED0D67" name="tftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="69" dst_range_end="69"/>
<UDPService id="id3AED0D8C" name="traceroute" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="33434" dst_range_end="33524"/>
<UDPService id="id4127EA73" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
<UDPService id="id41291783" name="SSDP" comment="Simple Service Discovery Protocol (used for UPnP)" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1900" dst_range_end="1900"/>
<UDPService id="id41291883" name="OpenVPN" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1194" dst_range_end="1194"/>
</ServiceGroup>
<ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
<CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
</ServiceGroup>
<ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
<ServiceGroup id="stdid20" name="UserServices" comment="" ro="False"/>
</ServiceGroup>
<ObjectGroup id="stdid12" name="Firewalls" comment="" ro="False"/>
<ObjectGroup id="stdid21" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="stdid11" name="Time" comment="" ro="False">
<Interval id="int-workhours" days_of_week="1,2,3,4,5" from_day="-1" from_hour="9" from_minute="0" from_month="-1" from_weekday="1" from_year="-1" to_day="-1" to_hour="17" to_minute="0" to_month="-1" to_weekday="5" to_year="-1" name="workhours" comment="any day, 9:00am through 5:00pm" ro="False"/>
<Interval id="int-weekends" days_of_week="6,0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="weekends" comment="weekends: Saturday 0:00 through Sunday 23:59 " ro="False"/>
<Interval id="int-afterhours" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1" name="afterhours" comment="any day 6:00pm - 12:00am" ro="False"/>
<Interval id="id3C63479C" days_of_week="6" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1" name="Sat" comment="" ro="False"/>
<Interval id="id3C63479E" days_of_week="0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="Sun" comment="" ro="False"/>
</IntervalGroup>
</Library>
<Library id="sysid99" name="Deleted Objects" comment="" ro="False">
<AddressRange id="id4120X11300" name="Address Range" comment="" ro="False" start_address="10.42.43.1" end_address="10.42.43.1"/>
<Interface id="id4452X11300" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="eth0" comment="" ro="False">
<InterfaceOptions>
<Option name="bonding_policy"></Option>
<Option name="bondng_driver_options"></Option>
<Option name="enable_stp">False</Option>
<Option name="type">ethernet</Option>
<Option name="vlan_id">0</Option>
<Option name="xmit_hash_policy"></Option>
</InterfaceOptions>
<Interface id="id4506X11300" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="eth0.151" comment="" ro="False">
<InterfaceOptions>
<Option name="bonding_policy"></Option>
<Option name="bondng_driver_options"></Option>
<Option name="enable_stp">False</Option>
<Option name="type">8021q</Option>
<Option name="vlan_id">151</Option>
<Option name="xmit_hash_policy"></Option>
</InterfaceOptions>
</Interface>
<Interface id="id4552X11300" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="eth0.152" comment="" ro="False">
<InterfaceOptions>
<Option name="type">8021q</Option>
<Option name="vlan_id">152</Option>
</InterfaceOptions>
</Interface>
</Interface>
</Library>
<Library id="id3690X11300" color="#d2ffd0" name="User" comment="" ro="False">
<ObjectGroup id="id3691X11300" name="Objects" comment="" ro="False">
<ObjectGroup id="id3692X11300" name="Addresses" comment="" ro="False"/>
<ObjectGroup id="id3693X11300" name="DNS Names" comment="" ro="False"/>
<ObjectGroup id="id3694X11300" name="Address Tables" comment="" ro="False"/>
<ObjectGroup id="id3695X11300" name="Groups" comment="" ro="False">
<ObjectGroup id="id5748X14337" name="VMs" comment="" ro="False">
<ObjectRef ref="id4236X11300"/>
<ObjectRef ref="id4244X11300"/>
</ObjectGroup>
</ObjectGroup>
<ObjectGroup id="id3696X11300" subfolders="VMs" name="Hosts" comment="" ro="False">
<Host id="id4204X11300" name="centos-ticketer" comment="" ro="False">
<Interface id="id4206X11300" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="unknown" comment="" ro="False">
<IPv4 id="id4207X11300" name="centos-ticketer:unknown:ip" comment="" ro="False" address="10.42.43.203" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="0.0.0.0">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions/>
</Host>
<Host id="id4236X11300" folder="VMs" name="vm1" comment="" ro="False">
<Interface id="id4238X11300" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="unknown" comment="" ro="False">
<IPv4 id="id4239X11300" name="vm1:unknown:ip" comment="" ro="False" address="10.42.43.220" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="0.0.0.0">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions/>
</Host>
<Host id="id4244X11300" folder="VMs" name="vm2" comment="" ro="False">
<Interface id="id4246X11300" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="unknown" comment="" ro="False">
<IPv4 id="id4247X11300" name="vm2:unknown:ip" comment="" ro="False" address="10.42.43.206" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="0.0.0.0">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions/>
</Host>
<Host id="id2599X2130" name="splunker" comment="" ro="False">
<Interface id="id2601X2130" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="unknown" comment="" ro="False">
<IPv4 id="id2602X2130" name="splunker:unknown:ip" comment="" ro="False" address="10.42.43.204" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="0.0.0.0">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions/>
</Host>
<Host id="id2627X2130" name="apache-warrior" comment="" ro="False">
<Interface id="id2629X2130" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="unknown" comment="" ro="False">
<IPv4 id="id2630X2130" name="apache-warrior:unknown:ip" comment="" ro="False" address="10.42.43.202" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="0.0.0.0">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions/>
</Host>
</ObjectGroup>
<ObjectGroup id="id3697X11300" name="Networks" comment="" ro="False">
<Network id="id4125X11300" name="Blue Pod" comment="" ro="False" address="10.42.43.0" netmask="255.255.255.0"/>
</ObjectGroup>
<ObjectGroup id="id3698X11300" name="Address Ranges" comment="" ro="False"/>
</ObjectGroup>
<ServiceGroup id="id3699X11300" name="Services" comment="" ro="False">
<ServiceGroup id="id3700X11300" name="Groups" comment="" ro="False"/>
<ServiceGroup id="id3701X11300" name="ICMP" comment="" ro="False"/>
<ServiceGroup id="id3702X11300" name="IP" comment="" ro="False"/>
<ServiceGroup id="id3703X11300" name="TCP" comment="" ro="False"/>
<ServiceGroup id="id3704X11300" name="UDP" comment="" ro="False"/>
<ServiceGroup id="id3705X11300" name="Users" comment="" ro="False"/>
<ServiceGroup id="id3706X11300" name="Custom" comment="" ro="False"/>
<ServiceGroup id="id3707X11300" name="TagServices" comment="" ro="False"/>
</ServiceGroup>
<ObjectGroup id="id3708X11300" name="Firewalls" comment="" ro="False">
<Firewall id="id4054X11300" host_OS="linux24" lastCompiled="1363924308" lastInstalled="1363924315" lastModified="1363926520" platform="iptables" name="practice" comment="" ro="False">
<NAT id="id4058X11300" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</NAT>
<Policy id="id4056X11300" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<PolicyRule id="id5761X14337" disabled="True" group="" log="True" position="0" action="Reject" direction="Both" comment="">
<Src neg="False">
<ObjectRef ref="id5748X14337"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule id="id2607X2130" disabled="False" group="" log="True" position="1" action="Reject" direction="Both" comment="">
<Src neg="False">
<ObjectRef ref="id2627X2130"/>
<ObjectRef ref="id2599X2130"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id2599X2130"/>
<ObjectRef ref="id2627X2130"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="action_on_reject"></Option>
<Option name="custom_str"></Option>
<Option name="ipfw_pipe_port_num">0</Option>
<Option name="rule_name_accounting"></Option>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule id="id4546X14337" disabled="False" group="" log="True" position="2" action="Accept" direction="Both" comment="">
<Src neg="False">
<ObjectRef ref="id4063X11300"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule id="id4108X11300" disabled="False" group="" log="True" position="3" action="Accept" direction="Both" comment="">
<Src neg="False">
<ObjectRef ref="id4125X11300"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<RuleSetOptions/>
</Policy>
<Routing id="id4060X11300" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</Routing>
<Interface id="id4062X11300" dedicated_failover="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="br0" comment="" ro="False">
<IPv4 id="id4063X11300" name="practice:br0:ip" comment="" ro="False" address="10.42.43.202" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="10.42.43.202">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<FirewallOptions>
<Option name="accept_established">True</Option>
<Option name="accept_new_tcp_with_no_syn">True</Option>
<Option name="action_on_reject"></Option>
<Option name="activationCmd"></Option>
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
<Option name="admUser">root</Option>
<Option name="altAddress"></Option>
<Option name="bridging_fw">True</Option>
<Option name="check_shading">True</Option>
<Option name="clamp_mss_to_mtu">False</Option>
<Option name="clear_unknown_interfaces">False</Option>
<Option name="cmdline"></Option>
<Option name="compiler"></Option>
<Option name="configure_bonding_interfaces">False</Option>
<Option name="configure_bridge_interfaces">False</Option>
<Option name="configure_interfaces">False</Option>
<Option name="configure_vlan_interfaces">False</Option>
<Option name="data_dir"></Option>
<Option name="debug">False</Option>
<Option name="drop_invalid">False</Option>
<Option name="epilog_script"></Option>
<Option name="firewall_dir">/tmp</Option>
<Option name="firewall_is_part_of_any_and_networks">True</Option>
<Option name="flush_and_set_default_policy">True</Option>
<Option name="ignore_empty_groups">False</Option>
<Option name="ipv4_6_order">ipv4_first</Option>
<Option name="limit_suffix"></Option>
<Option name="limit_value">0</Option>
<Option name="linux24_accept_redirects"></Option>
<Option name="linux24_accept_source_route"></Option>
<Option name="linux24_conntrack_hashsize">0</Option>
<Option name="linux24_conntrack_max">0</Option>
<Option name="linux24_conntrack_tcp_be_liberal"></Option>
<Option name="linux24_icmp_echo_ignore_all"></Option>
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
<Option name="linux24_ip_dynaddr"></Option>
<Option name="linux24_ip_forward"></Option>
<Option name="linux24_ipv6_forward"></Option>
<Option name="linux24_log_martians"></Option>
<Option name="linux24_path_brctl"></Option>
<Option name="linux24_path_ifenslave"></Option>
<Option name="linux24_path_ip"></Option>
<Option name="linux24_path_ip6tables"></Option>
<Option name="linux24_path_ip6tables_restore"></Option>
<Option name="linux24_path_ipset"></Option>
<Option name="linux24_path_iptables"></Option>
<Option name="linux24_path_iptables_restore"></Option>
<Option name="linux24_path_logger"></Option>
<Option name="linux24_path_lsmod"></Option>
<Option name="linux24_path_modprobe"></Option>
<Option name="linux24_path_vconfig"></Option>
<Option name="linux24_rp_filter"></Option>
<Option name="linux24_tcp_ecn"></Option>
<Option name="linux24_tcp_fack"></Option>
<Option name="linux24_tcp_fin_timeout">0</Option>
<Option name="linux24_tcp_keepalive_interval">0</Option>
<Option name="linux24_tcp_sack"></Option>
<Option name="linux24_tcp_syncookies"></Option>
<Option name="linux24_tcp_timestamps"></Option>
<Option name="linux24_tcp_window_scaling"></Option>
<Option name="load_modules">True</Option>
<Option name="local_nat">False</Option>
<Option name="log_all">False</Option>
<Option name="log_invalid">False</Option>
<Option name="log_ip_opt">False</Option>
<Option name="log_level">info</Option>
<Option name="log_prefix">RULE %N -- %A </Option>
<Option name="log_tcp_opt">False</Option>
<Option name="log_tcp_seq">False</Option>
<Option name="loopback_interface">lo</Option>
<Option name="manage_virtual_addr">False</Option>
<Option name="mgmt_addr"></Option>
<Option name="mgmt_ssh">False</Option>
<Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
<Option name="output_file"></Option>
<Option name="prolog_place">top</Option>
<Option name="prolog_script"></Option>
<Option name="scpArgs"></Option>
<Option name="script_name_on_firewall"></Option>
<Option name="sshArgs"></Option>
<Option name="ulog_cprange">0</Option>
<Option name="ulog_nlgroup">1</Option>
<Option name="ulog_qthreshold">1</Option>
<Option name="use_ULOG">False</Option>
<Option name="use_iptables_restore">False</Option>
<Option name="use_m_set">False</Option>
<Option name="use_numeric_log_levels">False</Option>
<Option name="verify_interfaces">False</Option>
</FirewallOptions>
</Firewall>
</ObjectGroup>
<ObjectGroup id="id3709X11300" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="id3710X11300" name="Time" comment="" ro="False"/>
</Library>
</FWObjectDatabase>
general-ccdc/bastion/firewall/wrccdc13.fwb
Executable
+1776
View File
File diff suppressed because it is too large Load Diff
general-ccdc/bastion/firewall/wrccdc14.fwb
Executable
+1308
View File
File diff suppressed because it is too large Load Diff
general-ccdc/bastion/firewall/wrccdc15-invite/NETWORK.net
Executable
+139
View File
@@ -0,0 +1,139 @@
# ----------------------------------------------------------------------------
# Hosts
# ----------------------------------------------------------------------------
#
# We use the following format for host definitions:
#
# HOSTNAME = IP # dns-label-1, ...: OS - service-1, ...
#
LOCALHOST = 127.0.0.1/32
# Unkown IP address
XXX = 0.0.0.0/32
# Internet
UPLINK = 10.47.4.1/32
# Servers
RONAN_UP = 10.47.4.2/32
RONAN = 172.21.1.2/32
STARLORD = 172.21.45.2/32
GAMORA = 172.21.18.2/32
ROCKET = 172.21.27.2/32
DRAX = 172.21.100.2/32
GROOT = 172.21.3.2/32
# Competition Infrastructure
#TEAM_PORTAL_SERVER = 10.120.0.5/32
#SOFTWARE_SERVER = 10.120.0.9/32 # Software/patch server
#NTP_SERVER = 10.120.0.10/32
#VOIP_SERVER = 10.120.0.100/32
#INTERNET_PROXY = 10.120.0.200/32
#PRINTER1 = 10.110.0.200/32 # Printer 1: 2300dn
#PRINTER2 = 10.110.0.201/32 # Printer 2: 2300dn
#PRINTER3 = 10.110.0.202/32 # Printer 3: 2300dn
# ----------------------------------------------------------------------------
# Groups
# ----------------------------------------------------------------------------
INTERNAL_MACHINES = RONAN
STARLORD
GAMORA
ROCKET
DRAX
GROOT
#COMP_SERVERS = TEAM_PORTAL_SERVER
# SOFTWARE_SERVER
# NTP_SERVER
# VOIP_SERVER
# INTERNET_PROXY
# PRINTER1
# PRINTER2
# PRINTER3
# ----------------------------------------------------------------------------
# Subnets
# ----------------------------------------------------------------------------
#COMP_NET = 10.110.0.0/16
# 10.120.0.0/16
UPLINK_NET = 10.47.4.2/30
INTERNAL_NET = 172.21.0.0/16 # 10.47.<TEAM>.0/30
EXTERNAL_NET = 192.168.104.0/24 # 192.168.10<TEAM>.0/24
POD = INTERNAL_NET
EXTERNAL_NET
# ----------------------------------------------------------------------------
# Defaults
# ----------------------------------------------------------------------------
RFC1918 = 10.0.0.0/8 # non-public
172.16.0.0/12 # non-public
192.168.0.0/16 # non-public
INTERNAL = RFC1918
LOOPBACK = 127.0.0.0/8 # loopback
::1/128 # ipv6 loopback
RFC_3330 = 169.254.0.0/16 # special use IPv4 addresses - netdeploy
LINKLOCAL = FE80::/10 # IPv6 link-local
SITELOCAL = FEC0::/10 # Ipv6 Site-local
MULTICAST = 224.0.0.0/4 # IP multicast
FF00::/8 # IPv6 multicast
CLASS-E = 240.0.0.0/4
RESERVED = 0.0.0.0/8 # reserved
RFC1918
LOOPBACK
RFC_3330
MULTICAST
CLASS-E
0000::/8 # reserved by IETF
0100::/8 # reserved by IETF
0200::/7 # reserved by IETF
0400::/6 # reserved by IETF
0800::/5 # reserved by IETF
1000::/4 # reserved by IETF
4000::/3 # reserved by IETF
6000::/3 # reserved by IETF
8000::/3 # reserved by IETF
A000::/3 # reserved by IETF
C000::/3 # reserved by IETF
E000::/4 # reserved by IETF
F000::/5 # reserved by IETF
F800::/6 # reserved by IETF
FC00::/7 # unique local unicast
FE00::/9 # reserved by IETF
LINKLOCAL # link local unicast
SITELOCAL # IPv6 site-local
# http://www.team-cymru.org/Services/Bogons/bogon-bn-agg.txt
# 22-Apr-2011
BOGON = 0.0.0.0/8
192.0.0.0/24
192.0.2.0/24
192.18.0.0/15
198.51.100.0/24
203.0.113.0/24
MULTICAST
CLASS-E
3FFE::/16 # 6bone
5F00::/8 # 6bone
2001:DB8::/32 # IPv6 documentation prefix
GOOGLE_PUBLIC_DNS_ANYCAST = 8.8.4.4/32 # IPv4 Anycast
8.8.8.8/32 # IPv4 Anycast
2001:4860:4860::8844/128 # IPv6 Anycast
2001:4860:4860::8888/128 # IPv6 Anycast
GOOGLE_DNS = GOOGLE_PUBLIC_DNS_ANYCAST
general-ccdc/bastion/firewall/wrccdc15-invite/SERVICES.svc
Executable
+77
View File
@@ -0,0 +1,77 @@
#
# Services
#
# TODO: Figure out ports
CISCO_VOIP = 1/tcp 1/udp
MINECRAFT_PORTS = 25565/tcp
UNREAL_TOURNAMENT_PORTS = 7777-7783/udp 27900/udp
MEDAL_OF_HONOR_PORTS = 12203-12218/udp 12300/udp 23000-23009/udp
QUAKE2_PORTS = 27910/tcp 27910/udp
VENTRILO_PORTS = 3784/tcp 3784/udp
TEAMSPEAK2_PORTS = 8767/tcp 8767/udp
# 14535/tcp # web interface
# 51234/tcp # query/telnet
#
# Defaults
#
WHOIS = 43/udp
SSH = 22/tcp
TELNET = 23/tcp
SMTP = 25/tcp
MAIL_SERVICES = SMTP
ESMTP
SMTP_SSL
POP_SSL
TIME = 37/tcp 37/udp
TACACS = 49/tcp
DNS = 53/tcp 53/udp
BOOTPS = 67/udp # BOOTP server
BOOTPC = 68/udp # BOOTP client
DHCP = BOOTPS
BOOTPC
TFTP = 69/tcp 69/udp
HTTP = 80/tcp
WEB_SERVICES = HTTP HTTPS
POP3 = 110/tcp
RPC = 111/udp
IDENT = 113/tcp 113/udp
NNTP = 119/tcp
NTP = 123/tcp 123/udp
MS_RPC_EPMAP = 135/udp 135/tcp
MS_137 = 137/udp
MS_138 = 138/udp
MS_139 = 139/tcp
IMAP = 143/tcp
SNMP = 161/udp
SNMP_TRAP = 162/udp
BGP = 179/tcp
IMAP3 = 220/tcp
LDAP = 389/tcp
LDAP_SERVICE = LDAP
LDAPS
HTTPS = 443/tcp
MS_445 = 445/tcp
SMTP_SSL = 465/tcp
IKE = 500/udp
SYSLOG = 514/udp
RTSP = 554/tcp
ESMTP = 587/tcp
LDAPS = 636/tcp
IMAPS = 993/tcp
POP_SSL = 995/tcp
HIGH_PORTS = 1024-65535/tcp 1024-65535/udp
MSSQL = 1433/tcp
MSSQL_MONITOR = 1434/tcp
RADIUS = 1812/tcp 1812/udp
HSRP = 1985/udp
NFSD = 2049/tcp 2049/udp
NETFLOW = 2056/udp
SQUID_PROXY = 3128/tcp
MYSQL = 3306/tcp
RDP = 3389/tcp
IPSEC = 4500/udp
POSTGRESQL = 5432/tcp
TRACEROUTE = 33434-33534/udp
general-ccdc/bastion/firewall/wrccdc15-invite/rules.pol
Executable
+104
View File
@@ -0,0 +1,104 @@
# -----------------------------------------------------------------------------
# INGRESS
# -----------------------------------------------------------------------------
header {
comment:: "ingress filter"
target:: speedway FORWARD DROP inet
}
# Allow ICMP everywhere.
term permit-icmp {
protocol:: icmp
action:: accept
}
# Work with speedway (iptables) only.
term permit-tcp-established {
destination-address:: POD
protocol:: tcp
option:: tcp-established
action:: accept
}
#term permit-udp-established {
# destination-address:: POD
# protocol:: udp
# source-port:: HIGH_PORTS
# action:: accept
#}
term permit-mail {
destination-address:: GROOT
protocol:: tcp
destination-port:: SMTP HTTP
action:: accept
}
term in-default-deny {
action:: deny
}
# -----------------------------------------------------------------------------
# EGRESS
# -----------------------------------------------------------------------------
header {
comment:: "egress filter"
target:: speedway FORWARD DROP inet
}
term deny-to-bad-destinations {
destination-address:: RFC1918 BOGON RESERVED
action:: deny
}
#term permit-comp-servers {
# destination-address:: COMP_SERVERS GOOGLE_DNS
# protocol:: tcp udp
# action:: accept
#}
#term permit-voip-phone {
# source-address:: PHONE
# destination-address:: COMP_NET
# protocol:: tcp udp
# port:: CISCO_VOIP
# target:: accept
#}
term out-default-deny {
action:: deny
}
# -----------------------------------------------------------------------------
# INPUT
# -----------------------------------------------------------------------------
header {
comment:: "input filter"
target:: speedway INPUT DROP inet
}
term permit-local {
source-interface:: lo
action:: accept
}
term permit-icmp {
protocol:: icmp
action:: accept
}
term permit-tcp-established {
protocol:: tcp
option:: tcp-established
action:: accept
}
term permit-admin {
source-address:: POD
protocol:: tcp
destination-port:: SSH
action:: accept
}
general-ccdc/bastion/firewall/wrccdc15-quals/NETWORK.net
Executable
+30
View File
@@ -0,0 +1,30 @@
LOCALHOST = 127.0.0.1/32
XXX = 0.0.0.0/32
UPLINK_NET = 10.47.8.0/30
GATEWAY = 10.47.8.1/32
RAPUNZEL_UPLINK = 10.47.8.2/32
RAPUNZEL = 10.8.128.2/32
SNOWWHITE = 10.8.218.2/32
CINDERELLA = 10.8.72.2/32
BELLE = 10.8.184.2/32
AURORA = 10.8.247.2/32
ARIEL = 10.8.8.2/32
ELSA = 10.8.40.2/32
#RAPUNZEL = 203.0.113.128/32
#SNOWWHITE = 203.0.113.218/32
#CINDERELLA = 203.0.113.72/32
#BELLE = 203.0.113.184/32
#AURORA = 203.0.113.247/32
#ARIEL = 203.0.113.8/32
#ELSA = 203.0.113.40/32
POD_NET = 10.8.0.0/24
POD = RAPUNZEL
SNOWWHITE
CINDERELLA
BELLE
AURORA
ARIEL
ELSA
general-ccdc/bastion/firewall/wrccdc15-quals/RULES.pol
Executable
+64
View File
@@ -0,0 +1,64 @@
# -------------------------------------
# INGRESS
# -------------------------------------
# Example verbatim rule
#term base-allow-lo0-out {
# comment:: "Allow all loopback communications"
# verbatim:: iptables "-A OUTPUT -o lo -j ACCEPT"
#}
header {
comment:: "ingress firewall"
target:: speedway FORWARD DROP inet
}
term permit-icmp {
comment:: "allow ICMP everywhere"
protocol::icmp
action:: accept
}
term permit-established {
option:: established
action:: accept
}
term permit-mail {
comment:: "Exchange"
destination-address:: BELLE
protocol:: tcp
destination-port:: SMTP POP3 HTTPS
action:: accept
}
term permit-web {
destination-address:: ARIEL ELSA
protocol:: tcp
destination-port:: HTTP
action:: accept
}
term permit-dns {
destination-address:: CINDERELLA SNOWWHITE
destination-port:: DNS
protocol:: udp
action:: accept
}
# -------------------------------------
# RELAY
# -------------------------------------
header {
comment:: "egress firewall"
target:: speedway FORWARD DROP inet
}
# TODO: lock down
term permit-pod-to-pod {
source-address:: POD
# destination-address:: POD
action:: accept
}
general-ccdc/bastion/firewall/wrccdc16-invite/default.iptables
Executable
+708
View File
@@ -0,0 +1,708 @@
# Generated by iptables-save v1.4.14 on Sat Jan 9 12:39:15 2016
*filter
:INPUT ACCEPT [51388:45668174]
:FORWARD ACCEPT [591:68902]
:OUTPUT ACCEPT [42959:45322218]
:block-invalid - [0:0]
:bypass-rules - [0:0]
:filter-rules-forward - [0:0]
:filter-rules-input - [0:0]
:nat-reverse-filter - [0:0]
:save-mark-dst-intf - [0:0]
:set-bypass-mark - [0:0]
-A INPUT -m conntrack --ctstate NEW -m comment --comment "input filter rules" -j filter-rules-input
-A INPUT -m conntrack --ctstate INVALID -m comment --comment "Block INVALID" -j block-invalid
-A FORWARD -m comment --comment "Save dst intf mark (0xff00)" -j save-mark-dst-intf
-A FORWARD -m conntrack --ctstate NEW -m comment --comment "Bypass rules" -j bypass-rules
-A FORWARD -m conntrack --ctstate NEW -m comment --comment "block traffic to NATd interfaces" -j nat-reverse-filter
-A FORWARD -m conntrack --ctstate NEW -m comment --comment "forward filter rules" -j filter-rules-forward
-A FORWARD -m conntrack --ctstate INVALID -m comment --comment "Block INVALID" -j block-invalid
-A block-invalid -m mark --mark 0xfe00/0xff00 -m comment --comment "Allow INVALID to local sockets (interface 0xfe)" -j RETURN
-A block-invalid -m mark --mark 0x202/0xffff -m comment --comment "Allow INVALID hairpin traffic (interface 2)" -j RETURN
-A block-invalid -m mark --mark 0x101/0xffff -m comment --comment "Allow INVALID hairpin traffic (interface 1)" -j RETURN
-A block-invalid -m conntrack --ctstate INVALID -m comment --comment "nflog on invalid" -j NFLOG --nflog-prefix invalid_blocked
-A block-invalid -m conntrack --ctstate INVALID -m comment --comment "Block INVALID packets" -j DROP
-A bypass-rules -m policy --dir in --pol ipsec -g set-bypass-mark
-A bypass-rules -m policy --dir out --pol ipsec -g set-bypass-mark
-A bypass-rules -i lo -m comment --comment "Bypass loopback traffic" -g set-bypass-mark
-A bypass-rules -o lo -m comment --comment "Bypass loopback traffic" -g set-bypass-mark
-A bypass-rules -m conntrack --ctstate RELATED -m comment --comment "Bypass RELATED sessions" -g set-bypass-mark
-A bypass-rules -p udp -m udp --sport 67:68 --dport 67:68 -m comment --comment "Bypass DHCP traffic" -g set-bypass-mark
-A bypass-rules -d 224.0.0.0/4 -m comment --comment "Bypass 224 traffic" -g set-bypass-mark
-A bypass-rules -m mark --mark 0x101/0xffff -m comment --comment "Bypass hairpin traffic (interface 1)" -g set-bypass-mark
-A bypass-rules -m mark --mark 0x202/0xffff -m comment --comment "Bypass hairpin traffic (interface 2)" -g set-bypass-mark
-A bypass-rules -p udp -m comment --comment "Bypass Rule #2" -m multiport --dports 5060 -g set-bypass-mark
-A bypass-rules -p tcp -m comment --comment "Bypass Rule #2" -m multiport --dports 5060 -g set-bypass-mark
-A bypass-rules -p udp -m comment --comment "Bypass Rule #3" -m multiport --dports 4569 -g set-bypass-mark
-A bypass-rules -p tcp -m comment --comment "Bypass Rule #3" -m multiport --dports 4569 -g set-bypass-mark
-A bypass-rules -p tcp -m comment --comment "Bypass Rule #4" -m multiport --dports 1723 -g set-bypass-mark
-A filter-rules-forward -m conntrack --ctstate RELATED -m comment --comment "Allow RELATED traffic" -j RETURN
-A filter-rules-input -i utun -m comment --comment "Allow all reinjected traffic" -j RETURN
-A filter-rules-input -m conntrack --ctstate RELATED -m comment --comment "Allow RELATED traffic" -j RETURN
-A filter-rules-input -i lo -m comment --comment "Allow all local traffic" -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #1" -m multiport --dports 22 -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #2" -m multiport --dports 443 -m connmark --mark 0x1/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #3" -m multiport --dports 443 -m connmark --mark 0x2/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #3" -m multiport --dports 443 -m connmark --mark 0xfa/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #3" -m multiport --dports 443 -m connmark --mark 0xfb/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #3" -m multiport --dports 443 -m connmark --mark 0xfc/0xff -j RETURN
-A filter-rules-input -p icmp -m comment --comment "Filter Rule #4" -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #5" -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #5" -j RETURN
-A filter-rules-input -p icmp -m comment --comment "Filter Rule #5" -j RETURN
-A filter-rules-input -p gre -m comment --comment "Filter Rule #5" -j RETURN
-A filter-rules-input -p esp -m comment --comment "Filter Rule #5" -j RETURN
-A filter-rules-input -p ah -m comment --comment "Filter Rule #5" -j RETURN
-A filter-rules-input -p sctp -m comment --comment "Filter Rule #5" -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #6" -m multiport --dports 53 -m connmark --mark 0x2/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #6" -m multiport --dports 53 -m connmark --mark 0x2/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #6" -m multiport --dports 53 -m connmark --mark 0xfa/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #6" -m multiport --dports 53 -m connmark --mark 0xfa/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #6" -m multiport --dports 53 -m connmark --mark 0xfb/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #6" -m multiport --dports 53 -m connmark --mark 0xfb/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #6" -m multiport --dports 53 -m connmark --mark 0xfc/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #6" -m multiport --dports 53 -m connmark --mark 0xfc/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #7" -m multiport --dports 67 -m connmark --mark 0x2/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #7" -m multiport --dports 67 -m connmark --mark 0xfa/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #7" -m multiport --dports 67 -m connmark --mark 0xfb/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #7" -m multiport --dports 67 -m connmark --mark 0xfc/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #8" -m multiport --dports 80 -m connmark --mark 0x2/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #8" -m multiport --dports 80 -m connmark --mark 0xfa/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #8" -m multiport --dports 80 -m connmark --mark 0xfb/0xff -j RETURN
-A filter-rules-input -p tcp -m comment --comment "Filter Rule #8" -m multiport --dports 80 -m connmark --mark 0xfc/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #9" -m multiport --dports 161 -m connmark --mark 0x2/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #9" -m multiport --dports 161 -m connmark --mark 0xfa/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #9" -m multiport --dports 161 -m connmark --mark 0xfb/0xff -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #9" -m multiport --dports 161 -m connmark --mark 0xfc/0xff -j RETURN
-A filter-rules-input -p ah -m comment --comment "Filter Rule #10" -j RETURN
-A filter-rules-input -p esp -m comment --comment "Filter Rule #10" -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #11" -m multiport --dports 500 -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #12" -m multiport --dports 4500 -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #13" -m multiport --dports 1701 -j RETURN
-A filter-rules-input -p udp -m comment --comment "Filter Rule #14" -m multiport --dports 1194 -m connmark --mark 0x1/0xff -j RETURN
-A filter-rules-input -m comment --comment "Filter Rule #15" -j NFLOG --nflog-prefix filter_blocked
-A filter-rules-input -m comment --comment "Filter Rule #15" -j DROP
-A nat-reverse-filter -m mark --mark 0xfb/0xff -m comment --comment "Allow L2TP" -j RETURN
-A nat-reverse-filter -m policy --dir out --pol ipsec -m comment --comment "allow IPsec traffic" -j RETURN
-A nat-reverse-filter -m policy --dir in --pol ipsec -m comment --comment "allow IPsec traffic" -j RETURN
-A nat-reverse-filter -m conntrack --ctstate RELATED -m comment --comment "Allow RELATED traffic" -j RETURN
-A nat-reverse-filter -m conntrack --ctstate DNAT -m comment --comment "Allow port forwarded traffic" -j RETURN
-A nat-reverse-filter -m connmark --mark 0x201/0xffff -m comment --comment "Block traffic to NATd interace, 1 -> 2 (egress setting)" -j NFLOG --nflog-prefix "filter_blocked: "
-A nat-reverse-filter -m connmark --mark 0x201/0xffff -m comment --comment "Block traffic to NATd interace, 1 -> 2 (egress setting)" -j REJECT --reject-with icmp-port-unreachable
-A save-mark-dst-intf -m conntrack --ctstate NEW -m comment --comment "Save dst interface mark to connmark" -j CONNMARK --save-mark --nfmask 0xff00 --ctmask 0xff00
-A set-bypass-mark -m comment --comment "Set the bypass mark on this packet" -j MARK --set-xmark 0x1000000/0x1000000
-A set-bypass-mark -m comment --comment "Set the bypass mark on this session" -j CONNMARK --set-xmark 0x1000000/0x1000000
COMMIT
# Completed on Sat Jan 9 12:39:15 2016
# Generated by iptables-save v1.4.14 on Sat Jan 9 12:39:15 2016
*mangle
:PREROUTING ACCEPT [1142533:584384998]
:INPUT ACCEPT [1025243:577400783]
:FORWARD ACCEPT [117042:6970285]
:OUTPUT ACCEPT [1035719:603681007]
:POSTROUTING ACCEPT [1147861:609968400]
:ipsec-xauth-dst - [0:0]
:ipsec-xauth-src - [0:0]
:mark-dst-intf - [0:0]
:mark-src-intf - [0:0]
:restore-bypass-mark - [0:0]
:restore-interface-marks - [0:0]
:snort-scanning - [0:0]
-A PREROUTING -m comment --comment "Restore interface marks (0xffff) from connmark" -j restore-interface-marks
-A PREROUTING -p tcp -m socket -m comment --comment "route traffic to non-locally bound sockets to local" -j MARK --set-xmark 0xfe00/0xff00
-A PREROUTING -p icmp -m icmp --icmp-type 3/4 -m socket -m comment --comment "route ICMP Unreachable Frag needed traffic to local" -j MARK --set-xmark 0xfe00/0xff00
-A PREROUTING -m comment --comment "Set src intf mark (0x00ff)" -j mark-src-intf
-A PREROUTING -m comment --comment "Restore bypass mark (0x01000000) from connmark" -j restore-bypass-mark
-A INPUT -i utun -m comment --comment "Set reinjected packet mark" -j MARK --set-xmark 0x10000000/0x10000000
-A FORWARD -m comment --comment "Set dst intf mark (0xff00)" -j mark-dst-intf
-A OUTPUT -m comment --comment "Set bypass bit on all local outbound packets" -j MARK --set-xmark 0x1000000/0x1000000
-A OUTPUT -m conntrack --ctstate NEW -m comment --comment "Set bypass bit on all local outbound sessions" -j CONNMARK --set-xmark 0x1000000/0x1000000
-A OUTPUT -p udp -m comment --comment "change the mark of all UDP packets to force re-route after OUTPUT" -j MARK --set-xmark 0x80000000/0x80000000
-A OUTPUT -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m comment --comment "restore mark on reinject packet" -j restore-interface-marks
-A mark-dst-intf -m mark ! --mark 0x0/0xff00 -m conntrack ! --ctstate NEW -m comment --comment "If its already set and an existing session, just return" -j RETURN
-A mark-dst-intf -m addrtype --dst-type BROADCAST -m comment --comment "If its a broadcast packet, just return" -j RETURN
-A mark-dst-intf -o eth0 -m comment --comment "Set dst interface mark for intf 1" -j MARK --set-xmark 0x100/0xff00
-A mark-dst-intf -o eth1 -m comment --comment "Set dst interface mark for intf 2" -j MARK --set-xmark 0x200/0xff00
-A mark-src-intf -m mark ! --mark 0x0/0xff -m comment --comment "If its already set, just return" -j RETURN
-A mark-src-intf -i eth0 -m comment --comment "Set src interface mark for intf 1" -j MARK --set-xmark 0x1/0xff
-A mark-src-intf -i eth1 -m comment --comment "Set src interface mark for intf 2" -j MARK --set-xmark 0x2/0xff
-A mark-src-intf -i utun -p tcp -m mac --mac-source 00:00:00:00:00:01 -m comment --comment "Set reinject packet src interface mark for intf 1" -j MARK --set-xmark 0x1/0xff
-A mark-src-intf -i utun -p tcp -m mac --mac-source 00:00:00:00:00:02 -m comment --comment "Set reinject packet src interface mark for intf 2" -j MARK --set-xmark 0x2/0xff
-A mark-src-intf -m mark ! --mark 0x0/0xff -m conntrack --ctstate NEW -m comment --comment "Save src interface mark to connmark" -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
-A mark-src-intf -m policy --dir in --pol ipsec -m comment --comment "Do not warn on IPsec traffic" -j RETURN
-A mark-src-intf -i lo -m comment --comment "Do not warn loopback traffic" -j RETURN
-A mark-src-intf -m mark --mark 0x0/0xff -m comment --comment "WARN on missing src mark" -j LOG --log-prefix "WARNING (unknown src intf):"
-A restore-bypass-mark -m comment --comment "Restore the bypass mark from conntrack" -j CONNMARK --restore-mark --nfmask 0x1000000 --ctmask 0x1000000
-A restore-bypass-mark -i lo -m comment --comment "Always bypass loopback traffic" -j MARK --set-xmark 0x1000000/0x1000000
-A restore-interface-marks -m comment --comment "Zero out source and destination interface marks" -j MARK --set-xmark 0x0/0xffff
-A restore-interface-marks -m addrtype --src-type BROADCAST -m comment --comment "Do not mark broadcast packets" -j RETURN
-A restore-interface-marks -m conntrack --ctdir ORIGINAL -m comment --comment "If packet is in original direction, copy mark from connmark to packet" -j CONNMARK --restore-mark --nfmask 0xffff --ctmask 0xffff
-A restore-interface-marks -m conntrack --ctdir ORIGINAL -m comment --comment "If packet is in original direction we are done, just return" -j RETURN
-A restore-interface-marks -m connmark --mark 0x1/0xff -m comment --comment "Set dst interface mark from connmark for intf 1" -j MARK --set-xmark 0x100/0xff00
-A restore-interface-marks -m connmark --mark 0x100/0xff00 -m comment --comment "Set src interface mark from connmark for intf 1" -j MARK --set-xmark 0x1/0xff
-A restore-interface-marks -m connmark --mark 0x2/0xff -m comment --comment "Set dst interface mark from connmark for intf 2" -j MARK --set-xmark 0x200/0xff00
-A restore-interface-marks -m connmark --mark 0x200/0xff00 -m comment --comment "Set src interface mark from connmark for intf 2" -j MARK --set-xmark 0x2/0xff
COMMIT
# Completed on Sat Jan 9 12:39:15 2016
# Generated by iptables-save v1.4.14 on Sat Jan 9 12:39:15 2016
*nat
:PREROUTING ACCEPT [13544:747410]
:INPUT ACCEPT [42248:2337477]
:OUTPUT ACCEPT [1471:118396]
:POSTROUTING ACCEPT [69829:3472439]
:l2tp-forward-rules - [0:0]
:nat-rules - [0:0]
:port-forward-rules - [0:0]
:uvm-tcp-redirect - [0:0]
-A PREROUTING -i utun -p tcp -m comment --comment "Redirect utun traffic to untangle-vm" -g uvm-tcp-redirect
-A PREROUTING -m conntrack --ctstate NEW -m comment --comment "Port Forward rules" -j port-forward-rules
-A POSTROUTING -m conntrack --ctstate NEW -m comment --comment "SNAT rules" -j nat-rules
-A nat-rules -m connmark --mark 0xfb/0xff -m comment --comment "NAT l2tp traffic" -j MASQUERADE
-A nat-rules -m policy --dir out --pol ipsec -m comment --comment "dont NAT IPsec traffic" -j RETURN
-A nat-rules -o lo -m comment --comment "Never NAT loopback traffic" -j RETURN
-A nat-rules -i lo -m comment --comment "Never NAT loopback traffic" -j RETURN
-A nat-rules -s 192.168.150.1/32 -m comment --comment "NAT Rule #1" -j SNAT --to-source 10.10.2.1
-A nat-rules -s 192.168.150.2/32 -m comment --comment "NAT Rule #2" -j SNAT --to-source 10.10.2.2
-A nat-rules -s 192.168.150.3/32 -m comment --comment "NAT Rule #3" -j SNAT --to-source 10.10.2.3
-A nat-rules -s 192.168.150.4/32 -m comment --comment "NAT Rule #4" -j SNAT --to-source 10.10.2.4
-A nat-rules -s 192.168.150.5/32 -m comment --comment "NAT Rule #5" -j SNAT --to-source 10.10.2.5
-A nat-rules -s 192.168.150.6/32 -m comment --comment "NAT Rule #6" -j SNAT --to-source 10.10.2.6
-A nat-rules -s 192.168.150.7/32 -m comment --comment "NAT Rule #7" -j SNAT --to-source 10.10.2.7
-A nat-rules -s 192.168.150.8/32 -m comment --comment "NAT Rule #8" -j SNAT --to-source 10.10.2.8
-A nat-rules -s 192.168.150.9/32 -m comment --comment "NAT Rule #9" -j SNAT --to-source 10.10.2.9
-A nat-rules -s 192.168.150.10/32 -m comment --comment "NAT Rule #10" -j SNAT --to-source 10.10.2.10
-A nat-rules -s 192.168.150.11/32 -m comment --comment "NAT Rule #11" -j SNAT --to-source 10.10.2.11
-A nat-rules -s 192.168.150.12/32 -m comment --comment "NAT Rule #12" -j SNAT --to-source 10.10.2.12
-A nat-rules -s 192.168.150.13/32 -m comment --comment "NAT Rule #13" -j SNAT --to-source 10.10.2.13
-A nat-rules -s 192.168.150.14/32 -m comment --comment "NAT Rule #14" -j SNAT --to-source 10.10.2.14
-A nat-rules -s 192.168.150.15/32 -m comment --comment "NAT Rule #15" -j SNAT --to-source 10.10.2.15
-A nat-rules -s 192.168.150.16/32 -m comment --comment "NAT Rule #16" -j SNAT --to-source 10.10.2.16
-A nat-rules -s 192.168.150.17/32 -m comment --comment "NAT Rule #17" -j SNAT --to-source 10.10.2.17
-A nat-rules -s 192.168.150.18/32 -m comment --comment "NAT Rule #18" -j SNAT --to-source 10.10.2.18
-A nat-rules -s 192.168.150.19/32 -m comment --comment "NAT Rule #19" -j SNAT --to-source 10.10.2.19
-A nat-rules -s 192.168.150.20/32 -m comment --comment "NAT Rule #20" -j SNAT --to-source 10.10.2.20
-A nat-rules -s 192.168.150.21/32 -m comment --comment "NAT Rule #21" -j SNAT --to-source 10.10.2.21
-A nat-rules -s 192.168.150.22/32 -m comment --comment "NAT Rule #22" -j SNAT --to-source 10.10.2.22
-A nat-rules -s 192.168.150.23/32 -m comment --comment "NAT Rule #23" -j SNAT --to-source 10.10.2.23
-A nat-rules -s 192.168.150.24/32 -m comment --comment "NAT Rule #24" -j SNAT --to-source 10.10.2.24
-A nat-rules -s 192.168.150.25/32 -m comment --comment "NAT Rule #25" -j SNAT --to-source 10.10.2.25
-A nat-rules -s 192.168.150.26/32 -m comment --comment "NAT Rule #26" -j SNAT --to-source 10.10.2.26
-A nat-rules -s 192.168.150.27/32 -m comment --comment "NAT Rule #27" -j SNAT --to-source 10.10.2.27
-A nat-rules -s 192.168.150.28/32 -m comment --comment "NAT Rule #28" -j SNAT --to-source 10.10.2.28
-A nat-rules -s 192.168.150.29/32 -m comment --comment "NAT Rule #29" -j SNAT --to-source 10.10.2.29
-A nat-rules -s 192.168.150.30/32 -m comment --comment "NAT Rule #30" -j SNAT --to-source 10.10.2.30
-A nat-rules -s 192.168.150.31/32 -m comment --comment "NAT Rule #31" -j SNAT --to-source 10.10.2.31
-A nat-rules -s 192.168.150.32/32 -m comment --comment "NAT Rule #32" -j SNAT --to-source 10.10.2.32
-A nat-rules -s 192.168.150.33/32 -m comment --comment "NAT Rule #33" -j SNAT --to-source 10.10.2.33
-A nat-rules -s 192.168.150.34/32 -m comment --comment "NAT Rule #34" -j SNAT --to-source 10.10.2.34
-A nat-rules -s 192.168.150.35/32 -m comment --comment "NAT Rule #35" -j SNAT --to-source 10.10.2.35
-A nat-rules -s 192.168.150.36/32 -m comment --comment "NAT Rule #36" -j SNAT --to-source 10.10.2.36
-A nat-rules -s 192.168.150.37/32 -m comment --comment "NAT Rule #37" -j SNAT --to-source 10.10.2.37
-A nat-rules -s 192.168.150.38/32 -m comment --comment "NAT Rule #38" -j SNAT --to-source 10.10.2.38
-A nat-rules -s 192.168.150.39/32 -m comment --comment "NAT Rule #39" -j SNAT --to-source 10.10.2.39
-A nat-rules -s 192.168.150.40/32 -m comment --comment "NAT Rule #40" -j SNAT --to-source 10.10.2.40
-A nat-rules -s 192.168.150.41/32 -m comment --comment "NAT Rule #41" -j SNAT --to-source 10.10.2.41
-A nat-rules -s 192.168.150.42/32 -m comment --comment "NAT Rule #42" -j SNAT --to-source 10.10.2.42
-A nat-rules -s 192.168.150.43/32 -m comment --comment "NAT Rule #43" -j SNAT --to-source 10.10.2.43
-A nat-rules -s 192.168.150.44/32 -m comment --comment "NAT Rule #44" -j SNAT --to-source 10.10.2.44
-A nat-rules -s 192.168.150.45/32 -m comment --comment "NAT Rule #45" -j SNAT --to-source 10.10.2.45
-A nat-rules -s 192.168.150.46/32 -m comment --comment "NAT Rule #46" -j SNAT --to-source 10.10.2.46
-A nat-rules -s 192.168.150.47/32 -m comment --comment "NAT Rule #47" -j SNAT --to-source 10.10.2.47
-A nat-rules -s 192.168.150.48/32 -m comment --comment "NAT Rule #48" -j SNAT --to-source 10.10.2.48
-A nat-rules -s 192.168.150.49/32 -m comment --comment "NAT Rule #49" -j SNAT --to-source 10.10.2.49
-A nat-rules -s 192.168.150.50/32 -m comment --comment "NAT Rule #50" -j SNAT --to-source 10.10.2.50
-A nat-rules -s 192.168.150.51/32 -m comment --comment "NAT Rule #51" -j SNAT --to-source 10.10.2.51
-A nat-rules -s 192.168.150.52/32 -m comment --comment "NAT Rule #52" -j SNAT --to-source 10.10.2.52
-A nat-rules -s 192.168.150.53/32 -m comment --comment "NAT Rule #53" -j SNAT --to-source 10.10.2.53
-A nat-rules -s 192.168.150.54/32 -m comment --comment "NAT Rule #54" -j SNAT --to-source 10.10.2.54
-A nat-rules -s 192.168.150.55/32 -m comment --comment "NAT Rule #55" -j SNAT --to-source 10.10.2.55
-A nat-rules -s 192.168.150.56/32 -m comment --comment "NAT Rule #56" -j SNAT --to-source 10.10.2.56
-A nat-rules -s 192.168.150.57/32 -m comment --comment "NAT Rule #57" -j SNAT --to-source 10.10.2.57
-A nat-rules -s 192.168.150.58/32 -m comment --comment "NAT Rule #58" -j SNAT --to-source 10.10.2.58
-A nat-rules -s 192.168.150.59/32 -m comment --comment "NAT Rule #59" -j SNAT --to-source 10.10.2.59
-A nat-rules -s 192.168.150.60/32 -m comment --comment "NAT Rule #60" -j SNAT --to-source 10.10.2.60
-A nat-rules -s 192.168.150.61/32 -m comment --comment "NAT Rule #61" -j SNAT --to-source 10.10.2.61
-A nat-rules -s 192.168.150.62/32 -m comment --comment "NAT Rule #62" -j SNAT --to-source 10.10.2.62
-A nat-rules -s 192.168.150.63/32 -m comment --comment "NAT Rule #63" -j SNAT --to-source 10.10.2.63
-A nat-rules -s 192.168.150.64/32 -m comment --comment "NAT Rule #64" -j SNAT --to-source 10.10.2.64
-A nat-rules -s 192.168.150.65/32 -m comment --comment "NAT Rule #65" -j SNAT --to-source 10.10.2.65
-A nat-rules -s 192.168.150.66/32 -m comment --comment "NAT Rule #66" -j SNAT --to-source 10.10.2.66
-A nat-rules -s 192.168.150.67/32 -m comment --comment "NAT Rule #67" -j SNAT --to-source 10.10.2.67
-A nat-rules -s 192.168.150.68/32 -m comment --comment "NAT Rule #68" -j SNAT --to-source 10.10.2.68
-A nat-rules -s 192.168.150.69/32 -m comment --comment "NAT Rule #69" -j SNAT --to-source 10.10.2.69
-A nat-rules -s 192.168.150.70/32 -m comment --comment "NAT Rule #70" -j SNAT --to-source 10.10.2.70
-A nat-rules -s 192.168.150.71/32 -m comment --comment "NAT Rule #71" -j SNAT --to-source 10.10.2.71
-A nat-rules -s 192.168.150.72/32 -m comment --comment "NAT Rule #72" -j SNAT --to-source 10.10.2.72
-A nat-rules -s 192.168.150.73/32 -m comment --comment "NAT Rule #73" -j SNAT --to-source 10.10.2.73
-A nat-rules -s 192.168.150.74/32 -m comment --comment "NAT Rule #74" -j SNAT --to-source 10.10.2.74
-A nat-rules -s 192.168.150.75/32 -m comment --comment "NAT Rule #75" -j SNAT --to-source 10.10.2.75
-A nat-rules -s 192.168.150.76/32 -m comment --comment "NAT Rule #76" -j SNAT --to-source 10.10.2.76
-A nat-rules -s 192.168.150.77/32 -m comment --comment "NAT Rule #77" -j SNAT --to-source 10.10.2.77
-A nat-rules -s 192.168.150.78/32 -m comment --comment "NAT Rule #78" -j SNAT --to-source 10.10.2.78
-A nat-rules -s 192.168.150.79/32 -m comment --comment "NAT Rule #79" -j SNAT --to-source 10.10.2.79
-A nat-rules -s 192.168.150.80/32 -m comment --comment "NAT Rule #80" -j SNAT --to-source 10.10.2.80
-A nat-rules -s 192.168.150.81/32 -m comment --comment "NAT Rule #81" -j SNAT --to-source 10.10.2.81
-A nat-rules -s 192.168.150.82/32 -m comment --comment "NAT Rule #82" -j SNAT --to-source 10.10.2.82
-A nat-rules -s 192.168.150.83/32 -m comment --comment "NAT Rule #83" -j SNAT --to-source 10.10.2.83
-A nat-rules -s 192.168.150.84/32 -m comment --comment "NAT Rule #84" -j SNAT --to-source 10.10.2.84
-A nat-rules -s 192.168.150.85/32 -m comment --comment "NAT Rule #85" -j SNAT --to-source 10.10.2.85
-A nat-rules -s 192.168.150.86/32 -m comment --comment "NAT Rule #86" -j SNAT --to-source 10.10.2.86
-A nat-rules -s 192.168.150.87/32 -m comment --comment "NAT Rule #87" -j SNAT --to-source 10.10.2.87
-A nat-rules -s 192.168.150.88/32 -m comment --comment "NAT Rule #88" -j SNAT --to-source 10.10.2.88
-A nat-rules -s 192.168.150.89/32 -m comment --comment "NAT Rule #89" -j SNAT --to-source 10.10.2.89
-A nat-rules -s 192.168.150.90/32 -m comment --comment "NAT Rule #90" -j SNAT --to-source 10.10.2.90
-A nat-rules -s 192.168.150.91/32 -m comment --comment "NAT Rule #91" -j SNAT --to-source 10.10.2.91
-A nat-rules -s 192.168.150.92/32 -m comment --comment "NAT Rule #92" -j SNAT --to-source 10.10.2.92
-A nat-rules -s 192.168.150.93/32 -m comment --comment "NAT Rule #93" -j SNAT --to-source 10.10.2.93
-A nat-rules -s 192.168.150.94/32 -m comment --comment "NAT Rule #94" -j SNAT --to-source 10.10.2.94
-A nat-rules -s 192.168.150.95/32 -m comment --comment "NAT Rule #95" -j SNAT --to-source 10.10.2.95
-A nat-rules -s 192.168.150.96/32 -m comment --comment "NAT Rule #96" -j SNAT --to-source 10.10.2.96
-A nat-rules -s 192.168.150.97/32 -m comment --comment "NAT Rule #97" -j SNAT --to-source 10.10.2.97
-A nat-rules -s 192.168.150.98/32 -m comment --comment "NAT Rule #98" -j SNAT --to-source 10.10.2.98
-A nat-rules -s 192.168.150.99/32 -m comment --comment "NAT Rule #99" -j SNAT --to-source 10.10.2.99
-A nat-rules -s 192.168.150.100/32 -m comment --comment "NAT Rule #100" -j SNAT --to-source 10.10.2.100
-A nat-rules -s 192.168.150.101/32 -m comment --comment "NAT Rule #101" -j SNAT --to-source 10.10.2.101
-A nat-rules -s 192.168.150.102/32 -m comment --comment "NAT Rule #102" -j SNAT --to-source 10.10.2.102
-A nat-rules -s 192.168.150.103/32 -m comment --comment "NAT Rule #103" -j SNAT --to-source 10.10.2.103
-A nat-rules -s 192.168.150.104/32 -m comment --comment "NAT Rule #104" -j SNAT --to-source 10.10.2.104
-A nat-rules -s 192.168.150.105/32 -m comment --comment "NAT Rule #105" -j SNAT --to-source 10.10.2.105
-A nat-rules -s 192.168.150.106/32 -m comment --comment "NAT Rule #106" -j SNAT --to-source 10.10.2.106
-A nat-rules -s 192.168.150.107/32 -m comment --comment "NAT Rule #107" -j SNAT --to-source 10.10.2.107
-A nat-rules -s 192.168.150.108/32 -m comment --comment "NAT Rule #108" -j SNAT --to-source 10.10.2.108
-A nat-rules -s 192.168.150.109/32 -m comment --comment "NAT Rule #109" -j SNAT --to-source 10.10.2.109
-A nat-rules -s 192.168.150.110/32 -m comment --comment "NAT Rule #110" -j SNAT --to-source 10.10.2.110
-A nat-rules -s 192.168.150.111/32 -m comment --comment "NAT Rule #111" -j SNAT --to-source 10.10.2.111
-A nat-rules -s 192.168.150.112/32 -m comment --comment "NAT Rule #112" -j SNAT --to-source 10.10.2.112
-A nat-rules -s 192.168.150.113/32 -m comment --comment "NAT Rule #113" -j SNAT --to-source 10.10.2.113
-A nat-rules -s 192.168.150.114/32 -m comment --comment "NAT Rule #114" -j SNAT --to-source 10.10.2.114
-A nat-rules -s 192.168.150.115/32 -m comment --comment "NAT Rule #115" -j SNAT --to-source 10.10.2.115
-A nat-rules -s 192.168.150.116/32 -m comment --comment "NAT Rule #116" -j SNAT --to-source 10.10.2.116
-A nat-rules -s 192.168.150.117/32 -m comment --comment "NAT Rule #117" -j SNAT --to-source 10.10.2.117
-A nat-rules -s 192.168.150.118/32 -m comment --comment "NAT Rule #118" -j SNAT --to-source 10.10.2.118
-A nat-rules -s 192.168.150.119/32 -m comment --comment "NAT Rule #119" -j SNAT --to-source 10.10.2.119
-A nat-rules -s 192.168.150.120/32 -m comment --comment "NAT Rule #120" -j SNAT --to-source 10.10.2.120
-A nat-rules -s 192.168.150.121/32 -m comment --comment "NAT Rule #121" -j SNAT --to-source 10.10.2.121
-A nat-rules -s 192.168.150.122/32 -m comment --comment "NAT Rule #122" -j SNAT --to-source 10.10.2.122
-A nat-rules -s 192.168.150.123/32 -m comment --comment "NAT Rule #123" -j SNAT --to-source 10.10.2.123
-A nat-rules -s 192.168.150.124/32 -m comment --comment "NAT Rule #124" -j SNAT --to-source 10.10.2.124
-A nat-rules -s 192.168.150.125/32 -m comment --comment "NAT Rule #125" -j SNAT --to-source 10.10.2.125
-A nat-rules -s 192.168.150.126/32 -m comment --comment "NAT Rule #126" -j SNAT --to-source 10.10.2.126
-A nat-rules -s 192.168.150.127/32 -m comment --comment "NAT Rule #127" -j SNAT --to-source 10.10.2.127
-A nat-rules -s 192.168.150.128/32 -m comment --comment "NAT Rule #128" -j SNAT --to-source 10.10.2.128
-A nat-rules -s 192.168.150.129/32 -m comment --comment "NAT Rule #129" -j SNAT --to-source 10.10.2.129
-A nat-rules -s 192.168.150.130/32 -m comment --comment "NAT Rule #130" -j SNAT --to-source 10.10.2.130
-A nat-rules -s 192.168.150.131/32 -m comment --comment "NAT Rule #131" -j SNAT --to-source 10.10.2.131
-A nat-rules -s 192.168.150.132/32 -m comment --comment "NAT Rule #132" -j SNAT --to-source 10.10.2.132
-A nat-rules -s 192.168.150.133/32 -m comment --comment "NAT Rule #133" -j SNAT --to-source 10.10.2.133
-A nat-rules -s 192.168.150.134/32 -m comment --comment "NAT Rule #134" -j SNAT --to-source 10.10.2.134
-A nat-rules -s 192.168.150.135/32 -m comment --comment "NAT Rule #135" -j SNAT --to-source 10.10.2.135
-A nat-rules -s 192.168.150.136/32 -m comment --comment "NAT Rule #136" -j SNAT --to-source 10.10.2.136
-A nat-rules -s 192.168.150.137/32 -m comment --comment "NAT Rule #137" -j SNAT --to-source 10.10.2.137
-A nat-rules -s 192.168.150.138/32 -m comment --comment "NAT Rule #138" -j SNAT --to-source 10.10.2.138
-A nat-rules -s 192.168.150.139/32 -m comment --comment "NAT Rule #139" -j SNAT --to-source 10.10.2.139
-A nat-rules -s 192.168.150.140/32 -m comment --comment "NAT Rule #140" -j SNAT --to-source 10.10.2.140
-A nat-rules -s 192.168.150.141/32 -m comment --comment "NAT Rule #141" -j SNAT --to-source 10.10.2.141
-A nat-rules -s 192.168.150.142/32 -m comment --comment "NAT Rule #142" -j SNAT --to-source 10.10.2.142
-A nat-rules -s 192.168.150.143/32 -m comment --comment "NAT Rule #143" -j SNAT --to-source 10.10.2.143
-A nat-rules -s 192.168.150.144/32 -m comment --comment "NAT Rule #144" -j SNAT --to-source 10.10.2.144
-A nat-rules -s 192.168.150.145/32 -m comment --comment "NAT Rule #145" -j SNAT --to-source 10.10.2.145
-A nat-rules -s 192.168.150.146/32 -m comment --comment "NAT Rule #146" -j SNAT --to-source 10.10.2.146
-A nat-rules -s 192.168.150.147/32 -m comment --comment "NAT Rule #147" -j SNAT --to-source 10.10.2.147
-A nat-rules -s 192.168.150.148/32 -m comment --comment "NAT Rule #148" -j SNAT --to-source 10.10.2.148
-A nat-rules -s 192.168.150.149/32 -m comment --comment "NAT Rule #149" -j SNAT --to-source 10.10.2.149
-A nat-rules -s 192.168.150.150/32 -m comment --comment "NAT Rule #150" -j SNAT --to-source 10.10.2.150
-A nat-rules -s 192.168.150.151/32 -m comment --comment "NAT Rule #151" -j SNAT --to-source 10.10.2.151
-A nat-rules -s 192.168.150.152/32 -m comment --comment "NAT Rule #152" -j SNAT --to-source 10.10.2.152
-A nat-rules -s 192.168.150.153/32 -m comment --comment "NAT Rule #153" -j SNAT --to-source 10.10.2.153
-A nat-rules -s 192.168.150.154/32 -m comment --comment "NAT Rule #154" -j SNAT --to-source 10.10.2.154
-A nat-rules -s 192.168.150.155/32 -m comment --comment "NAT Rule #155" -j SNAT --to-source 10.10.2.155
-A nat-rules -s 192.168.150.156/32 -m comment --comment "NAT Rule #156" -j SNAT --to-source 10.10.2.156
-A nat-rules -s 192.168.150.157/32 -m comment --comment "NAT Rule #157" -j SNAT --to-source 10.10.2.157
-A nat-rules -s 192.168.150.158/32 -m comment --comment "NAT Rule #158" -j SNAT --to-source 10.10.2.158
-A nat-rules -s 192.168.150.159/32 -m comment --comment "NAT Rule #159" -j SNAT --to-source 10.10.2.159
-A nat-rules -s 192.168.150.160/32 -m comment --comment "NAT Rule #160" -j SNAT --to-source 10.10.2.160
-A nat-rules -s 192.168.150.161/32 -m comment --comment "NAT Rule #161" -j SNAT --to-source 10.10.2.161
-A nat-rules -s 192.168.150.162/32 -m comment --comment "NAT Rule #162" -j SNAT --to-source 10.10.2.162
-A nat-rules -s 192.168.150.163/32 -m comment --comment "NAT Rule #163" -j SNAT --to-source 10.10.2.163
-A nat-rules -s 192.168.150.164/32 -m comment --comment "NAT Rule #164" -j SNAT --to-source 10.10.2.164
-A nat-rules -s 192.168.150.165/32 -m comment --comment "NAT Rule #165" -j SNAT --to-source 10.10.2.165
-A nat-rules -s 192.168.150.166/32 -m comment --comment "NAT Rule #166" -j SNAT --to-source 10.10.2.166
-A nat-rules -s 192.168.150.167/32 -m comment --comment "NAT Rule #167" -j SNAT --to-source 10.10.2.167
-A nat-rules -s 192.168.150.168/32 -m comment --comment "NAT Rule #168" -j SNAT --to-source 10.10.2.168
-A nat-rules -s 192.168.150.169/32 -m comment --comment "NAT Rule #169" -j SNAT --to-source 10.10.2.169
-A nat-rules -s 192.168.150.170/32 -m comment --comment "NAT Rule #170" -j SNAT --to-source 10.10.2.170
-A nat-rules -s 192.168.150.171/32 -m comment --comment "NAT Rule #171" -j SNAT --to-source 10.10.2.171
-A nat-rules -s 192.168.150.172/32 -m comment --comment "NAT Rule #172" -j SNAT --to-source 10.10.2.172
-A nat-rules -s 192.168.150.173/32 -m comment --comment "NAT Rule #173" -j SNAT --to-source 10.10.2.173
-A nat-rules -s 192.168.150.174/32 -m comment --comment "NAT Rule #174" -j SNAT --to-source 10.10.2.174
-A nat-rules -s 192.168.150.175/32 -m comment --comment "NAT Rule #175" -j SNAT --to-source 10.10.2.175
-A nat-rules -s 192.168.150.176/32 -m comment --comment "NAT Rule #176" -j SNAT --to-source 10.10.2.176
-A nat-rules -s 192.168.150.177/32 -m comment --comment "NAT Rule #177" -j SNAT --to-source 10.10.2.177
-A nat-rules -s 192.168.150.178/32 -m comment --comment "NAT Rule #178" -j SNAT --to-source 10.10.2.178
-A nat-rules -s 192.168.150.179/32 -m comment --comment "NAT Rule #179" -j SNAT --to-source 10.10.2.179
-A nat-rules -s 192.168.150.180/32 -m comment --comment "NAT Rule #180" -j SNAT --to-source 10.10.2.180
-A nat-rules -s 192.168.150.181/32 -m comment --comment "NAT Rule #181" -j SNAT --to-source 10.10.2.181
-A nat-rules -s 192.168.150.182/32 -m comment --comment "NAT Rule #182" -j SNAT --to-source 10.10.2.182
-A nat-rules -s 192.168.150.183/32 -m comment --comment "NAT Rule #183" -j SNAT --to-source 10.10.2.183
-A nat-rules -s 192.168.150.184/32 -m comment --comment "NAT Rule #184" -j SNAT --to-source 10.10.2.184
-A nat-rules -s 192.168.150.185/32 -m comment --comment "NAT Rule #185" -j SNAT --to-source 10.10.2.185
-A nat-rules -s 192.168.150.186/32 -m comment --comment "NAT Rule #186" -j SNAT --to-source 10.10.2.186
-A nat-rules -s 192.168.150.187/32 -m comment --comment "NAT Rule #187" -j SNAT --to-source 10.10.2.187
-A nat-rules -s 192.168.150.188/32 -m comment --comment "NAT Rule #188" -j SNAT --to-source 10.10.2.188
-A nat-rules -s 192.168.150.189/32 -m comment --comment "NAT Rule #189" -j SNAT --to-source 10.10.2.189
-A nat-rules -s 192.168.150.190/32 -m comment --comment "NAT Rule #190" -j SNAT --to-source 10.10.2.190
-A nat-rules -s 192.168.150.191/32 -m comment --comment "NAT Rule #191" -j SNAT --to-source 10.10.2.191
-A nat-rules -s 192.168.150.192/32 -m comment --comment "NAT Rule #192" -j SNAT --to-source 10.10.2.192
-A nat-rules -s 192.168.150.193/32 -m comment --comment "NAT Rule #193" -j SNAT --to-source 10.10.2.193
-A nat-rules -s 192.168.150.194/32 -m comment --comment "NAT Rule #194" -j SNAT --to-source 10.10.2.194
-A nat-rules -s 192.168.150.195/32 -m comment --comment "NAT Rule #195" -j SNAT --to-source 10.10.2.195
-A nat-rules -s 192.168.150.196/32 -m comment --comment "NAT Rule #196" -j SNAT --to-source 10.10.2.196
-A nat-rules -s 192.168.150.197/32 -m comment --comment "NAT Rule #197" -j SNAT --to-source 10.10.2.197
-A nat-rules -s 192.168.150.198/32 -m comment --comment "NAT Rule #198" -j SNAT --to-source 10.10.2.198
-A nat-rules -s 192.168.150.199/32 -m comment --comment "NAT Rule #199" -j SNAT --to-source 10.10.2.199
-A nat-rules -s 192.168.150.200/32 -m comment --comment "NAT Rule #200" -j SNAT --to-source 10.10.2.200
-A nat-rules -s 192.168.150.201/32 -m comment --comment "NAT Rule #201" -j SNAT --to-source 10.10.2.201
-A nat-rules -s 192.168.150.202/32 -m comment --comment "NAT Rule #202" -j SNAT --to-source 10.10.2.202
-A nat-rules -s 192.168.150.203/32 -m comment --comment "NAT Rule #203" -j SNAT --to-source 10.10.2.203
-A nat-rules -s 192.168.150.204/32 -m comment --comment "NAT Rule #204" -j SNAT --to-source 10.10.2.204
-A nat-rules -s 192.168.150.205/32 -m comment --comment "NAT Rule #205" -j SNAT --to-source 10.10.2.205
-A nat-rules -s 192.168.150.206/32 -m comment --comment "NAT Rule #206" -j SNAT --to-source 10.10.2.206
-A nat-rules -s 192.168.150.207/32 -m comment --comment "NAT Rule #207" -j SNAT --to-source 10.10.2.207
-A nat-rules -s 192.168.150.208/32 -m comment --comment "NAT Rule #208" -j SNAT --to-source 10.10.2.208
-A nat-rules -s 192.168.150.209/32 -m comment --comment "NAT Rule #209" -j SNAT --to-source 10.10.2.209
-A nat-rules -s 192.168.150.210/32 -m comment --comment "NAT Rule #210" -j SNAT --to-source 10.10.2.210
-A nat-rules -s 192.168.150.211/32 -m comment --comment "NAT Rule #211" -j SNAT --to-source 10.10.2.211
-A nat-rules -s 192.168.150.212/32 -m comment --comment "NAT Rule #212" -j SNAT --to-source 10.10.2.212
-A nat-rules -s 192.168.150.213/32 -m comment --comment "NAT Rule #213" -j SNAT --to-source 10.10.2.213
-A nat-rules -s 192.168.150.214/32 -m comment --comment "NAT Rule #214" -j SNAT --to-source 10.10.2.214
-A nat-rules -s 192.168.150.215/32 -m comment --comment "NAT Rule #215" -j SNAT --to-source 10.10.2.215
-A nat-rules -s 192.168.150.216/32 -m comment --comment "NAT Rule #216" -j SNAT --to-source 10.10.2.216
-A nat-rules -s 192.168.150.217/32 -m comment --comment "NAT Rule #217" -j SNAT --to-source 10.10.2.217
-A nat-rules -s 192.168.150.218/32 -m comment --comment "NAT Rule #218" -j SNAT --to-source 10.10.2.218
-A nat-rules -s 192.168.150.219/32 -m comment --comment "NAT Rule #219" -j SNAT --to-source 10.10.2.219
-A nat-rules -s 192.168.150.220/32 -m comment --comment "NAT Rule #220" -j SNAT --to-source 10.10.2.220
-A nat-rules -s 192.168.150.221/32 -m comment --comment "NAT Rule #221" -j SNAT --to-source 10.10.2.221
-A nat-rules -s 192.168.150.222/32 -m comment --comment "NAT Rule #222" -j SNAT --to-source 10.10.2.222
-A nat-rules -s 192.168.150.223/32 -m comment --comment "NAT Rule #223" -j SNAT --to-source 10.10.2.223
-A nat-rules -s 192.168.150.224/32 -m comment --comment "NAT Rule #224" -j SNAT --to-source 10.10.2.224
-A nat-rules -s 192.168.150.225/32 -m comment --comment "NAT Rule #225" -j SNAT --to-source 10.10.2.225
-A nat-rules -s 192.168.150.226/32 -m comment --comment "NAT Rule #226" -j SNAT --to-source 10.10.2.226
-A nat-rules -s 192.168.150.227/32 -m comment --comment "NAT Rule #227" -j SNAT --to-source 10.10.2.227
-A nat-rules -s 192.168.150.228/32 -m comment --comment "NAT Rule #228" -j SNAT --to-source 10.10.2.228
-A nat-rules -s 192.168.150.229/32 -m comment --comment "NAT Rule #229" -j SNAT --to-source 10.10.2.229
-A nat-rules -s 192.168.150.230/32 -m comment --comment "NAT Rule #230" -j SNAT --to-source 10.10.2.230
-A nat-rules -s 192.168.150.231/32 -m comment --comment "NAT Rule #231" -j SNAT --to-source 10.10.2.231
-A nat-rules -s 192.168.150.232/32 -m comment --comment "NAT Rule #232" -j SNAT --to-source 10.10.2.232
-A nat-rules -s 192.168.150.233/32 -m comment --comment "NAT Rule #233" -j SNAT --to-source 10.10.2.233
-A nat-rules -s 192.168.150.234/32 -m comment --comment "NAT Rule #234" -j SNAT --to-source 10.10.2.234
-A nat-rules -s 192.168.150.235/32 -m comment --comment "NAT Rule #235" -j SNAT --to-source 10.10.2.235
-A nat-rules -s 192.168.150.236/32 -m comment --comment "NAT Rule #236" -j SNAT --to-source 10.10.2.236
-A nat-rules -s 192.168.150.237/32 -m comment --comment "NAT Rule #237" -j SNAT --to-source 10.10.2.237
-A nat-rules -s 192.168.150.238/32 -m comment --comment "NAT Rule #238" -j SNAT --to-source 10.10.2.238
-A nat-rules -s 192.168.150.239/32 -m comment --comment "NAT Rule #239" -j SNAT --to-source 10.10.2.239
-A nat-rules -s 192.168.150.240/32 -m comment --comment "NAT Rule #240" -j SNAT --to-source 10.10.2.240
-A nat-rules -s 192.168.150.241/32 -m comment --comment "NAT Rule #241" -j SNAT --to-source 10.10.2.241
-A nat-rules -s 192.168.150.242/32 -m comment --comment "NAT Rule #242" -j SNAT --to-source 10.10.2.242
-A nat-rules -s 192.168.150.243/32 -m comment --comment "NAT Rule #243" -j SNAT --to-source 10.10.2.243
-A nat-rules -s 192.168.150.244/32 -m comment --comment "NAT Rule #244" -j SNAT --to-source 10.10.2.244
-A nat-rules -s 192.168.150.245/32 -m comment --comment "NAT Rule #245" -j SNAT --to-source 10.10.2.245
-A nat-rules -s 192.168.150.246/32 -m comment --comment "NAT Rule #246" -j SNAT --to-source 10.10.2.246
-A nat-rules -s 192.168.150.247/32 -m comment --comment "NAT Rule #247" -j SNAT --to-source 10.10.2.247
-A nat-rules -s 192.168.150.248/32 -m comment --comment "NAT Rule #248" -j SNAT --to-source 10.10.2.248
-A nat-rules -s 192.168.150.249/32 -m comment --comment "NAT Rule #249" -j SNAT --to-source 10.10.2.249
-A nat-rules -s 192.168.150.250/32 -m comment --comment "NAT Rule #250" -j SNAT --to-source 10.10.2.250
-A nat-rules -s 192.168.150.251/32 -m comment --comment "NAT Rule #251" -j SNAT --to-source 10.10.2.251
-A nat-rules -s 192.168.150.252/32 -m comment --comment "NAT Rule #252" -j SNAT --to-source 10.10.2.252
-A nat-rules -s 192.168.150.253/32 -m comment --comment "NAT Rule #253" -j SNAT --to-source 10.10.2.253
-A nat-rules -s 192.168.150.254/32 -m comment --comment "NAT Rule #254" -j SNAT --to-source 10.10.2.254
-A nat-rules -m connmark --mark 0x102/0xffff -m comment --comment "NAT traffic, 2 -> 1 (egress setting)" -j MASQUERADE
-A nat-rules -m conntrack --ctstate DNAT -m connmark --mark 0x101/0xffff -m comment --comment "NAT all port forwards (hairpin) (interface 1)" -j MASQUERADE
-A nat-rules -m conntrack --ctstate DNAT -m connmark --mark 0x202/0xffff -m comment --comment "NAT all port forwards (hairpin) (interface 2)" -j MASQUERADE
-A port-forward-rules -m comment --comment "Port forward jump for L2TP" -j l2tp-forward-rules
-A port-forward-rules -d 192.168.150.1/32 -p tcp -m tcp --dport 80 -m comment --comment "Send 192.168.150.1:80 to Apache" -j DNAT --to-destination 192.168.150.1:80
-A port-forward-rules -d 192.168.150.1/32 -p tcp -m tcp --dport 443 -m comment --comment "Send 192.168.150.1:443 to Apache" -j DNAT --to-destination 192.168.150.1:443
-A port-forward-rules -d 10.47.2.2/32 -p tcp -m tcp --dport 443 -m comment --comment "Send 10.47.2.2:443 to Apache" -j DNAT --to-destination 10.47.2.2:443
-A port-forward-rules -d 10.10.2.1/32 -m comment --comment "Port Forward Rule #1" -j DNAT --to-destination 192.168.150.1
-A port-forward-rules -d 10.10.2.2/32 -m comment --comment "Port Forward Rule #2" -j DNAT --to-destination 192.168.150.2
-A port-forward-rules -d 10.10.2.3/32 -m comment --comment "Port Forward Rule #3" -j DNAT --to-destination 192.168.150.3
-A port-forward-rules -d 10.10.2.4/32 -m comment --comment "Port Forward Rule #4" -j DNAT --to-destination 192.168.150.4
-A port-forward-rules -d 10.10.2.5/32 -m comment --comment "Port Forward Rule #5" -j DNAT --to-destination 192.168.150.5
-A port-forward-rules -d 10.10.2.6/32 -m comment --comment "Port Forward Rule #6" -j DNAT --to-destination 192.168.150.6
-A port-forward-rules -d 10.10.2.7/32 -m comment --comment "Port Forward Rule #7" -j DNAT --to-destination 192.168.150.7
-A port-forward-rules -d 10.10.2.8/32 -m comment --comment "Port Forward Rule #8" -j DNAT --to-destination 192.168.150.8
-A port-forward-rules -d 10.10.2.9/32 -m comment --comment "Port Forward Rule #9" -j DNAT --to-destination 192.168.150.9
-A port-forward-rules -d 10.10.2.10/32 -m comment --comment "Port Forward Rule #10" -j DNAT --to-destination 192.168.150.10
-A port-forward-rules -d 10.10.2.11/32 -m comment --comment "Port Forward Rule #11" -j DNAT --to-destination 192.168.150.11
-A port-forward-rules -d 10.10.2.12/32 -m comment --comment "Port Forward Rule #12" -j DNAT --to-destination 192.168.150.12
-A port-forward-rules -d 10.10.2.13/32 -m comment --comment "Port Forward Rule #13" -j DNAT --to-destination 192.168.150.13
-A port-forward-rules -d 10.10.2.14/32 -m comment --comment "Port Forward Rule #14" -j DNAT --to-destination 192.168.150.14
-A port-forward-rules -d 10.10.2.15/32 -m comment --comment "Port Forward Rule #15" -j DNAT --to-destination 192.168.150.15
-A port-forward-rules -d 10.10.2.16/32 -m comment --comment "Port Forward Rule #16" -j DNAT --to-destination 192.168.150.16
-A port-forward-rules -d 10.10.2.17/32 -m comment --comment "Port Forward Rule #17" -j DNAT --to-destination 192.168.150.17
-A port-forward-rules -d 10.10.2.18/32 -m comment --comment "Port Forward Rule #18" -j DNAT --to-destination 192.168.150.18
-A port-forward-rules -d 10.10.2.19/32 -m comment --comment "Port Forward Rule #19" -j DNAT --to-destination 192.168.150.19
-A port-forward-rules -d 10.10.2.20/32 -m comment --comment "Port Forward Rule #20" -j DNAT --to-destination 192.168.150.20
-A port-forward-rules -d 10.10.2.21/32 -m comment --comment "Port Forward Rule #21" -j DNAT --to-destination 192.168.150.21
-A port-forward-rules -d 10.10.2.22/32 -m comment --comment "Port Forward Rule #22" -j DNAT --to-destination 192.168.150.22
-A port-forward-rules -d 10.10.2.23/32 -m comment --comment "Port Forward Rule #23" -j DNAT --to-destination 192.168.150.23
-A port-forward-rules -d 10.10.2.24/32 -m comment --comment "Port Forward Rule #24" -j DNAT --to-destination 192.168.150.24
-A port-forward-rules -d 10.10.2.25/32 -m comment --comment "Port Forward Rule #25" -j DNAT --to-destination 192.168.150.25
-A port-forward-rules -d 10.10.2.26/32 -m comment --comment "Port Forward Rule #26" -j DNAT --to-destination 192.168.150.26
-A port-forward-rules -d 10.10.2.27/32 -m comment --comment "Port Forward Rule #27" -j DNAT --to-destination 192.168.150.27
-A port-forward-rules -d 10.10.2.28/32 -m comment --comment "Port Forward Rule #28" -j DNAT --to-destination 192.168.150.28
-A port-forward-rules -d 10.10.2.29/32 -m comment --comment "Port Forward Rule #29" -j DNAT --to-destination 192.168.150.29
-A port-forward-rules -d 10.10.2.30/32 -m comment --comment "Port Forward Rule #30" -j DNAT --to-destination 192.168.150.30
-A port-forward-rules -d 10.10.2.31/32 -m comment --comment "Port Forward Rule #31" -j DNAT --to-destination 192.168.150.31
-A port-forward-rules -d 10.10.2.32/32 -m comment --comment "Port Forward Rule #32" -j DNAT --to-destination 192.168.150.32
-A port-forward-rules -d 10.10.2.33/32 -m comment --comment "Port Forward Rule #33" -j DNAT --to-destination 192.168.150.33
-A port-forward-rules -d 10.10.2.34/32 -m comment --comment "Port Forward Rule #34" -j DNAT --to-destination 192.168.150.34
-A port-forward-rules -d 10.10.2.35/32 -m comment --comment "Port Forward Rule #35" -j DNAT --to-destination 192.168.150.35
-A port-forward-rules -d 10.10.2.36/32 -m comment --comment "Port Forward Rule #36" -j DNAT --to-destination 192.168.150.36
-A port-forward-rules -d 10.10.2.37/32 -m comment --comment "Port Forward Rule #37" -j DNAT --to-destination 192.168.150.37
-A port-forward-rules -d 10.10.2.38/32 -m comment --comment "Port Forward Rule #38" -j DNAT --to-destination 192.168.150.38
-A port-forward-rules -d 10.10.2.39/32 -m comment --comment "Port Forward Rule #39" -j DNAT --to-destination 192.168.150.39
-A port-forward-rules -d 10.10.2.40/32 -m comment --comment "Port Forward Rule #40" -j DNAT --to-destination 192.168.150.40
-A port-forward-rules -d 10.10.2.41/32 -m comment --comment "Port Forward Rule #41" -j DNAT --to-destination 192.168.150.41
-A port-forward-rules -d 10.10.2.42/32 -m comment --comment "Port Forward Rule #42" -j DNAT --to-destination 192.168.150.42
-A port-forward-rules -d 10.10.2.43/32 -m comment --comment "Port Forward Rule #43" -j DNAT --to-destination 192.168.150.43
-A port-forward-rules -d 10.10.2.44/32 -m comment --comment "Port Forward Rule #44" -j DNAT --to-destination 192.168.150.44
-A port-forward-rules -d 10.10.2.45/32 -m comment --comment "Port Forward Rule #45" -j DNAT --to-destination 192.168.150.45
-A port-forward-rules -d 10.10.2.46/32 -m comment --comment "Port Forward Rule #46" -j DNAT --to-destination 192.168.150.46
-A port-forward-rules -d 10.10.2.47/32 -m comment --comment "Port Forward Rule #47" -j DNAT --to-destination 192.168.150.47
-A port-forward-rules -d 10.10.2.48/32 -m comment --comment "Port Forward Rule #48" -j DNAT --to-destination 192.168.150.48
-A port-forward-rules -d 10.10.2.49/32 -m comment --comment "Port Forward Rule #49" -j DNAT --to-destination 192.168.150.49
-A port-forward-rules -d 10.10.2.50/32 -m comment --comment "Port Forward Rule #50" -j DNAT --to-destination 192.168.150.50
-A port-forward-rules -d 10.10.2.51/32 -m comment --comment "Port Forward Rule #51" -j DNAT --to-destination 192.168.150.51
-A port-forward-rules -d 10.10.2.52/32 -m comment --comment "Port Forward Rule #52" -j DNAT --to-destination 192.168.150.52
-A port-forward-rules -d 10.10.2.53/32 -m comment --comment "Port Forward Rule #53" -j DNAT --to-destination 192.168.150.53
-A port-forward-rules -d 10.10.2.54/32 -m comment --comment "Port Forward Rule #54" -j DNAT --to-destination 192.168.150.54
-A port-forward-rules -d 10.10.2.55/32 -m comment --comment "Port Forward Rule #55" -j DNAT --to-destination 192.168.150.55
-A port-forward-rules -d 10.10.2.56/32 -m comment --comment "Port Forward Rule #56" -j DNAT --to-destination 192.168.150.56
-A port-forward-rules -d 10.10.2.57/32 -m comment --comment "Port Forward Rule #57" -j DNAT --to-destination 192.168.150.57
-A port-forward-rules -d 10.10.2.58/32 -m comment --comment "Port Forward Rule #58" -j DNAT --to-destination 192.168.150.58
-A port-forward-rules -d 10.10.2.59/32 -m comment --comment "Port Forward Rule #59" -j DNAT --to-destination 192.168.150.59
-A port-forward-rules -d 10.10.2.60/32 -m comment --comment "Port Forward Rule #60" -j DNAT --to-destination 192.168.150.60
-A port-forward-rules -d 10.10.2.61/32 -m comment --comment "Port Forward Rule #61" -j DNAT --to-destination 192.168.150.61
-A port-forward-rules -d 10.10.2.62/32 -m comment --comment "Port Forward Rule #62" -j DNAT --to-destination 192.168.150.62
-A port-forward-rules -d 10.10.2.63/32 -m comment --comment "Port Forward Rule #63" -j DNAT --to-destination 192.168.150.63
-A port-forward-rules -d 10.10.2.64/32 -m comment --comment "Port Forward Rule #64" -j DNAT --to-destination 192.168.150.64
-A port-forward-rules -d 10.10.2.65/32 -m comment --comment "Port Forward Rule #65" -j DNAT --to-destination 192.168.150.65
-A port-forward-rules -d 10.10.2.66/32 -m comment --comment "Port Forward Rule #66" -j DNAT --to-destination 192.168.150.66
-A port-forward-rules -d 10.10.2.67/32 -m comment --comment "Port Forward Rule #67" -j DNAT --to-destination 192.168.150.67
-A port-forward-rules -d 10.10.2.68/32 -m comment --comment "Port Forward Rule #68" -j DNAT --to-destination 192.168.150.68
-A port-forward-rules -d 10.10.2.69/32 -m comment --comment "Port Forward Rule #69" -j DNAT --to-destination 192.168.150.69
-A port-forward-rules -d 10.10.2.70/32 -m comment --comment "Port Forward Rule #70" -j DNAT --to-destination 192.168.150.70
-A port-forward-rules -d 10.10.2.71/32 -m comment --comment "Port Forward Rule #71" -j DNAT --to-destination 192.168.150.71
-A port-forward-rules -d 10.10.2.72/32 -m comment --comment "Port Forward Rule #72" -j DNAT --to-destination 192.168.150.72
-A port-forward-rules -d 10.10.2.73/32 -m comment --comment "Port Forward Rule #73" -j DNAT --to-destination 192.168.150.73
-A port-forward-rules -d 10.10.2.74/32 -m comment --comment "Port Forward Rule #74" -j DNAT --to-destination 192.168.150.74
-A port-forward-rules -d 10.10.2.75/32 -m comment --comment "Port Forward Rule #75" -j DNAT --to-destination 192.168.150.75
-A port-forward-rules -d 10.10.2.76/32 -m comment --comment "Port Forward Rule #76" -j DNAT --to-destination 192.168.150.76
-A port-forward-rules -d 10.10.2.77/32 -m comment --comment "Port Forward Rule #77" -j DNAT --to-destination 192.168.150.77
-A port-forward-rules -d 10.10.2.78/32 -m comment --comment "Port Forward Rule #78" -j DNAT --to-destination 192.168.150.78
-A port-forward-rules -d 10.10.2.79/32 -m comment --comment "Port Forward Rule #79" -j DNAT --to-destination 192.168.150.79
-A port-forward-rules -d 10.10.2.80/32 -m comment --comment "Port Forward Rule #80" -j DNAT --to-destination 192.168.150.80
-A port-forward-rules -d 10.10.2.81/32 -m comment --comment "Port Forward Rule #81" -j DNAT --to-destination 192.168.150.81
-A port-forward-rules -d 10.10.2.82/32 -m comment --comment "Port Forward Rule #82" -j DNAT --to-destination 192.168.150.82
-A port-forward-rules -d 10.10.2.83/32 -m comment --comment "Port Forward Rule #83" -j DNAT --to-destination 192.168.150.83
-A port-forward-rules -d 10.10.2.84/32 -m comment --comment "Port Forward Rule #84" -j DNAT --to-destination 192.168.150.84
-A port-forward-rules -d 10.10.2.85/32 -m comment --comment "Port Forward Rule #85" -j DNAT --to-destination 192.168.150.85
-A port-forward-rules -d 10.10.2.86/32 -m comment --comment "Port Forward Rule #86" -j DNAT --to-destination 192.168.150.86
-A port-forward-rules -d 10.10.2.87/32 -m comment --comment "Port Forward Rule #87" -j DNAT --to-destination 192.168.150.87
-A port-forward-rules -d 10.10.2.88/32 -m comment --comment "Port Forward Rule #88" -j DNAT --to-destination 192.168.150.88
-A port-forward-rules -d 10.10.2.89/32 -m comment --comment "Port Forward Rule #89" -j DNAT --to-destination 192.168.150.89
-A port-forward-rules -d 10.10.2.90/32 -m comment --comment "Port Forward Rule #90" -j DNAT --to-destination 192.168.150.90
-A port-forward-rules -d 10.10.2.91/32 -m comment --comment "Port Forward Rule #91" -j DNAT --to-destination 192.168.150.91
-A port-forward-rules -d 10.10.2.92/32 -m comment --comment "Port Forward Rule #92" -j DNAT --to-destination 192.168.150.92
-A port-forward-rules -d 10.10.2.93/32 -m comment --comment "Port Forward Rule #93" -j DNAT --to-destination 192.168.150.93
-A port-forward-rules -d 10.10.2.94/32 -m comment --comment "Port Forward Rule #94" -j DNAT --to-destination 192.168.150.94
-A port-forward-rules -d 10.10.2.95/32 -m comment --comment "Port Forward Rule #95" -j DNAT --to-destination 192.168.150.95
-A port-forward-rules -d 10.10.2.96/32 -m comment --comment "Port Forward Rule #96" -j DNAT --to-destination 192.168.150.96
-A port-forward-rules -d 10.10.2.97/32 -m comment --comment "Port Forward Rule #97" -j DNAT --to-destination 192.168.150.97
-A port-forward-rules -d 10.10.2.98/32 -m comment --comment "Port Forward Rule #98" -j DNAT --to-destination 192.168.150.98
-A port-forward-rules -d 10.10.2.99/32 -m comment --comment "Port Forward Rule #99" -j DNAT --to-destination 192.168.150.99
-A port-forward-rules -d 10.10.2.100/32 -m comment --comment "Port Forward Rule #100" -j DNAT --to-destination 192.168.150.100
-A port-forward-rules -d 10.10.2.101/32 -m comment --comment "Port Forward Rule #101" -j DNAT --to-destination 192.168.150.101
-A port-forward-rules -d 10.10.2.102/32 -m comment --comment "Port Forward Rule #102" -j DNAT --to-destination 192.168.150.102
-A port-forward-rules -d 10.10.2.103/32 -m comment --comment "Port Forward Rule #103" -j DNAT --to-destination 192.168.150.103
-A port-forward-rules -d 10.10.2.104/32 -m comment --comment "Port Forward Rule #104" -j DNAT --to-destination 192.168.150.104
-A port-forward-rules -d 10.10.2.105/32 -m comment --comment "Port Forward Rule #105" -j DNAT --to-destination 192.168.150.105
-A port-forward-rules -d 10.10.2.106/32 -m comment --comment "Port Forward Rule #106" -j DNAT --to-destination 192.168.150.106
-A port-forward-rules -d 10.10.2.107/32 -m comment --comment "Port Forward Rule #107" -j DNAT --to-destination 192.168.150.107
-A port-forward-rules -d 10.10.2.108/32 -m comment --comment "Port Forward Rule #108" -j DNAT --to-destination 192.168.150.108
-A port-forward-rules -d 10.10.2.109/32 -m comment --comment "Port Forward Rule #109" -j DNAT --to-destination 192.168.150.109
-A port-forward-rules -d 10.10.2.110/32 -m comment --comment "Port Forward Rule #110" -j DNAT --to-destination 192.168.150.110
-A port-forward-rules -d 10.10.2.111/32 -m comment --comment "Port Forward Rule #111" -j DNAT --to-destination 192.168.150.111
-A port-forward-rules -d 10.10.2.112/32 -m comment --comment "Port Forward Rule #112" -j DNAT --to-destination 192.168.150.112
-A port-forward-rules -d 10.10.2.113/32 -m comment --comment "Port Forward Rule #113" -j DNAT --to-destination 192.168.150.113
-A port-forward-rules -d 10.10.2.114/32 -m comment --comment "Port Forward Rule #114" -j DNAT --to-destination 192.168.150.114
-A port-forward-rules -d 10.10.2.115/32 -m comment --comment "Port Forward Rule #115" -j DNAT --to-destination 192.168.150.115
-A port-forward-rules -d 10.10.2.116/32 -m comment --comment "Port Forward Rule #116" -j DNAT --to-destination 192.168.150.116
-A port-forward-rules -d 10.10.2.117/32 -m comment --comment "Port Forward Rule #117" -j DNAT --to-destination 192.168.150.117
-A port-forward-rules -d 10.10.2.118/32 -m comment --comment "Port Forward Rule #118" -j DNAT --to-destination 192.168.150.118
-A port-forward-rules -d 10.10.2.119/32 -m comment --comment "Port Forward Rule #119" -j DNAT --to-destination 192.168.150.119
-A port-forward-rules -d 10.10.2.120/32 -m comment --comment "Port Forward Rule #120" -j DNAT --to-destination 192.168.150.120
-A port-forward-rules -d 10.10.2.121/32 -m comment --comment "Port Forward Rule #121" -j DNAT --to-destination 192.168.150.121
-A port-forward-rules -d 10.10.2.122/32 -m comment --comment "Port Forward Rule #122" -j DNAT --to-destination 192.168.150.122
-A port-forward-rules -d 10.10.2.123/32 -m comment --comment "Port Forward Rule #123" -j DNAT --to-destination 192.168.150.123
-A port-forward-rules -d 10.10.2.124/32 -m comment --comment "Port Forward Rule #124" -j DNAT --to-destination 192.168.150.124
-A port-forward-rules -d 10.10.2.125/32 -m comment --comment "Port Forward Rule #125" -j DNAT --to-destination 192.168.150.125
-A port-forward-rules -d 10.10.2.126/32 -m comment --comment "Port Forward Rule #126" -j DNAT --to-destination 192.168.150.126
-A port-forward-rules -d 10.10.2.127/32 -m comment --comment "Port Forward Rule #127" -j DNAT --to-destination 192.168.150.127
-A port-forward-rules -d 10.10.2.128/32 -m comment --comment "Port Forward Rule #128" -j DNAT --to-destination 192.168.150.128
-A port-forward-rules -d 10.10.2.129/32 -m comment --comment "Port Forward Rule #129" -j DNAT --to-destination 192.168.150.129
-A port-forward-rules -d 10.10.2.130/32 -m comment --comment "Port Forward Rule #130" -j DNAT --to-destination 192.168.150.130
-A port-forward-rules -d 10.10.2.131/32 -m comment --comment "Port Forward Rule #131" -j DNAT --to-destination 192.168.150.131
-A port-forward-rules -d 10.10.2.132/32 -m comment --comment "Port Forward Rule #132" -j DNAT --to-destination 192.168.150.132
-A port-forward-rules -d 10.10.2.133/32 -m comment --comment "Port Forward Rule #133" -j DNAT --to-destination 192.168.150.133
-A port-forward-rules -d 10.10.2.134/32 -m comment --comment "Port Forward Rule #134" -j DNAT --to-destination 192.168.150.134
-A port-forward-rules -d 10.10.2.135/32 -m comment --comment "Port Forward Rule #135" -j DNAT --to-destination 192.168.150.135
-A port-forward-rules -d 10.10.2.136/32 -m comment --comment "Port Forward Rule #136" -j DNAT --to-destination 192.168.150.136
-A port-forward-rules -d 10.10.2.137/32 -m comment --comment "Port Forward Rule #137" -j DNAT --to-destination 192.168.150.137
-A port-forward-rules -d 10.10.2.138/32 -m comment --comment "Port Forward Rule #138" -j DNAT --to-destination 192.168.150.138
-A port-forward-rules -d 10.10.2.139/32 -m comment --comment "Port Forward Rule #139" -j DNAT --to-destination 192.168.150.139
-A port-forward-rules -d 10.10.2.140/32 -m comment --comment "Port Forward Rule #140" -j DNAT --to-destination 192.168.150.140
-A port-forward-rules -d 10.10.2.141/32 -m comment --comment "Port Forward Rule #141" -j DNAT --to-destination 192.168.150.141
-A port-forward-rules -d 10.10.2.142/32 -m comment --comment "Port Forward Rule #142" -j DNAT --to-destination 192.168.150.142
-A port-forward-rules -d 10.10.2.143/32 -m comment --comment "Port Forward Rule #143" -j DNAT --to-destination 192.168.150.143
-A port-forward-rules -d 10.10.2.144/32 -m comment --comment "Port Forward Rule #144" -j DNAT --to-destination 192.168.150.144
-A port-forward-rules -d 10.10.2.145/32 -m comment --comment "Port Forward Rule #145" -j DNAT --to-destination 192.168.150.145
-A port-forward-rules -d 10.10.2.146/32 -m comment --comment "Port Forward Rule #146" -j DNAT --to-destination 192.168.150.146
-A port-forward-rules -d 10.10.2.147/32 -m comment --comment "Port Forward Rule #147" -j DNAT --to-destination 192.168.150.147
-A port-forward-rules -d 10.10.2.148/32 -m comment --comment "Port Forward Rule #148" -j DNAT --to-destination 192.168.150.148
-A port-forward-rules -d 10.10.2.149/32 -m comment --comment "Port Forward Rule #149" -j DNAT --to-destination 192.168.150.149
-A port-forward-rules -d 10.10.2.150/32 -m comment --comment "Port Forward Rule #150" -j DNAT --to-destination 192.168.150.150
-A port-forward-rules -d 10.10.2.151/32 -m comment --comment "Port Forward Rule #151" -j DNAT --to-destination 192.168.150.151
-A port-forward-rules -d 10.10.2.152/32 -m comment --comment "Port Forward Rule #152" -j DNAT --to-destination 192.168.150.152
-A port-forward-rules -d 10.10.2.153/32 -m comment --comment "Port Forward Rule #153" -j DNAT --to-destination 192.168.150.153
-A port-forward-rules -d 10.10.2.154/32 -m comment --comment "Port Forward Rule #154" -j DNAT --to-destination 192.168.150.154
-A port-forward-rules -d 10.10.2.155/32 -m comment --comment "Port Forward Rule #155" -j DNAT --to-destination 192.168.150.155
-A port-forward-rules -d 10.10.2.156/32 -m comment --comment "Port Forward Rule #156" -j DNAT --to-destination 192.168.150.156
-A port-forward-rules -d 10.10.2.157/32 -m comment --comment "Port Forward Rule #157" -j DNAT --to-destination 192.168.150.157
-A port-forward-rules -d 10.10.2.158/32 -m comment --comment "Port Forward Rule #158" -j DNAT --to-destination 192.168.150.158
-A port-forward-rules -d 10.10.2.159/32 -m comment --comment "Port Forward Rule #159" -j DNAT --to-destination 192.168.150.159
-A port-forward-rules -d 10.10.2.160/32 -m comment --comment "Port Forward Rule #160" -j DNAT --to-destination 192.168.150.160
-A port-forward-rules -d 10.10.2.161/32 -m comment --comment "Port Forward Rule #161" -j DNAT --to-destination 192.168.150.161
-A port-forward-rules -d 10.10.2.162/32 -m comment --comment "Port Forward Rule #162" -j DNAT --to-destination 192.168.150.162
-A port-forward-rules -d 10.10.2.163/32 -m comment --comment "Port Forward Rule #163" -j DNAT --to-destination 192.168.150.163
-A port-forward-rules -d 10.10.2.164/32 -m comment --comment "Port Forward Rule #164" -j DNAT --to-destination 192.168.150.164
-A port-forward-rules -d 10.10.2.165/32 -m comment --comment "Port Forward Rule #165" -j DNAT --to-destination 192.168.150.165
-A port-forward-rules -d 10.10.2.166/32 -m comment --comment "Port Forward Rule #166" -j DNAT --to-destination 192.168.150.166
-A port-forward-rules -d 10.10.2.167/32 -m comment --comment "Port Forward Rule #167" -j DNAT --to-destination 192.168.150.167
-A port-forward-rules -d 10.10.2.168/32 -m comment --comment "Port Forward Rule #168" -j DNAT --to-destination 192.168.150.168
-A port-forward-rules -d 10.10.2.169/32 -m comment --comment "Port Forward Rule #169" -j DNAT --to-destination 192.168.150.169
-A port-forward-rules -d 10.10.2.170/32 -m comment --comment "Port Forward Rule #170" -j DNAT --to-destination 192.168.150.170
-A port-forward-rules -d 10.10.2.171/32 -m comment --comment "Port Forward Rule #171" -j DNAT --to-destination 192.168.150.171
-A port-forward-rules -d 10.10.2.172/32 -m comment --comment "Port Forward Rule #172" -j DNAT --to-destination 192.168.150.172
-A port-forward-rules -d 10.10.2.173/32 -m comment --comment "Port Forward Rule #173" -j DNAT --to-destination 192.168.150.173
-A port-forward-rules -d 10.10.2.174/32 -m comment --comment "Port Forward Rule #174" -j DNAT --to-destination 192.168.150.174
-A port-forward-rules -d 10.10.2.175/32 -m comment --comment "Port Forward Rule #175" -j DNAT --to-destination 192.168.150.175
-A port-forward-rules -d 10.10.2.176/32 -m comment --comment "Port Forward Rule #176" -j DNAT --to-destination 192.168.150.176
-A port-forward-rules -d 10.10.2.177/32 -m comment --comment "Port Forward Rule #177" -j DNAT --to-destination 192.168.150.177
-A port-forward-rules -d 10.10.2.178/32 -m comment --comment "Port Forward Rule #178" -j DNAT --to-destination 192.168.150.178
-A port-forward-rules -d 10.10.2.179/32 -m comment --comment "Port Forward Rule #179" -j DNAT --to-destination 192.168.150.179
-A port-forward-rules -d 10.10.2.180/32 -m comment --comment "Port Forward Rule #180" -j DNAT --to-destination 192.168.150.180
-A port-forward-rules -d 10.10.2.181/32 -m comment --comment "Port Forward Rule #181" -j DNAT --to-destination 192.168.150.181
-A port-forward-rules -d 10.10.2.182/32 -m comment --comment "Port Forward Rule #182" -j DNAT --to-destination 192.168.150.182
-A port-forward-rules -d 10.10.2.183/32 -m comment --comment "Port Forward Rule #183" -j DNAT --to-destination 192.168.150.183
-A port-forward-rules -d 10.10.2.184/32 -m comment --comment "Port Forward Rule #184" -j DNAT --to-destination 192.168.150.184
-A port-forward-rules -d 10.10.2.185/32 -m comment --comment "Port Forward Rule #185" -j DNAT --to-destination 192.168.150.185
-A port-forward-rules -d 10.10.2.186/32 -m comment --comment "Port Forward Rule #186" -j DNAT --to-destination 192.168.150.186
-A port-forward-rules -d 10.10.2.187/32 -m comment --comment "Port Forward Rule #187" -j DNAT --to-destination 192.168.150.187
-A port-forward-rules -d 10.10.2.188/32 -m comment --comment "Port Forward Rule #188" -j DNAT --to-destination 192.168.150.188
-A port-forward-rules -d 10.10.2.189/32 -m comment --comment "Port Forward Rule #189" -j DNAT --to-destination 192.168.150.189
-A port-forward-rules -d 10.10.2.190/32 -m comment --comment "Port Forward Rule #190" -j DNAT --to-destination 192.168.150.190
-A port-forward-rules -d 10.10.2.191/32 -m comment --comment "Port Forward Rule #191" -j DNAT --to-destination 192.168.150.191
-A port-forward-rules -d 10.10.2.192/32 -m comment --comment "Port Forward Rule #192" -j DNAT --to-destination 192.168.150.192
-A port-forward-rules -d 10.10.2.193/32 -m comment --comment "Port Forward Rule #193" -j DNAT --to-destination 192.168.150.193
-A port-forward-rules -d 10.10.2.194/32 -m comment --comment "Port Forward Rule #194" -j DNAT --to-destination 192.168.150.194
-A port-forward-rules -d 10.10.2.195/32 -m comment --comment "Port Forward Rule #195" -j DNAT --to-destination 192.168.150.195
-A port-forward-rules -d 10.10.2.196/32 -m comment --comment "Port Forward Rule #196" -j DNAT --to-destination 192.168.150.196
-A port-forward-rules -d 10.10.2.197/32 -m comment --comment "Port Forward Rule #197" -j DNAT --to-destination 192.168.150.197
-A port-forward-rules -d 10.10.2.198/32 -m comment --comment "Port Forward Rule #198" -j DNAT --to-destination 192.168.150.198
-A port-forward-rules -d 10.10.2.199/32 -m comment --comment "Port Forward Rule #199" -j DNAT --to-destination 192.168.150.199
-A port-forward-rules -d 10.10.2.200/32 -m comment --comment "Port Forward Rule #200" -j DNAT --to-destination 192.168.150.200
-A port-forward-rules -d 10.10.2.201/32 -m comment --comment "Port Forward Rule #201" -j DNAT --to-destination 192.168.150.201
-A port-forward-rules -d 10.10.2.202/32 -m comment --comment "Port Forward Rule #202" -j DNAT --to-destination 192.168.150.202
-A port-forward-rules -d 10.10.2.203/32 -m comment --comment "Port Forward Rule #203" -j DNAT --to-destination 192.168.150.203
-A port-forward-rules -d 10.10.2.204/32 -m comment --comment "Port Forward Rule #204" -j DNAT --to-destination 192.168.150.204
-A port-forward-rules -d 10.10.2.205/32 -m comment --comment "Port Forward Rule #205" -j DNAT --to-destination 192.168.150.205
-A port-forward-rules -d 10.10.2.206/32 -m comment --comment "Port Forward Rule #206" -j DNAT --to-destination 192.168.150.206
-A port-forward-rules -d 10.10.2.207/32 -m comment --comment "Port Forward Rule #207" -j DNAT --to-destination 192.168.150.207
-A port-forward-rules -d 10.10.2.208/32 -m comment --comment "Port Forward Rule #208" -j DNAT --to-destination 192.168.150.208
-A port-forward-rules -d 10.10.2.209/32 -m comment --comment "Port Forward Rule #209" -j DNAT --to-destination 192.168.150.209
-A port-forward-rules -d 10.10.2.210/32 -m comment --comment "Port Forward Rule #210" -j DNAT --to-destination 192.168.150.210
-A port-forward-rules -d 10.10.2.211/32 -m comment --comment "Port Forward Rule #211" -j DNAT --to-destination 192.168.150.211
-A port-forward-rules -d 10.10.2.212/32 -m comment --comment "Port Forward Rule #212" -j DNAT --to-destination 192.168.150.212
-A port-forward-rules -d 10.10.2.213/32 -m comment --comment "Port Forward Rule #213" -j DNAT --to-destination 192.168.150.213
-A port-forward-rules -d 10.10.2.214/32 -m comment --comment "Port Forward Rule #214" -j DNAT --to-destination 192.168.150.214
-A port-forward-rules -d 10.10.2.215/32 -m comment --comment "Port Forward Rule #215" -j DNAT --to-destination 192.168.150.215
-A port-forward-rules -d 10.10.2.216/32 -m comment --comment "Port Forward Rule #216" -j DNAT --to-destination 192.168.150.216
-A port-forward-rules -d 10.10.2.217/32 -m comment --comment "Port Forward Rule #217" -j DNAT --to-destination 192.168.150.217
-A port-forward-rules -d 10.10.2.218/32 -m comment --comment "Port Forward Rule #218" -j DNAT --to-destination 192.168.150.218
-A port-forward-rules -d 10.10.2.219/32 -m comment --comment "Port Forward Rule #219" -j DNAT --to-destination 192.168.150.219
-A port-forward-rules -d 10.10.2.220/32 -m comment --comment "Port Forward Rule #220" -j DNAT --to-destination 192.168.150.220
-A port-forward-rules -d 10.10.2.221/32 -m comment --comment "Port Forward Rule #221" -j DNAT --to-destination 192.168.150.221
-A port-forward-rules -d 10.10.2.222/32 -m comment --comment "Port Forward Rule #222" -j DNAT --to-destination 192.168.150.222
-A port-forward-rules -d 10.10.2.223/32 -m comment --comment "Port Forward Rule #223" -j DNAT --to-destination 192.168.150.223
-A port-forward-rules -d 10.10.2.224/32 -m comment --comment "Port Forward Rule #224" -j DNAT --to-destination 192.168.150.224
-A port-forward-rules -d 10.10.2.225/32 -m comment --comment "Port Forward Rule #225" -j DNAT --to-destination 192.168.150.225
-A port-forward-rules -d 10.10.2.226/32 -m comment --comment "Port Forward Rule #226" -j DNAT --to-destination 192.168.150.226
-A port-forward-rules -d 10.10.2.227/32 -m comment --comment "Port Forward Rule #227" -j DNAT --to-destination 192.168.150.227
-A port-forward-rules -d 10.10.2.228/32 -m comment --comment "Port Forward Rule #228" -j DNAT --to-destination 192.168.150.228
-A port-forward-rules -d 10.10.2.229/32 -m comment --comment "Port Forward Rule #229" -j DNAT --to-destination 192.168.150.229
-A port-forward-rules -d 10.10.2.230/32 -m comment --comment "Port Forward Rule #230" -j DNAT --to-destination 192.168.150.230
-A port-forward-rules -d 10.10.2.231/32 -m comment --comment "Port Forward Rule #231" -j DNAT --to-destination 192.168.150.231
-A port-forward-rules -d 10.10.2.232/32 -m comment --comment "Port Forward Rule #232" -j DNAT --to-destination 192.168.150.232
-A port-forward-rules -d 10.10.2.233/32 -m comment --comment "Port Forward Rule #233" -j DNAT --to-destination 192.168.150.233
-A port-forward-rules -d 10.10.2.234/32 -m comment --comment "Port Forward Rule #234" -j DNAT --to-destination 192.168.150.234
-A port-forward-rules -d 10.10.2.235/32 -m comment --comment "Port Forward Rule #235" -j DNAT --to-destination 192.168.150.235
-A port-forward-rules -d 10.10.2.236/32 -m comment --comment "Port Forward Rule #236" -j DNAT --to-destination 192.168.150.236
-A port-forward-rules -d 10.10.2.237/32 -m comment --comment "Port Forward Rule #237" -j DNAT --to-destination 192.168.150.237
-A port-forward-rules -d 10.10.2.238/32 -m comment --comment "Port Forward Rule #238" -j DNAT --to-destination 192.168.150.238
-A port-forward-rules -d 10.10.2.239/32 -m comment --comment "Port Forward Rule #239" -j DNAT --to-destination 192.168.150.239
-A port-forward-rules -d 10.10.2.240/32 -m comment --comment "Port Forward Rule #240" -j DNAT --to-destination 192.168.150.240
-A port-forward-rules -d 10.10.2.241/32 -m comment --comment "Port Forward Rule #241" -j DNAT --to-destination 192.168.150.241
-A port-forward-rules -d 10.10.2.242/32 -m comment --comment "Port Forward Rule #242" -j DNAT --to-destination 192.168.150.242
-A port-forward-rules -d 10.10.2.243/32 -m comment --comment "Port Forward Rule #243" -j DNAT --to-destination 192.168.150.243
-A port-forward-rules -d 10.10.2.244/32 -m comment --comment "Port Forward Rule #244" -j DNAT --to-destination 192.168.150.244
-A port-forward-rules -d 10.10.2.245/32 -m comment --comment "Port Forward Rule #245" -j DNAT --to-destination 192.168.150.245
-A port-forward-rules -d 10.10.2.246/32 -m comment --comment "Port Forward Rule #246" -j DNAT --to-destination 192.168.150.246
-A port-forward-rules -d 10.10.2.247/32 -m comment --comment "Port Forward Rule #247" -j DNAT --to-destination 192.168.150.247
-A port-forward-rules -d 10.10.2.248/32 -m comment --comment "Port Forward Rule #248" -j DNAT --to-destination 192.168.150.248
-A port-forward-rules -d 10.10.2.249/32 -m comment --comment "Port Forward Rule #249" -j DNAT --to-destination 192.168.150.249
-A port-forward-rules -d 10.10.2.250/32 -m comment --comment "Port Forward Rule #250" -j DNAT --to-destination 192.168.150.250
-A port-forward-rules -d 10.10.2.251/32 -m comment --comment "Port Forward Rule #251" -j DNAT --to-destination 192.168.150.251
-A port-forward-rules -d 10.10.2.252/32 -m comment --comment "Port Forward Rule #252" -j DNAT --to-destination 192.168.150.252
-A port-forward-rules -d 10.10.2.253/32 -m comment --comment "Port Forward Rule #253" -j DNAT --to-destination 192.168.150.253
-A port-forward-rules -d 10.10.2.254/32 -m comment --comment "Port Forward Rule #254" -j DNAT --to-destination 192.168.150.254
-A port-forward-rules -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 443 -m comment --comment "Drop local HTTPS traffic that hasn\'t been handled earlier in chain" -j REDIRECT --to-ports 0
-A port-forward-rules -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 80 -m comment --comment "Drop local HTTP traffic that hasn\'t been handled earlier in chain" -j REDIRECT --to-ports 0
-A uvm-tcp-redirect -d 10.47.2.2/32 -i utun -p tcp -m comment --comment "Redirect reinjected packets to 10.47.2.2 to the untangle-vm" -j DNAT --to-destination 10.47.2.2:9500-9627
-A uvm-tcp-redirect -d 192.168.150.1/32 -i utun -p tcp -m comment --comment "Redirect reinjected packets to 192.168.150.1 to the untangle-vm" -j DNAT --to-destination 192.168.150.1:9500-9627
-A uvm-tcp-redirect -i utun -p tcp -m comment --comment "Redirect reinjected packets to the untangle-vm" -j REDIRECT --to-ports 9500-9627
COMMIT
# Completed on Sat Jan 9 12:39:15 2016
# Generated by iptables-save v1.4.14 on Sat Jan 9 12:39:15 2016
*tune
:POSTROUTING ACCEPT [1057650:604742497]
:OUTPUT ACCEPT [1034093:603573243]
:queue-to-uvm - [0:0]
-A POSTROUTING -m comment --comment "Queue packets to the Untangle-VM" -j queue-to-uvm
-A queue-to-uvm -i lo -m comment --comment "Do not queue loopback traffic" -j RETURN
-A queue-to-uvm -o lo -m comment --comment "Do not queue loopback traffic" -j RETURN
-A queue-to-uvm -m conntrack --ctstate RELATED -m comment --comment "Do not queue (bypass) sessions related to other bypassed sessions" -j RETURN
-A queue-to-uvm -m conntrack --ctstate INVALID -m comment --comment "Do not queue (bypass) sessions without conntrack info" -j RETURN
-A queue-to-uvm -m mark --mark 0x1000000/0x1000000 -m comment --comment "Do not queue (bypass) all packets with bypass bit set" -j RETURN
-A queue-to-uvm -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "Queue TCP SYN packets to the untangle-vm" -j NFQUEUE --queue-num 1981
-A queue-to-uvm -p udp -m addrtype --dst-type UNICAST -m comment --comment "Queue Unicast UDP packets to the untange-vm" -j NFQUEUE --queue-num 1982
COMMIT
# Completed on Sat Jan 9 12:39:15 2016
# Generated by iptables-save v1.4.14 on Sat Jan 9 12:39:15 2016
*raw
:PREROUTING ACCEPT [1142533:584384998]
:OUTPUT ACCEPT [1035719:603681007]
:snort-scanning - [0:0]
-A OUTPUT -m mark --mark 0x1000000/0x1000000 -m comment --comment "CT NOTRACK packets with bypass bit mark set" -j CT --notrack
COMMIT
# Completed on Sat Jan 9 12:39:15 2016
general-ccdc/bastion/install-bro.sh
Executable
+83
View File
@@ -0,0 +1,83 @@
#!/bin/sh
# Installs Bro on Redhat or Debian Linux.
if [ "$(id -u)" -ne "0" ] ; then
echo "must be root to install Bro"
fi
# Defaults
flavor=redhat
prefix=/opt/bro
src=src
# Parse command line.
while getopts "edf:p:s:h?" opt ; do
case "$opt" in
h|\?)
printf "usage: %s -f flavor [-ed] [-p prefix]\n" $(basename $0)
exit 0
;;
e)
set -e
;;
d)
set -x
;;
f)
flavor=$OPTARG
;;
p)
prefix=$OPTARG
;;
s)
src=$OPTARG
;;
esac
done
# Remove parsed arguments.
shift $(expr $OPTIND - 1)
# Verify parameters.
if [ "$flavor" = "redhat" -a "$flavor" = "debian" ] ; then
echo "missing Linux flavor"
exit 1
fi
# Don't install twice.
if [ -f "$prefix/bin/bro" ] ; then
echo "bro already intalled in $prefix"
exit 1
fi
# Install Bro dependencies.
if [ "$flavor" = "redhat" ] ; then
yum install git cmake make gcc gcc-c++ flex bison libpcap-devel \
openssl-devel python-devel swig zlib-devel file-devel
elif [ "$flavor" = "debian" ] ; then
apt-get install git cmake make gcc g++ flex bison libpcap-dev \
libssl-dev python-dev swig zlib1g-dev libmagic-dev
fi
# Install Bro.
mkdir -p "$src"
cd "$src"
git clone --recursive git://git.bro.org/bro.git
cd bro
./configure --prefix=$prefix
make
make install
# Append a crontab entry.
entry="0-59/5 * * * * $prefix/bin/broctl cron > /dev/null"
(crontab -l; echo "$entry" ) | crontab -
# Tweak capture performance.
sysctl -w net.core.rmem_max=8388608
sysctl -w net.core.wmem_max=8388608
sysctl -w net.core.rmem_default=65536
sysctl -w net.core.wmem_default=65536
sysctl -w net.ipv4.tcp_rmem='4096 87380 8388608'
sysctl -w net.ipv4.tcp_wmem='4096 65536 8388608'
sysctl -w net.ipv4.tcp_mem='8388608 8388608 8388608'
sysctl -w net.ipv4.route.flush=1
general-ccdc/bastion/iptables_routing_isolation.sh
Executable
+38
View File
@@ -0,0 +1,38 @@
#!/bin/sh
# Our team number.
# Used to compute 3rd octet in public IPs.
team=4
hush() {
"$@" > /dev/null
#echo $*
}
nat() {
EXT_IF=eth0
IF=$2
NAME=$1
B=${3##*.}
INT_IP=172.21.$3
EXT_IP=192.168.$((100 + $team)).$B
LOC_IP=172.21.$B.2
LOC_RT=172.21.$B.1/30
echo -A POSTROUTING -o $EXT_IF -s $LOC_IP -m comment --comment $NAME -j SNAT --to-source $EXT_IP
echo -A POSTROUTING -s $LOC_IP -m comment --comment $NAME -j SNAT --to-source $INT_IP
echo -A PREROUTING -d $INT_IP -m comment --comment $NAME -j DNAT --to-destination $LOC_IP
echo -A PREROUTING -d $EXT_IP -m comment --comment $NAME -j DNAT --to-destination $LOC_IP
hush ip addr add dev $IF $INT_IP/32
hush ip addr add dev $IF $LOC_RT
}
echo \*nat
## TRANSLATION
nat starlord eth1 0.45
nat gamora eth1 0.18
nat rocket eth1 0.27
nat drax eth1 0.100
nat groot eth1 0.3
echo COMMIT
general-ccdc/bastion/vlan_setup.sh
Executable
+67
View File
@@ -0,0 +1,67 @@
#!/bin/sh
# VLAN setup script.
# TODO:
# - Make variables configurable via the command line.
# - Disable IPv6.
set -e
IPCOMMAND="/sbin/ip"
IP="10.10.9.132/24"
GATEWAY="10.10.9.1"
BRIDGE="br0"
PHYSICAL="eth0"
# Number of interfaces to create for the script
SWITCH_INTERFACES="25"
VM_INTERFACES="20"
echo -n "Installing Kernel module..."
modprobe 8021q
echo " Done."
if ! command -v brctl > /dev/null 2>&1
then
echo "bridge-utils missing"
exit 1
fi
if ! command -v ip > /dev/null 2>&1
then
echo "iproute2 missing"
exit 1
fi
# Create the bridge.
echo -n "Adding bridge interface..."
brctl addbr $BRIDGE
echo " Done."
for PORT in 1 $(seq -s " " 100 1$SWITCH_INTERFACES) $(seq -s " " 200 2$VM_INTERFACES)
do
# Create one VLAN for each port.
VLAN="$PHYSICAL.$PORT"
echo -n "Creating $VLAN..."
$IPCOMMAND link add link $PHYSICAL name $VLAN type vlan id $PORT
$IPCOMMAND link set $VLAN up
# Add all VLANS to br0.
echo -n " Adding to bridge..."
brctl addif $BRIDGE $VLAN
echo " Done."
done
# Migrate the IP address of the physical to the trunk interface.
echo -n "Adding IP to $TRUNK_BRIDGE..."
$IPCOMMAND addr add $IP dev $BRIDGE
echo " Done."
echo -n "Bringing $BRIDGE up..."
$IPCOMMAND link set $BRIDGE up
echo " Done."
echo -n "Removing IP from $PHYSICAL..."
$IPCOMMAND addr flush $PHYSICAL
echo " Done."
echo -n "Adding default route..."
$IPCOMMAND route add default via $GATEWAY dev $BRIDGE
echo " Done."
echo "Bastion setup complete! YAY!"
general-ccdc/bsd/crunch/README.md
Executable
+9
View File
@@ -0,0 +1,9 @@
`crunch` is a BSD utility to put a lot of programs in a single binary, the result is like busybox.
Here is an i386 version:
http://bsdbox.sourceforge.net
To extract crunch from BSDbox:
* Using BSD, loop-mount the `.bin`
* Loop-mount a file `mfs`, find it in the previous mount
* Every binary in `/stand` is a hard-linked copy of the `crunch` binary
general-ccdc/bsd/crunch/crunch.i386
Executable
BIN
View File
Binary file not shown.
general-ccdc/chpasswd.sh
Executable
+23
View File
@@ -0,0 +1,23 @@
#!/bin/sh
# setpass
passfile=passwords.txt
passfile=passwords.txt
>$passfile
list="alpha bravo charlie"
list=awk -F':' '{ if ( $7 !~ "nologin" && $7 !~ "false" ) print $1 }' "/etc/passwd"
for user in $list
do
if ! grep -w ^$user /etc/passwd > /dev/null
then
echo "user NOT present: $user"
else
echo "user present: $user"
pass=$(pwgen 16 1)
echo "$user:$pass">>$passfile
fi
done
cat $passfile | chpasswd
general-ccdc/cisco_switch/factory_reset.manual
Executable
+26
View File
@@ -0,0 +1,26 @@
== To Factory Reset ==
# Either run this on serial shortly after boot -or- Hold mode button until LED's stop flashing.
en
delete flash:/config.text
delete flash:/vlan.dat
write erase
reload
no
== Setup Network Access From Factory Reset (Over Serial) ==
en
conf t
enable password 0 abcd1234
enable secret secret1234
line vty 0 15
password 0 abcd1234
exit
interface vlan 1
ip address 10.42.43.253 255.255.255.0
no shutdown
exit
general-ccdc/cisco_switch/setup_switch.rb
Executable
+67
View File
@@ -0,0 +1,67 @@
#!/usr/bin/env ruby
# Cisco VLAN creation script
# Starts from the enabled "Switch#" prompt
# Competition switch will only have 24 ports. Likey 23 & 24 are fiber ports!
# Also - likely the modern switches would not be user FastEthernet but GigaEthernet interfaces.
[true, false].each do |practice|
type = practice ? "practice" : "competition"
File.open("setup_switch_#{type}.txt", "w") do |file|
ports = practice ? 48 : 24
file.puts "# #{type} script, run from serial or the last port"
file.puts "configure terminal"
file.puts "vtp mode transparent"
file.puts "no spanning-tree vlan 1-4094"
file.puts "no cdp run"
file.puts "no snmp-server"
# Assign each port to a VLAN
# Note: we're skipping port 0/2 because it's the bastion.
([1] + (3..(ports - 1)).to_a).each do |port|
file.puts "interface FastEthernet 0/#{port}"
file.puts "switchport mode access"
file.puts "switchport nonegotiate"
file.puts "switchport access vlan 1#{port.to_s.rjust(2, "0")}"
file.puts "exit"
end
if practice
file.puts "interface GigabitEthernet 0/2"
file.puts "switchport mode access"
file.puts "switchport nonegotiate"
file.puts "switchport access vlan 149"
file.puts "exit"
# file.puts "interface vlan 149"
# file.puts "ip address 10.42.43.253 255.255.255.0"
# file.puts "no shutdown"
# file.puts "exit"
# file.puts "interface vlan 1"
# file.puts "no ip address"
# file.puts "exit"
else
# Disable HTTP server of switch.
file.puts "no ip http server"
file.puts "no ip http secure-server"
end
# Setup Trunk
file.puts "interface FastEthernet 0/2"
file.puts "switchport mode trunk"
file.puts "switchport nonegotiate"
file.puts "switchport trunk encapsulation dot1q" if practice
file.puts "switchport trunk allowed vlan all"
file.puts "switchport trunk native vlan 100"
# Covered by 'no spanning-tree' above
#file.puts "spanning-tree bpdufilter enable"
file.puts "exit"
file.puts "exit"
file.puts "write"
file.puts "copy running-config startup-config"
puts "Writing #{type} script complete."
end
end
general-ccdc/cisco_switch/setup_switch_competition.txt
Executable
+122
View File
@@ -0,0 +1,122 @@
# competition script, run from serial or the last port
configure terminal
vtp mode transparent
interface FastEthernet 0/1
switchport mode access
switchport nonegotiate
switchport access vlan 101
exit
interface FastEthernet 0/3
switchport mode access
switchport nonegotiate
switchport access vlan 103
exit
interface FastEthernet 0/4
switchport mode access
switchport nonegotiate
switchport access vlan 104
exit
interface FastEthernet 0/5
switchport mode access
switchport nonegotiate
switchport access vlan 105
exit
interface FastEthernet 0/6
switchport mode access
switchport nonegotiate
switchport access vlan 106
exit
interface FastEthernet 0/7
switchport mode access
switchport nonegotiate
switchport access vlan 107
exit
interface FastEthernet 0/8
switchport mode access
switchport nonegotiate
switchport access vlan 108
exit
interface FastEthernet 0/9
switchport mode access
switchport nonegotiate
switchport access vlan 109
exit
interface FastEthernet 0/10
switchport mode access
switchport nonegotiate
switchport access vlan 110
exit
interface FastEthernet 0/11
switchport mode access
switchport nonegotiate
switchport access vlan 111
exit
interface FastEthernet 0/12
switchport mode access
switchport nonegotiate
switchport access vlan 112
exit
interface FastEthernet 0/13
switchport mode access
switchport nonegotiate
switchport access vlan 113
exit
interface FastEthernet 0/14
switchport mode access
switchport nonegotiate
switchport access vlan 114
exit
interface FastEthernet 0/15
switchport mode access
switchport nonegotiate
switchport access vlan 115
exit
interface FastEthernet 0/16
switchport mode access
switchport nonegotiate
switchport access vlan 116
exit
interface FastEthernet 0/17
switchport mode access
switchport nonegotiate
switchport access vlan 117
exit
interface FastEthernet 0/18
switchport mode access
switchport nonegotiate
switchport access vlan 118
exit
interface FastEthernet 0/19
switchport mode access
switchport nonegotiate
switchport access vlan 119
exit
interface FastEthernet 0/20
switchport mode access
switchport nonegotiate
switchport access vlan 120
exit
interface FastEthernet 0/21
switchport mode access
switchport nonegotiate
switchport access vlan 121
exit
interface FastEthernet 0/22
switchport mode access
switchport nonegotiate
switchport access vlan 122
exit
interface FastEthernet 0/23
switchport mode access
switchport nonegotiate
switchport access vlan 123
exit
no ip http server
no ip http secure-server
interface FastEthernet 0/2
switchport mode trunk
switchport nonegotiate
switchport trunk allowed vlan all
switchport trunk native vlan 100
spanning-tree bpdufilter enable
exit
general-ccdc/cisco_switch/setup_switch_practice.txt
Executable
+246
View File
@@ -0,0 +1,246 @@
# practice script, run from serial or the last port
configure terminal
vtp mode transparent
interface FastEthernet 0/1
switchport mode access
switchport nonegotiate
switchport access vlan 101
exit
interface FastEthernet 0/3
switchport mode access
switchport nonegotiate
switchport access vlan 103
exit
interface FastEthernet 0/4
switchport mode access
switchport nonegotiate
switchport access vlan 104
exit
interface FastEthernet 0/5
switchport mode access
switchport nonegotiate
switchport access vlan 105
exit
interface FastEthernet 0/6
switchport mode access
switchport nonegotiate
switchport access vlan 106
exit
interface FastEthernet 0/7
switchport mode access
switchport nonegotiate
switchport access vlan 107
exit
interface FastEthernet 0/8
switchport mode access
switchport nonegotiate
switchport access vlan 108
exit
interface FastEthernet 0/9
switchport mode access
switchport nonegotiate
switchport access vlan 109
exit
interface FastEthernet 0/10
switchport mode access
switchport nonegotiate
switchport access vlan 110
exit
interface FastEthernet 0/11
switchport mode access
switchport nonegotiate
switchport access vlan 111
exit
interface FastEthernet 0/12
switchport mode access
switchport nonegotiate
switchport access vlan 112
exit
interface FastEthernet 0/13
switchport mode access
switchport nonegotiate
switchport access vlan 113
exit
interface FastEthernet 0/14
switchport mode access
switchport nonegotiate
switchport access vlan 114
exit
interface FastEthernet 0/15
switchport mode access
switchport nonegotiate
switchport access vlan 115
exit
interface FastEthernet 0/16
switchport mode access
switchport nonegotiate
switchport access vlan 116
exit
interface FastEthernet 0/17
switchport mode access
switchport nonegotiate
switchport access vlan 117
exit
interface FastEthernet 0/18
switchport mode access
switchport nonegotiate
switchport access vlan 118
exit
interface FastEthernet 0/19
switchport mode access
switchport nonegotiate
switchport access vlan 119
exit
interface FastEthernet 0/20
switchport mode access
switchport nonegotiate
switchport access vlan 120
exit
interface FastEthernet 0/21
switchport mode access
switchport nonegotiate
switchport access vlan 121
exit
interface FastEthernet 0/22
switchport mode access
switchport nonegotiate
switchport access vlan 122
exit
interface FastEthernet 0/23
switchport mode access
switchport nonegotiate
switchport access vlan 123
exit
interface FastEthernet 0/24
switchport mode access
switchport nonegotiate
switchport access vlan 124
exit
interface FastEthernet 0/25
switchport mode access
switchport nonegotiate
switchport access vlan 125
exit
interface FastEthernet 0/26
switchport mode access
switchport nonegotiate
switchport access vlan 126
exit
interface FastEthernet 0/27
switchport mode access
switchport nonegotiate
switchport access vlan 127
exit
interface FastEthernet 0/28
switchport mode access
switchport nonegotiate
switchport access vlan 128
exit
interface FastEthernet 0/29
switchport mode access
switchport nonegotiate
switchport access vlan 129
exit
interface FastEthernet 0/30
switchport mode access
switchport nonegotiate
switchport access vlan 130
exit
interface FastEthernet 0/31
switchport mode access
switchport nonegotiate
switchport access vlan 131
exit
interface FastEthernet 0/32
switchport mode access
switchport nonegotiate
switchport access vlan 132
exit
interface FastEthernet 0/33
switchport mode access
switchport nonegotiate
switchport access vlan 133
exit
interface FastEthernet 0/34
switchport mode access
switchport nonegotiate
switchport access vlan 134
exit
interface FastEthernet 0/35
switchport mode access
switchport nonegotiate
switchport access vlan 135
exit
interface FastEthernet 0/36
switchport mode access
switchport nonegotiate
switchport access vlan 136
exit
interface FastEthernet 0/37
switchport mode access
switchport nonegotiate
switchport access vlan 137
exit
interface FastEthernet 0/38
switchport mode access
switchport nonegotiate
switchport access vlan 138
exit
interface FastEthernet 0/39
switchport mode access
switchport nonegotiate
switchport access vlan 139
exit
interface FastEthernet 0/40
switchport mode access
switchport nonegotiate
switchport access vlan 140
exit
interface FastEthernet 0/41
switchport mode access
switchport nonegotiate
switchport access vlan 141
exit
interface FastEthernet 0/42
switchport mode access
switchport nonegotiate
switchport access vlan 142
exit
interface FastEthernet 0/43
switchport mode access
switchport nonegotiate
switchport access vlan 143
exit
interface FastEthernet 0/44
switchport mode access
switchport nonegotiate
switchport access vlan 144
exit
interface FastEthernet 0/45
switchport mode access
switchport nonegotiate
switchport access vlan 145
exit
interface FastEthernet 0/46
switchport mode access
switchport nonegotiate
switchport access vlan 146
exit
interface FastEthernet 0/47
switchport mode access
switchport nonegotiate
switchport access vlan 147
exit
interface GigabitEthernet 0/2
switchport mode access
switchport nonegotiate
switchport access vlan 149
exit
interface FastEthernet 0/2
switchport mode trunk
switchport nonegotiate
switchport trunk encapsulation dot1q
switchport trunk allowed vlan all
switchport trunk native vlan 100
spanning-tree bpdufilter enable
exit
general-ccdc/esx/vlan_migration.powercli.sh
Executable
+66
View File
@@ -0,0 +1,66 @@
# Script to tag all VM's
# Author: Vania Smirnov, with Berkeley CCDC
# Possible issues:
# 1. if last octet is not 3 digits, code will fail
# 2. if ip is null, we get errors, and a vlan_id is reused
# 3. this script assumes we are on vswitch0. this may not always be the case
#############################################################
# install powercli and paste in this script
#https://my.vmware.com/group/vmware/get-download?downloadGroup=VSPS510-PCLI-510R2
# note - all commands are case insensitive
$MyESXiHostIP="10.42.43.205" # CHANGE THIS
# allow remote scripting - otherwise powercli will not work
Set-ExecutionPolicy RemoteSigned
## connect to server
Connect-VIServer $MyESXiHostIP -username admin
## optional password change
#Set-VMHostAccount -UserAccount root -password MyPa$$!
## 0. recon (optional) ##
#get-vm # lists all VN's, with name, PowerSate, and details
#get-VirtualSwitch # list virtual switches. in all honesty the GUI is probably easier to look at
# 1. for each vm , create a vlan with name same as (VM | VLAN_ID) and ID same as last 3 digits of IP
$VM_LIST = get-vm # populate list
$VLAN_ID = 201 # start from 200
foreach ($VM in $VM_LIST) {
# get last three digits of ip, assign to VLAN_ID
#$IP=$VM.guest.ipaddress
#$VLAN_ID = $IP[0].substring($IP[0].length -3, 3)
# get name
$VM_NAME = $VM.name
$VLAN_NAME = $VM.name + " - " + $VLAN_ID
# create new vlan with VM_NAME and VLAN_ID
Get-VirtualSwitch -name vSwitch0 | new-VirtualPortGroup -name $VM_NAME -vlanid $VLAN_ID
# move VM to new VLAN
Get-VM $VM_NAME | Get-NetworkAdapter | Set-NetworkAdapter -NetworkName $VLAN_NAME
#increment vlan counter
$VLAN_ID = $VLAN_ID + 1
}
### move all vm's back to default
$VM_LIST = get-vm # populate list
foreach ($VM in $VM_LIST) {
# get name
$VM_NAME = $VM.name
# move VM to new VLAN
Get-VM $VM_NAME | Get-NetworkAdapter | Set-NetworkAdapter -NetworkName "VM Network"
}
general-ccdc/freebsd81/pfsense-config
Executable
+127
View File
@@ -0,0 +1,127 @@
#!/bin/sh
# Our team number.
# Used to compute 3rd octet in public IPs.
team=6
hush() {
"$@" > /dev/null
#echo $*
}
nat() {
NAME=$1
IF=$2
INT_IP=172.20.$3
B=${3##*.}
EXT_IP=172.25.$((20 + $team)).$B
LOC_IP=10.137.$B.2
hush pfctl -t $NAME -T flush
hush pfctl -t $NAME -T add $LOC_IP $EXT_IP $INT_IP
hush pfctl -t locals -T add $LOC_IP $EXT_IP $INT_IP
echo rdr to $EXT_IP tag $NAME -\> $LOC_IP
echo rdr on {le1,le2} to $INT_IP tag $NAME -\> $LOC_IP
echo nat on le0 from $LOC_IP tag $NAME -\> $EXT_IP
echo nat on {le1,le2} from $LOC_IP tag $NAME -\> $INT_IP
hush ifconfig $IF add $INT_IP/32
hush ifconfig $IF add 10.137.$B.1/30
}
# Creates a PF rule.
# $1: interface restrictions
# $2: src:[port]
# $3: dst:[port]
# $4: [proto]
pass()
{
src=${2%%:*}
pfctl -sT | egrep -q \^$src\$ && src="<$src>"
dst=${3%%:*}
pfctl -sT | egrep -q \^$dst\$ && dst="<$dst>"
sport=${2#*:}
dport=${3#*:}
echo pass $1 inet ${4:+proto }$4 \
from $src ${sport:+port }$sport \
to $dst ${dport:+port }$dport
# label ${2}_to_${3}
}
# Creates a PF rule for the local interfaces.
lan()
{
pass "on {le1,le2}" "$@"
}
# Creates a PF rule for all interfaces.
all()
{
pass "" "$@"
}
## OPTIONS
echo set block-policy drop
echo scrub in all fragment reassemble
hush pfctl -t locals -T flush
hush pfctl -t self -T flush
## TRANSLATION
nat ecom le1 240.11
nat dns le1 240.23
nat email le2 241.39
nat ftp le2 241.9
nat dfs le2 241.3
nat ad le2 241.27
hush pfctl -t locals -T add self
hush pfctl -t self -T add self
## RULES
# Completely disable IPv6
echo block quick inet6 all
# Prevent spoofing from WAN.
echo block in quick on le0 from '<locals>' to any
# Prevent source address spoofing.
#echo block out quick on le0 from ! '<locals>' to any
# Block all non-matching packets and log them.
echo block log all
# Enable SSH tunneling (practice only).
#all self: 128.32.45.42:10106 tcp
#all self: self:22 tcp
# -------------------------------------
all any: any: icmp
all any: ecom:{80,443} tcp
lan locals: dns:1514 udp # OSSEC
lan self: dns:25 tcp # Bro emails
lan ecom: dns:3306 tcp
lan email: dns:3306 tcp
all any: dns:53 tcp
all any: dns:53 udp
all any: email:{80,443,25,465,587} tcp
all email: any:{25,465,587} tcp # outbound SMTP
all any: ftp:21 tcp
all any: ftp:49000:51000 tcp
all ftp:20 any: tcp # outbound active FTP
all email: ad: # TODO: limit to LDAP only.
all any: ad:53 tcp
all any: ad:53 udp
all locals: locals:22 tcp
all locals: any:{80,443} tcp
all locals: any:53 udp
general-ccdc/freebsd81/usr_include.tbz
Executable
BIN
View File
Binary file not shown.
general-ccdc/injects/top5/README
Executable
+7
View File
@@ -0,0 +1,7 @@
deploy.sh
Copies over the generated HTML to the web server
top5.sh
Generates the HTML report from Bro logs
general-ccdc/injects/top5/deploy.sh
Executable
+8
View File
@@ -0,0 +1,8 @@
#!/bin/sh
dir=/home/angel/ccdc/injects/top5
file=index.html
cd $dir
./top5.sh > $file
scp -i top5 $file root@10.10.9.16:/var/www/top5
rm -f $file
general-ccdc/injects/top5/top5
Executable
+27
View File
@@ -0,0 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAxqqsjCIUDNN8tbhc8hnnj5UBGoipyzUqLHzarNEGkfNt9Sq4
gH7ky2fzyZAFhVPH0bkEc9N8XfBoCuPcGbejyRE3zotrumt+jyU46hngO+lsEGyf
njCB37HPe6M6G7VnxRGi56Zygzkwwuwn9BxrOx9WSpIQKYZ2v58JJjy8KSd+dQK1
tZYDMUrDtpBW9yE8kuBw7gdtc3VFMYz3iIfBWopau+YQtiylnenyxFCAoqM0dAP9
abMr12ez6BCdAgsHXKhWZ8RznEEQswSAEpfXeOw+Cbt6idAytu1jxvM9CefUFuT7
u+Hgor2cwE6vpRxNv252qw5NoT+4uM1pwMdR/QIDAQABAoIBAQDGm+3wEkmVIQC1
8uAIsNkMc9wsmJ+WpUnKO++pgTZeRsyQourcmv9EUmIoCbFbPwyun5bR7IWSrDp3
WKC7nRlCc9IkzMEgF0Lo/D9P2hqQCqWcLdvNG5Va+roAUohPFyXsn9sKVx54DX6v
/8NZieexrXxpBGjf+qtQmj9dWK6LPEuH9W6FttX8aBTXXtDbhXGgprBun//TmUHM
W5Hr1AOeHzkuZs/b4dmLfcrCuPUHOsUSZEL6nV1e2MdM5YfHm4QnNM1QRIPICO+A
5/X0PSCSaM9DyrVQnm2W4wCO3pVnlx+b4+BHHWjxq2i0iIqodiT5Ne3bABTdh1TQ
vrb5Rz3JAoGBAOGjD6FqNuAlZAxn7jph1OPmMHGD7us04L2ez7e4OuGN/sQ/XZJW
jCgbWSOgL+h+PQbxqVLgEIXAWoGCOSMxzkWtZQ6isteqZqXfcjJqjE4a3bxAq76v
gjnaZuXCk4SK7Z0QqRllLLXOsgJOPVWzmMdb5HZ8/ME5dQO5vbthbU5vAoGBAOFm
hJAK7T9WpeeAkfc4VYIrgpkjlx6x+49rrSJm1YX2F6sIWlTeA6sObU5kj2gu1x0m
CteN7JtOFOrLIcRcV0/KiD4ZUbRnBfBZHjqighDkDIv5LSTQW4ebP0+RPHu+iCfO
JnSqAVYgApdv6fP7V2naLXCbC0YZPPywBpgDyVxTAoGAfTDF2V9fNxpH2oJHsWja
f+AV/MWg6CucjljxExRKxx7LvgMSXcFbXl1eJeAY9LwmDBZFRlA/mpZRIQ4puZdG
xW4hZe9rnzFSZrIFYGexlRxe7rZLFC+453SAJvbAdofGsqCt0gNKvU0Dgzf52/Ub
zXD037EVY/gHLpv941t5FE0CgYBOH5VUw6TFbkfkfGibMlhY3LHQWEiZqADUDfMd
WF0rqEc9zZBZl/XXhRGXuT0HVCzU+omJerSGg8K2Op/Cimrsyfr84xOxnn+tdYYH
tqm0Jwa+QShHeTwwPTvtXR6EmV5hxY8IoqAB9OhRCsYg/X2nv6o+PE7lBfxgbLZs
W+uf5wKBgFS1dovfdSpyN3UjNluF7XpwFcctTGOvhIfV5oR43i10WFpu00DWrC4x
Byfn0zQ3namOJh7+5CJTWrb+Z6eUDGmKyJbM3F1Bqc8uMr1/5U3vjV1DjTfTpFWE
vlxdDm0AK2ZxKczce0yiCyB9VNm1kogaTk2gYG57w7qHE2h0uzjP
-----END RSA PRIVATE KEY-----
general-ccdc/injects/top5/top5.pub
Executable
+1
View File
@@ -0,0 +1 @@
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGqqyMIhQM03y1uFzyGeePlQEaiKnLNSosfNqs0QaR8231KriAfuTLZ/PJkAWFU8fRuQRz03xd8GgK49wZt6PJETfOi2u6a36PJTjqGeA76WwQbJ+eMIHfsc97ozobtWfFEaLnpnKDOTDC7Cf0HGs7H1ZKkhAphna/nwkmPLwpJ351ArW1lgMxSsO2kFb3ITyS4HDuB21zdUUxjPeIh8Failq75hC2LKWd6fLEUICiozR0A/1psyvXZ7PoEJ0CCwdcqFZnxHOcQRCzBIASl9d47D4Ju3qJ0DK27WPG8z0J59QW5Pu74eCivZzATq+lHE2/bnarDk2hP7i4zWnAx1H9 root@bastion
general-ccdc/injects/top5/top5.sh
Executable
+79
View File
@@ -0,0 +1,79 @@
#!/bin/sh
# Make sure we have bro-cut available.
PATH=/opt/bro/bin:$PATH
archive='/var/bro/logs/2013-03-30'
current='/var/bro/logs/current'
echo '<html>'
echo '<body>'
echo '<h1>Top-5 Attacker Statistics</h1>'
echo '<p>This page lists various connection-level information about blocked hosts, ports, and HTTP attacks. In all reports, the <em>first</em> column represents the number of connections and the <em>second</em> column a piece of evidence gathered from our Bro IDS logs.</p>'
echo '<h2>Top 5 Blocked Hosts</h2>'
echo '<p>The hosts below are attacker IP addresses blocked by our firewall.</p>'
echo '<pre>'
zcat -f $(ls $archive/conn*gz | tail -1) $current/conn.log \
| bro-cut id.orig_h id.resp_h conn_state \
| awk '$1 ~ /10\.1[23]/ && $2 != "10.10.9.132" && $3 ~/REJ|S0/ { print $1 }' \
| sort \
| uniq -c \
| sort -rn \
| head -n 5
echo '</pre>'
echo '<h2>Top 5 Blocked Ports</h2>'
echo '<p>The hosts below show attacker TCP ports blocked at our firewall.</p>'
echo '<pre>'
zcat -f $(ls $archive/conn*gz | tail -1) $current/conn.log \
| bro-cut id.orig_h id.resp_p conn_state \
| awk '$1 ~ /10\.1[23]/ && $3 ~/REJ|S0/ { print $2 }' \
| sort \
| uniq -c \
| sort -rn \
| head -n 5
echo '</pre>'
echo '<h2>Top 5 HTTP Attacks</h2>'
http=/tmp/http-forensics.log
zcat -f $archive/http*gz $current/http.log \
| bro-cut -d ts id.orig_h id.resp_h uri user_agent \
> $http
echo '<h3>Directory Traversal</h3>'
echo '<pre>'
awk '$4 ~ /\.\.\/\.\.\// { print $4 }' $http \
| sort \
| uniq -c \
| sort -rn \
| head -n 3
awk '$5 ~ /DirBuster/ { print $4 }' $http \
| sort \
| uniq -c \
| sort -rn \
| head -n 2
echo '</pre>'
echo '<h3>Cross-Site Scripting (XSS)</h3>'
echo '<pre>'
awk '$4 ~ /<script>./ { print $4 }' $http \
| sort \
| uniq -c \
| sort -rn \
| head -n 5 \
| sed -e 's/<script>/\&lt;script\&gt;/'
echo '</pre>'
echo '<h3>Command Injection (XSS)</h3>'
echo '<pre>'
awk -F'\t' '$3 ~ /10\.10\.9/ && $4 !~ /serverInfo/ && $4 ~ /cmd=|echo./ { print $4 }' $http \
| sort \
| uniq -c \
| sort -rn \
| head -n 5
echo '</pre>'
echo '</body>'
echo '</html>'
rm -f /tmp/http-forensics.log
general-ccdc/linux/busybox/build.config
Executable
+1034
View File
File diff suppressed because it is too large Load Diff
general-ccdc/linux/busybox/busybox32
Executable
BIN
View File
Binary file not shown.
general-ccdc/linux/busybox/busybox64
Executable
BIN
View File
Binary file not shown.
general-ccdc/linux/rkhunter/portable.sh
Executable
+17
View File
@@ -0,0 +1,17 @@
# To run this, run this as root: <busybox path> sh portable.sh <busybox path>
# This script needs to be run in the directory that comes from unzipping rkhunter (usually called rkhunter-1.4.0)
# Additionally, the rkhunter.conf file needs to be moved in to the files/ directory in that same folder
# Upon running this, it will move all of rkhunter's necessary files in to /tmp and set up the required variables so it runs without installing all over the system
# Then, rkhunter is instructed to check all critical system commands and runs an app scan as well (looks for old versions)
# rkhunter is now available in your path for more intensive checks
$1 rm -rf /tmp/rkhunter
$1 mkdir -p /tmp/rkhunter
$1 mkdir -p /tmp/rkhunter/tmp
$1 mkdir -p /tmp/rkhunter/db
$1 chmod 700 /tmp/rkhunter
$1 cp -r files /tmp/rkhunter
$1 cp -r files/i18n /tmp/rkhunter/db/
$1 ln -s /tmp/rkhunter/files/rkhunter.conf /etc/rkhunter.conf
$1 ln -s /tmp/rkhunter/files/rkhunter /usr/bin/rkhunter
rkhunter --update
rkhunter --rwo --enable system_commands,apps
general-ccdc/linux/rkhunter/rkhunter.conf
Executable
+984
View File
@@ -0,0 +1,984 @@
#
# This is the main configuration file for Rootkit Hunter.
#
# You can either modify this file directly, or you can create a local
# configuration file. The local file must be named 'rkhunter.conf.local',
# and must reside in the same directory as this file. Please modify one
# or both files to your own requirements. It is suggested that the
# command 'rkhunter -C' is run after any changes have been made.
#
# Please review the documentation before posting bug reports or questions.
# To report bugs, obtain updates, or provide patches or comments, please go to:
# http://rkhunter.sourceforge.net
#
# To ask questions about rkhunter, please use the rkhunter-users mailing list.
# Note this is a moderated list: please subscribe before posting.
#
# Lines beginning with a hash (#), and blank lines, are ignored.
# End-of-line comments are not supported.
#
# Most of the following options need only be specified once. If
# they appear more than once, then the last one seen will be used.
# Some options are allowed to appear more than once, and the text
# describing the option will say if this is so.
#
# Some of the options are space-separated lists of pathnames. If
# wildcard characters (globbing) are allowed in the list, then the
# text describing the option will say so.
#
# Space-separated lists may be enclosed by quotes, but these must only
# appear at the start and end of the list, not in the middle.
#
# For example: XXX="abc def gh" (correct)
# XXX="abc" "def" "gh" (incorrect)
#
#
# If this option is set to 1, it specifies that the mirrors file
# ('mirrors.dat'), which is used when the '--update' and '--versioncheck'
# options are used, is to be rotated. Rotating the entries in the file
# allows a basic form of load-balancing between the mirror sites whenever
# the above options are used.
# If the option is set to 0, then the mirrors will be treated as if in
# a priority list. That is, the first mirror listed will always be used
# first. The second mirror will only be used if the first mirror fails,
# the third mirror will only be used if the second mirror fails, and so on.
#
# If the mirrors file is read-only, then the '--versioncheck' command-line
# option can only be used if this option is set to 0.
#
ROTATE_MIRRORS=1
#
# If this option is set to 1, it specifies that when the '--update'
# option is used, then the mirrors file is to be checked for updates
# as well. If the current mirrors file contains any local mirrors,
# these will be prepended to the updated file.
# If this option is set to 0, the mirrors file can only be updated
# manually. This may be useful if only using local mirrors.
#
UPDATE_MIRRORS=1
#
# The MIRRORS_MODE option tells rkhunter which mirrors are to be
# used when the '--update' or '--versioncheck' command-line options
# are given. Possible values are:
# 0 - use any mirror (the default)
# 1 - only use local mirrors
# 2 - only use remote mirrors
#
# Local and remote mirrors can be defined in the mirrors file
# by using the 'local=' and 'remote=' keywords respectively.
#
MIRRORS_MODE=0
#
# Email a message to this address if a warning is found when the
# system is being checked. Multiple addresses may be specified
# simply be separating them with a space. Setting this option to
# null disables the option.
#
# NOTE: This option should be present in the configuration file.
#
#MAIL-ON-WARNING=me@mydomain root@mydomain
MAIL-ON-WARNING=""
#
# Specify the mail command to use if MAIL-ON-WARNING is set.
#
# NOTE: Double quotes are not required around the command, but
# are required around the subject line if it contains spaces.
#
MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}"
#
# Specify the temporary directory to use.
#
# NOTE: Do not use /tmp as your temporary directory. Some
# important files will be written to this directory, so be
# sure that the directory permissions are tight.
#
TMPDIR=/tmp
#
# Specify the database directory to use.
#
DBDIR=/tmp/rkhunter/db
#
# Specify the script directory to use.
#
SCRIPTDIR=/tmp/rkhunter/files
#
# This option can be used to modify the command directory list used
# by rkhunter to locate commands (that is, its PATH). By default
# this will be the root PATH, and an internal list of some common
# command directories.
#
# Any directories specified here will, by default, be appended to the
# default list. However, if a directory name begins with the '+'
# character, then that directory will be prepended to the list (that
# is, it will be put at the start of the list).
#
# This is a space-separated list of directory names. The option may
# be specified more than once.
#
#BINDIR="/bin /usr/bin /sbin /usr/sbin"
#BINDIR="+/usr/local/bin +/usr/local/sbin"
#
# Specify the default language to use. This should be similar
# to the ISO 639 language code.
#
# NOTE: Please ensure that the language you specify is supported.
# For a list of supported languages use the following command:
#
# rkhunter --lang en --list languages
#
#LANGUAGE=en
#
# This option is a space-separated list of the languages that are to
# be updated when the '--update' option is used. If unset, then all
# the languages will be updated. If none of the languages are to be
# updated, then set this option to just 'en'.
#
# The default is for all the languages to be updated. The default
# language, specified above, and the English (en) language file will
# always be updated regardless of this option.
#
UPDATE_LANG=""
#
# Specify the log file pathname.
#
# NOTE: This option should be present in the configuration file.
#
LOGFILE=/var/log/rkhunter.log
#
# Set the following option to 1 if the log file is to be appended to
# whenever rkhunter is run.
#
APPEND_LOG=0
#
# Set the following option to 1 if the log file is to be copied when
# rkhunter finishes and an error or warning has occurred. The copied
# log file name will be appended with the current date and time
# (in YYYY-MM-DD_HH:MM:SS format).
# For example: rkhunter.log.2009-04-21_00:57:51
#
COPY_LOG_ON_ERROR=0
#
# Set the following option to enable the rkhunter check start and finish
# times to be logged by syslog. Warning messages will also be logged.
# The value of the option must be a standard syslog facility and
# priority, separated by a dot. For example:
#
# USE_SYSLOG=authpriv.warning
#
# Setting the value to 'none', or just leaving the option commented out,
# disables the use of syslog.
#
#USE_SYSLOG=authpriv.notice
#
# Set the following option to 1 if the second colour set is to be used.
# This can be useful if your screen uses black characters on a white
# background (for example, a PC instead of a server).
#
COLOR_SET2=0
#
# Set the following option to 0 if rkhunter should not detect if X is
# being used. If X is detected as being used, then the second colour
# set will automatically be used.
#
AUTO_X_DETECT=1
#
# Set the following option to 1 if it is wanted that any 'Whitelisted'
# results are shown in white rather than green. For colour set 2 users,
# setting this option will cause the result to be shown in black.
#
WHITELISTED_IS_WHITE=0
#
# The following option is checked against the SSH configuration file
# 'PermitRootLogin' option. A warning will be displayed if they do not
# match. However, if a value has not been set in the SSH configuration
# file, then a value here of 'unset' can be used to avoid warning messages.
# This option has a default value of 'no'.
#
ALLOW_SSH_ROOT_USER=no
#
# Set this option to '1' to allow the use of the SSH-1 protocol, but note
# that theoretically it is weaker, and therefore less secure, than the
# SSH-2 protocol. Do not modify this option unless you have good reasons
# to use the SSH-1 protocol (for instance for AFS token passing or Kerberos4
# authentication). If the 'Protocol' option has not been set in the SSH
# configuration file, then a value of '2' may be set here in order to
# suppress a warning message. This option has a default value of '0'.
#
ALLOW_SSH_PROT_V1=0
#
# This setting tells rkhunter the directory containing the SSH configuration
# file. This setting will be worked out by rkhunter, and so should not
# usually need to be set.
#
#SSH_CONFIG_DIR=/etc/ssh
#
# These two options determine which tests are to be performed.
# The ENABLE_TESTS option can use the word 'all' to refer to all the
# available tests. The DISABLE_TESTS option can use the word 'none' to
# mean that no tests are disabled. The list of disabled tests is applied to
# the list of enabled tests. Both options are space-separated lists of test
# names. The currently available test names can be seen by using the command
# 'rkhunter --list tests'.
#
# The program defaults are to enable all tests and disable none. However, if
# either of the options below are specified, then they will override the
# program defaults.
#
# The supplied configuration file has some tests already disabled, and these
# are tests that will be used only occasionally, can be considered
# "advanced" or that are prone to produce more than the average number of
# false-positives.
#
# Please read the README file for more details about enabling and disabling
# tests, the test names, and how rkhunter behaves when these options are used.
#
ENABLE_TESTS="all"
DISABLE_TESTS="suspscan hidden_ports hidden_procs deleted_files packet_cap_apps"
#
# The HASH_FUNC option can be used to specify the command to use
# for the file hash value check. It can be specified as just the
# command name or the full pathname. If just the command name is
# given, and it is one of MD5, SHA1, SHA224, SHA256, SHA384 or
# SHA512, then rkhunter will first look for the relevant command,
# such as 'sha256sum', and then for 'sha256'. If neither of these
# are found, it will then look to see if a perl module has been
# installed which will support the relevant hash function. To see
# which perl modules have been installed use the command
# 'rkhunter --list perl'.
#
# The default is SHA1, or MD5 if SHA1 cannot be found.
#
# Systems using prelinking are restricted to using either the
# SHA1 or MD5 function.
#
# A value of 'NONE' (in uppercase) can be specified to indicate that
# no hash function should be used. Rootkit Hunter will detect this and
# automatically disable the file hash checks.
#
# Examples:
# For Solaris 9 : HASH_FUNC=gmd5sum
# For Solaris 10: HASH_FUNC=sha1sum
# For AIX (>5.2): HASH_FUNC="csum -hMD5"
# For NetBSD : HASH_FUNC="cksum -a sha512"
#
# NOTE: If the hash function is changed then you MUST run rkhunter with
# the '--propupd' option to rebuild the file properties database.
#
#HASH_FUNC=sha1sum
#
# The HASH_FLD_IDX option specifies which field from the HASH_FUNC
# command output contains the hash value. The fields are assumed to
# be space-separated. The default value is 1, but for *BSD users
# rkhunter will, by default, use a value of 4 if the HASH_FUNC option
# has not been set. The option value must be an integer greater
# than zero.
#
#HASH_FLD_IDX=4
#
# The PKGMGR option tells rkhunter to use the specified package manager
# to obtain the file property information. This is used when updating
# the file properties file ('rkhunter.dat'), and when running the file
# properties check. For RedHat/RPM-based systems, 'RPM' can be used to
# get information from the RPM database. For Debian-based systems 'DPKG'
# can be used, for *BSD systems 'BSD' can be used, and for Solaris
# systems 'SOLARIS' can be used. No value, or a value of 'NONE',
# indicates that no package manager is to be used. The default is 'NONE'.
#
# The current package managers, except 'SOLARIS', store the file hash
# values using an MD5 hash function. The Solaris package manager includes
# a checksum value, but this is not used by default (see USE_SUNSUM below).
#
# The 'DPKG' and 'BSD' package managers only provide MD5 hash values.
# The 'RPM' package manager additionally provides values for the inode,
# file permissions, uid, gid and other values. The 'SOLARIS' also provides
# most of the values, similar to 'RPM', but not the inode number.
#
# For any file not part of a package, rkhunter will revert to using the
# HASH_FUNC hash function instead.
#
# Whenever this option is changed 'rkhunter --propupd' must be run.
#
#PKGMGR=NONE
#
# It is possible that a file which is part of a package may be modified
# by the administrator. Typically this occurs for configuration files.
# However, the package manager may list the file as being modified. For
# the RPM package manager this may well depend on how the package was
# built. This option specifies those pathnames which are to be exempt
# from the package manager verification process, and which will be treated
# as non-packaged files. As such, the file properties are still checked.
#
# This option only takes effect if the PKGMGR option has been set, and
# is not 'NONE'.
#
# This is a space-separated list of pathnames. The option may
# be specified more than once.
#
# Whenever this option is changed 'rkhunter --propupd' must be run.
#
#PKGMGR_NO_VRFY=""
#
# This option can be used to tell rkhunter to ignore any prelink
# dependency errors for the given commands. However, a warning will also
# be issued if the error does not occur for a given command. As such
# this option must only be used on commands which experience a persistent
# problem.
#
# Short-term prelink dependency errors can usually be resolved simply by
# running the 'prelink' command on the given pathname.
#
# NOTE: The command 'rkhunter --propupd' must be run whenever this option
# is changed.
#
# This is a space-separated list of command pathnames. The option can be
# specified more than once.
#
#IGNORE_PRELINK_DEP_ERR="/bin/ps /usr/bin/top"
#
# If the 'SOLARIS' package manager is used, then it is possible to use
# the checksum (hash) value stored for a file. However, this is only a
# 16-bit checksum, and as such is not nearly as secure as, for example,
# a SHA-2 value. For that reason, the checksum is not used by default,
# and the hash function given by HASH_FUNC is used instead. To enable
# this option, set its value to 1. The Solaris 'sum' command must be
# present on the system if this option is used.
#
#USE_SUNSUM=0
#
# This option is a space-separated list of commands, directories and file
# pathnames which will be included in the file properties checks.
# This option can be specified more than once.
#
# Whenever this option is changed, 'rkhunter --propupd' must be run.
#
# Simple command names - for example, 'top' - and directory names are
# added to the internal list of directories to be searched for each of
# the command names in the command list. Additionally, full pathnames
# to files, which need not be commands, may be given. Any files or
# directories which are already part of the internal lists will be
# silently ignored from the configuration.
#
# Normal globbing wildcards are allowed, except for simple command names.
# For example, 'top*' cannot be given, but '/usr/bin/top*' is allowed.
#
# Specific files may be excluded by preceding their name with an
# exclamation mark (!). For example, '!/opt/top'. By combining this
# with wildcarding, whole directories can be excluded. For example,
# '/etc/* /etc/*/* !/etc/rc?.d/*'. This will look for files in the first
# two directory levels of '/etc'. However, anything in '/etc/rc0.d',
# '/etc/rc1.d', '/etc/rc2.d' and so on, will be excluded.
#
# NOTE: Only files and directories which have been added by the user,
# and are not part of the internal lists, can be excluded. So, for
# example, it is not possible to exclude the 'ps' command by using
# '!/bin/ps'. These will be silently ignored from the configuration.
#
#USER_FILEPROP_FILES_DIRS="top /usr/local/sbin !/opt/ps*"
#USER_FILEPROP_FILES_DIRS="/etc/rkhunter.conf"
#USER_FILEPROP_FILES_DIRS="/etc/rkhunter.conf.local"
#USER_FILEPROP_FILES_DIRS="/var/lib/rkhunter/db/*"
#USER_FILEPROP_FILES_DIRS="!/var/lib/rkhunter/db/mirrors.dat"
#USER_FILEPROP_FILES_DIRS="!/var/lib/rkhunter/db/rkhunter*"
#USER_FILEPROP_FILES_DIRS="/var/lib/rkhunter/db/i18n/*"
#
# This option whitelists files and directories from existing,
# or not existing, on the system at the time of testing. This
# option is used when the configuration file options themselves
# are checked, and during the file properties check, the hidden
# files and directories checks, and the filesystem check of the
# '/dev' directory.
#
# This is a space-separated list of pathnames. The option may be
# specified more than once. The option may use wildcard characters,
# but be aware that this is probably not what you want to do as the
# wildcarding will be expanded after files have been deleted. As
# such deleted files won't be whitelisted if wildcarded.
#
# NOTE: The user must take into consideration how often the file will
# appear and disappear from the system in relation to how often
# rkhunter is run. If the file appears, and disappears, too often
# then rkhunter may not notice this. All it will see is that the file
# has changed. The inode-number and DTM will certainly be different
# for each new file, and rkhunter will report this.
#
#EXISTWHITELIST=""
#
# Whitelist various attributes of the specified files.
# The attributes are those of the 'attributes' test.
# Specifying a file name here does not include it being
# whitelisted for the write permission test (see below).
#
# This is a space-separated list of filenames. The option may
# be specified more than once. The option may use wildcard
# characters.
#
#ATTRWHITELIST="/bin/ps /usr/bin/date"
#
# Allow the specified commands to have the 'others'
# (world) permission have the write-bit set.
#
# For example, files with permissions r-xr-xrwx
# or rwxrwxrwx.
#
# This is a space-separated list of filenames. The option may
# be specified more than once. The option may use wildcard
# characters.
#
#WRITEWHITELIST="/bin/ps /usr/bin/date"
#
# Allow the specified commands to be scripts.
#
# This is a space-separated list of filenames. The option may
# be specified more than once. The option may use wildcard
# characters.
#
#SCRIPTWHITELIST="/sbin/ifup /sbin/ifdown"
#SCRIPTWHITELIST="/usr/bin/groups"
#
# Allow the specified commands to have the immutable attribute set.
#
# This is a space-separated list of filenames. The option may
# be specified more than once. The option may use wildcard
# characters.
#
#IMMUTWHITELIST="/sbin/ifup /sbin/ifdown"
#
# If this option is set to 1, then the immutable-bit test is
# reversed. That is, the files are expected to have the bit set.
#
IMMUTABLE_SET=0
#
# Allow the specified hidden directories to be whitelisted.
#
# This is a space-separated list of directory pathnames.
# The option may be specified more than once. The option
# may use wildcard characters.
#
#ALLOWHIDDENDIR="/etc/.java"
#ALLOWHIDDENDIR="/dev/.udev /dev/.udevdb /dev/.udev.tdb"
#ALLOWHIDDENDIR="/dev/.static"
#ALLOWHIDDENDIR="/dev/.initramfs"
#ALLOWHIDDENDIR="/dev/.SRC-unix"
#ALLOWHIDDENDIR="/dev/.mdadm"
#
# Allow the specified hidden files to be whitelisted.
#
# This is a space-separated list of filenames. The option may
# be specified more than once. The option may use wildcard
# characters.
#
#ALLOWHIDDENFILE="/etc/.java"
#ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
#ALLOWHIDDENFILE="/etc/.pwd.lock"
#ALLOWHIDDENFILE="/etc/.init.state"
#ALLOWHIDDENFILE="/lib/.libcrypto.so.0.9.8e.hmac /lib/.libcrypto.so.6.hmac"
#ALLOWHIDDENFILE="/lib/.libssl.so.0.9.8e.hmac /lib/.libssl.so.6.hmac"
#ALLOWHIDDENFILE="/usr/bin/.fipscheck.hmac"
#ALLOWHIDDENFILE="/usr/bin/.ssh.hmac"
#ALLOWHIDDENFILE="/usr/lib/.libfipscheck.so.1.1.0.hmac"
#ALLOWHIDDENFILE="/usr/lib/.libfipscheck.so.1.hmac"
#ALLOWHIDDENFILE="/usr/lib/.libgcrypt.so.11.hmac"
#ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha1hmac.hmac"
#ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha256hmac.hmac"
#ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
#ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
#ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
#
# Allow the specified processes to use deleted files. The
# process name may be followed by a colon-separated list of
# full pathnames. The process will then only be whitelisted
# if it is using one of the given files. For example:
#
# ALLOWPROCDELFILE="/usr/libexec/gconfd-2:/tmp/abc:/var/tmp/xyz"
#
# This is a space-separated list of process names. The option
# may be specified more than once. The option may use wildcard
# characters, but only in the file names.
#
#ALLOWPROCDELFILE="/sbin/cardmgr /usr/sbin/gpm:/etc/X11/abc"
#ALLOWPROCDELFILE="/usr/libexec/gconfd-2"
#ALLOWPROCDELFILE="/usr/sbin/mysqld:/tmp/ib*"
#
# Allow the specified processes to listen on any network interface.
#
# This is a space-separated list of process names. The option
# may be specified more than once.
#
#ALLOWPROCLISTEN="/sbin/dhclient /usr/bin/dhcpcd"
#ALLOWPROCLISTEN="/usr/sbin/pppoe /usr/sbin/tcpdump"
#ALLOWPROCLISTEN="/usr/sbin/snort-plain"
#ALLOWPROCLISTEN="/usr/local/bin/wpa_supplicant"
#
# Allow the specified network interfaces to be in promiscuous mode.
#
# This is a space-separated list of interface names. The option may
# be specified more than once.
#
#ALLOWPROMISCIF="eth0"
#
# SCAN_MODE_DEV governs how we scan '/dev' for suspicious files.
# The two allowed options are: THOROUGH or LAZY.
# If commented out we do a THOROUGH scan which will increase the runtime.
# Even though this adds to the running time it is highly recommended to
# leave it like this.
#
#SCAN_MODE_DEV=THOROUGH
#
# The PHALANX2_DIRTEST option is used to indicate if the Phalanx2 test is to
# perform a basic check, or a more thorough check. If the option is set to 0,
# then a basic check is performed. If it is set to 1, then all the directries
# in the /etc and /usr directories are scanned. The default value is 0. Users
# should note that setting this option to 1 will cause the test to take longer
# to complete.
#
PHALANX2_DIRTEST=0
#
# Allow the specified files to be present in the /dev directory,
# and not regarded as suspicious.
#
# This is a space-separated list of pathnames. The option may
# be specified more than once. The option may use wildcard
# characters.
#
#ALLOWDEVFILE="/dev/shm/pulse-shm-*"
#ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
#
# This setting tells rkhunter where the inetd configuration
# file is located.
#
#INETD_CONF_PATH=/etc/inetd.conf
#
# Allow the following enabled inetd services.
#
# This is a space-separated list of service names. The option may
# be specified more than once.
#
# For non-Solaris users the simple service name should be used.
# For example:
#
# INETD_ALLOWED_SVC=echo
#
# For Solaris 9 users the simple service name should also be used, but
# if it is an RPC service, then the executable pathname should be used.
# For example:
#
# INETD_ALLOWED_SVC=imaps
# INETD_ALLOWED_SVC="/usr/sbin/rpc.metad /usr/sbin/rpc.metamhd"
#
# For Solaris 10 users the service/FMRI name should be used. For example:
#
# INETD_ALLOWED_SVC=/network/rpc/meta
# INETD_ALLOWED_SVC=/network/rpc/metamed
# INETD_ALLOWED_SVC=/application/font/stfsloader
# INETD_ALLOWED_SVC=/network/rpc-100235_1/rpc_ticotsord
#
#INETD_ALLOWED_SVC=echo
#
# This setting tells rkhunter where the xinetd configuration
# file is located.
#
#XINETD_CONF_PATH=/etc/xinetd.conf
#
# Allow the following enabled xinetd services. Whilst it would be
# nice to use the service names themselves, at the time of testing
# we only have the pathname available. As such, these entries are
# the xinetd file pathnames.
#
# This is a space-separated list of service names. The option may
# be specified more than once.
#
#XINETD_ALLOWED_SVC=/etc/xinetd.d/echo
#
# This option tells rkhunter the local system startup file pathnames.
# The directories will be searched for files. By default rkhunter
# will use certain filenames and directories. If the option is set
# to 'none', then certain tests will be skipped.
#
# This is a space-separated list of file and directory pathnames.
# The option may be specified more than once. The option may use
# wildcard characters.
#
#STARTUP_PATHS="/etc/rc.d /etc/rc.local"
#
# This setting tells rkhunter the pathname to the file containing the
# user account passwords. This setting will be worked out by rkhunter,
# and so should not usually need to be set. Users of TCB shadow files
# should not set this option.
#
#PASSWORD_FILE=/etc/shadow
#
# Allow the following accounts to be root equivalent. These accounts
# will have a UID value of zero. The 'root' account does not need to
# be listed as it is automatically whitelisted.
#
# This is a space-separated list of account names. The option may
# be specified more than once.
#
# NOTE: For *BSD systems you will probably need to use this option
# for the 'toor' account.
#
#UID0_ACCOUNTS="toor rooty"
#
# Allow the following accounts to have no password. NIS/YP entries do
# not need to be listed as they are automatically whitelisted.
#
# This is a space-separated list of account names. The option may
# be specified more than once.
#
#PWDLESS_ACCOUNTS="abc"
#
# This setting tells rkhunter the pathname to the syslog configuration
# file. This setting will be worked out by rkhunter, and so should not
# usually need to be set. A value of 'NONE' can be used to indicate
# that there is no configuration file, but that the syslog daemon process
# may be running.
#
# This is a space-separated list of pathnames. The option may
# be specified more than once.
#
#SYSLOG_CONFIG_FILE=/etc/syslog.conf
#
# This option permits the use of syslog remote logging.
#
ALLOW_SYSLOG_REMOTE_LOGGING=0
#
# Allow the following applications, or a specific version of an application,
# to be whitelisted. This option may be specified more than once, and is a
# space-separated list consisting of the application names. If a specific
# version is to be whitelisted, then the name must be followed by a colon
# and then the version number. For example:
#
# APP_WHITELIST="openssl:0.9.7d gpg httpd:1.3.29"
#
# Note above that for the Apache web server, the name 'httpd' is used.
#
#APP_WHITELIST=""
#
# Scan for suspicious files in directories containing temporary files and
# directories posing a relatively higher risk due to user write access.
# Please do not enable by default as suspscan is CPU and I/O intensive and prone to
# producing false positives. Do review all settings before usage.
# Also be aware that running suspscan in combination with verbose logging on,
# RKH's default, will show all ignored files.
# Please consider adding all directories the user the (web)server runs as has
# write access to including the document root (example: "/var/www") and log
# directories (example: "/var/log/httpd").
#
# This is a space-separated list of directory pathnames.
# The option may be specified more than once.
#
#SUSPSCAN_DIRS="/tmp /var/tmp"
#
# Directory for temporary files. A memory-based one is better (faster).
# Do not use a directory name that is listed in SUSPSCAN_DIRS.
# Please make sure you have a tempfs mounted and the directory exists.
#
SUSPSCAN_TEMP=/dev/shm
#
# Maximum filesize in bytes. Files larger than this will not be inspected.
# Do make sure you have enough space left in your temporary files directory.
#
SUSPSCAN_MAXSIZE=10240000
#
# Score threshold. Below this value no hits will be reported.
# A value of "200" seems "good" after testing on malware. Please adjust
# locally if necessary.
#
SUSPSCAN_THRESH=200
#
# The following option can be used to whitelist network ports which
# are known to have been used by malware. This option may be specified
# more than once. The option is a space-separated list of one or more
# of four types of whitelisting. These are:
#
# 1) a 'protocol:port' pair (e.g. TCP:25)
# 2) a pathname to an executable (e.g. /usr/sbin/squid)
# 3) a combined pathname, protocol and port
# (e.g. /usr/sbin/squid:TCP:3801)
# 4) an asterisk ('*')
#
# Only the UDP or TCP protocol may be specified, and the port number
# must be between 1 and 65535 inclusive.
#
# The asterisk can be used to indicate that any executable which rkhunter
# can locate as a command, is whitelisted. (See BINDIR in this file.)
#
# For example:
#
# PORT_WHITELIST="/home/user1/abc /opt/xyz TCP:2001 UDP:32011"
#
# NOTE: In order to whitelist a pathname, or use the asterisk option,
# the 'lsof' command must be present.
#
#PORT_WHITELIST=""
#
# The following option can be used to tell rkhunter where the operating
# system 'release' file is located. This file contains information
# specifying the current O/S version. RKH will store this information
# itself, and check to see if it has changed between each run. If it has
# changed, then the user is warned that RKH may issue warning messages
# until RKH has been run with the '--propupd' option.
#
# Since the contents of the file vary according to the O/S distribution,
# RKH will perform different actions when it detects the file itself. As
# such, this option should not be set unless necessary. If this option is
# specified, then RKH will assume the O/S release information is on the
# first non-blank line of the file.
#
#OS_VERSION_FILE="/etc/release"
#
# The following two options can be used to whitelist files and directories
# that would normally be flagged with a warning during the various rootkit
# and malware checks. If the file or directory name contains a space, then
# the percent character ('%') must be used instead. Only existing files and
# directories can be specified, and these must be full pathnames not links.
#
# Additionally, the RTKT_FILE_WHITELIST option may include a string after the
# file name (separated by a colon). This will then only whitelist that string
# in that file (as part of the malware checks). For example:
#
# RTKT_FILE_WHITELIST="/etc/rc.local:hdparm"
#
# If the option list includes the filename on its own as well, then the file
# will be whitelisted from rootkit checks of the files existence, but still
# only the specific string within the file will be whitelisted. For example:
#
# RTKT_FILE_WHITELIST="/etc/rc.local:hdparm /etc/rc.local"
#
# To whitelist a file from the existence checks, but not from the strings
# checks, then include the filename on its own and on its own but with
# just a colon appended. For example:
#
# RTKT_FILE_WHITELIST="/etc/rc.local /etc/rc.local:"
#
# NOTE: It is recommended that if you whitelist any files, then you include
# those files in the file properties check. See the USER_FILEPROP_FILES_DIRS
# configuration option.
#
# These are space-separated lists of file and directory pathnames.
# The options may be specified more than once.
#
#RTKT_DIR_WHITELIST=""
#RTKT_FILE_WHITELIST=""
#
# The following option can be used to whitelist shared library files that would
# normally be flagged with a warning during the preloaded shared library check.
# These library pathnames usually exist in the '/etc/ld.so.preload' file or in
# the LD_PRELOAD environment variable.
#
# NOTE: It is recommended that if you whitelist any files, then you include
# those files in the file properties check. See the USER_FILEPROP_FILES_DIRS
# configuration option.
#
# This is a space-separated list of library pathnames.
# The option may be specified more than once.
#
#SHARED_LIB_WHITELIST="/lib/snoopy.so"
#
# To force rkhunter to use the supplied script for the 'stat' or 'readlink'
# command, then the following two options can be used. The value must be
# set to 'BUILTIN'.
#
# NOTE: IRIX users will probably need to enable STAT_CMD.
#
#STAT_CMD=BUILTIN
#READLINK_CMD=BUILTIN
#
# In the file properties test any modification date/time is displayed as the
# number of epoch seconds. Rkhunter will try and use the 'date' command, or
# failing that the 'perl' command, to display the date and time in a
# human-readable format as well. This option may be used if some other command
# should be used instead. The given command must understand the '%s' and
# 'seconds ago' options found in the GNU date command.
#
# A value of 'NONE' may be used to request that only the epoch seconds be shown.
# A value of 'PERL' may be used to force rkhunter to use the 'perl' command, if
# it is present.
#
#EPOCH_DATE_CMD=""
#
# This setting tells rkhunter the directory containing the available
# Linux kernel modules. This setting will be worked out by rkhunter,
# and so should not usually need to be set.
#
#MODULES_DIR=""
#
# The following option can be set to a command which rkhunter will use when
# downloading files from the Internet - that is, when the '--update' or
# '--versioncheck' option is used. The command can take options.
#
# This allows the user to use a command other than the one automatically
# selected by rkhunter, but still one which it already knows about.
# For example:
#
# WEB_CMD=curl
#
# Alternatively, the user may specify a completely new command. However, note
# that rkhunter expects the downloaded file to be written to stdout, and that
# everything written to stderr is ignored. For example:
#
# WEB_CMD="/opt/bin/dlfile --timeout 5m -q"
#
# *BSD users may want to use the 'ftp' command, provided that it supports
# the HTTP protocol:
#
# WEB_CMD="ftp -o -"
#
#WEB_CMD=""
#
# Set the following option to 0 if you do not want to receive a warning if
# any O/S information has changed since the last run of 'rkhunter --propupd'.
# The warnings occur during the file properties check. The default is to
# issue a warning if something has changed.
#
#WARN_ON_OS_CHANGE=1
#
# Set the following option to 1 if you want rkhunter to automatically run
# a file properties update ('--propupd') if the O/S has changed. Detection
# of an O/S change occurs during the file properties check. The default is
# not to do an automatic update.
#
# WARNING: Only set this option if you are sure that the update will work
# correctly. That is, that the database directory is writeable, that a valid
# hash function is available, and so on. This can usually be checked simply
# by running 'rkhunter --propupd' at least once.
#
#UPDT_ON_OS_CHANGE=0
#
# Set the following option to 1 if locking is to be used when rkhunter runs.
# The lock is set just before logging starts, and is removed when the program
# ends. It is used to prevent items such as the log file, and the file
# properties file, from becoming corrupted if rkhunter is running more than
# once. The mechanism used is to simply create a lock file in the TMPDIR
# directory. If the lock file already exists, because rkhunter is already
# running, then the current process simply loops around sleeping for 10 seconds
# and then retrying the lock.
#
# The default is not to use locking.
#
USE_LOCKING=0
#
# If locking is used, then rkhunter may have to wait to get the lock file.
# This option sets the total amount of time, in seconds, that rkhunter should
# wait. It will retry the lock every 10 seconds, until either it obtains the
# lock or the timeout value has been reached. If no value is set, then a
# default of 300 seconds (5 minutes) is used.
#
LOCK_TIMEOUT=300
#
# If locking is used, then rkhunter may be doing nothing for some time if it
# has to wait for the lock. Some simple messages are echo'd to the users screen
# to let them know that rkhunter is waiting for the lock. Set this option to 0
# if the messages are not to be displayed. The default is to show them.
#
SHOW_LOCK_MSGS=1
#
# If the option SCANROOTKITMODE is set to "THOROUGH" the scanrootkit() function
# will search (on a per rootkit basis) for filenames in all of the directories (as defined
# by the result of running 'find / -xdev'). While still not optimal, as it
# still searches for only file names as opposed to file contents, this is one step away
# from the rigidity of searching in known (evidence) or default (installation) locations.
#
# THIS OPTION SHOULD NOT BE ENABLED BY DEFAULT.
#
# You should only activate this feature as part of a more thorough investigation which
# should be based on relevant best practices and procedures.
#
# Enabling this feature implies you have the knowledge to interpret the results properly.
#
#SCANROOTKITMODE=THOROUGH
#
# The following option can be set to the name(s) of the tests the 'unhide' command is
# to use. In order to maintain compatibility with older versions of 'unhide', this
# option defaults to 'sys'. Options such as '-m' and '-v' may also be specified, but
# will only take effect when they are seen. The test names are a space-separated list,
# and will be executed in the order given.
#
#UNHIDE_TESTS="sys"
#
# If both the C 'unhide', and Ruby 'unhide.rb', programs exist on the system, then it
# is possible to disable the execution of one of the programs if desired. By default
# rkhunter will look for both programs, and execute each of them as they are found.
# If the value of this option is 0, then both programs will be executed if they are
# present. A value of 1 will disable execution of the C 'unhide' program, and a value
# of 2 will disable the Ruby 'unhide.rb' program. The default value is 0. To disable
# both programs, then disable the 'hidden_procs' test.
#
#DISABLE_UNHIDE=0
#
INSTALLDIR=/tmp/rkhunter/tmp
general-ccdc/linux/wrap/wrap-install.sh
Executable
+32
View File
@@ -0,0 +1,32 @@
#!/bin/sh
# replaces binaries in $PATH with symlinks to wrap.sh
truth=/usr/lib/bin
wrap_location="/usr/bin/wrap.sh"
default_replace="nc bash sh python python2 python3 ruby"
wrapify () {
cmd="$0"
if which $0; then
cmd_origin="$(which "$cmd")"
echo "wrapping $cmd_origin -> $truth/$cmd"
mv "$cmd_origin" "$truth/"
ln -s "$wrap_location" "$cmd_origin"
else
echo "skipped $cmd: not found in PATH $PATH"
fi
}
main () {
if [ "$#" -gt 0 ]; then
REPLACE="$@"
else
REPLACE="$default_replace"
fi
for command_name in $REPLACE; do
wrapify $command_name
done
}
main "$@"
general-ccdc/linux/wrap/wrap.sh
Executable
+10
View File
@@ -0,0 +1,10 @@
#!/bin/sh
truth=/usr/lib/bin
out=/var/lib/log
server=10.0.0.1
port=12345
echo "$(hostname) $0 $@" >> $out &
#echo "$(hostname) $0 $@" | nc $server $port &
PATH="$truth:$PATH" exec "$(basename "$0")" "$@"
general-ccdc/palo_alto_firewall/bridging-firewall-network.net
Executable
+19
View File
@@ -0,0 +1,19 @@
XXX = 0.0.0.0/32
PUBLIC_DNS = 8.8.8.8/32
#######
# POD #
#######
# TRUSTED
FIREWALL = 192.168.10.1/32
DESKTOP1 = 192.168.10.50/32
SERVER = 192.168.10.10/32
POD = FIREWALL
DESKTOP1
SERVER
# UNTRUSTED
DESKTOP2 = 172.20.1.10/32
general-ccdc/palo_alto_firewall/bridging-firewall-policy.pol
Executable
+87
View File
@@ -0,0 +1,87 @@
################
### RULEBASE ###
################
# rulebase -> security -> rules
# Defaults (if not specified):
# source = any
# destination = any
# application = any
# service = application-default
# New variables (?):
# rule-type
# service
# application
header {
target:: paloaltofw from Pod-public to Firewall
}
term allow-ping-Firewall {
destination-address:: FIREWALL
protocol:: icmp
action:: allow
}
term allow-ssh-Firewall {
destination-address:: FIREWALL
destination-port:: SSH
protocol:: tcp
action:: allow
}
term allow-https-Firewall {
destination-address:: FIREWALL
destination-port:: HTTPS
protocol:: tcp
action:: allow
}
header {
target:: paloaltofw from Pod-Private to Pod-Private
}
term allow-icmp{
source:: POD
destination:: POD
rule-type:: intrazone
protocol:: icmp
action:: allow
}
term allow-ssh{
source:: POD
destination:: POD
rule-type:: intrazone
destination-port:: SSH
protocol:: tcp
action:: allow
}
header {
target:: paloaltofw from Pod-Public to Internet
}
term allow-any {
source:: POD
action:: allow
}
header {
target:: paloaltofw from Internet to Firewall
}
term allow-ping{
destination:: FIREWALL
protocol:: icmp
action:: allow
}
# rulebase -> default-security-rules -> rules
header {
target:: paloaltofw default-security-rules
}
term intrazone-default{
action:: deny
}
general-ccdc/palo_alto_firewall/bridging-firewall.txt
Executable
+112
View File
@@ -0,0 +1,112 @@
Network diagram for the following configuration
Upstream router
|
| DHCP (Internet “untrust”)
+--1-------+
| firewall | ---------------------
+--2----3--+
| | 192.168.10.0/24 (local network “pod”)
/ \
Machine1 Machine2
The firewall bridges the machines on the local network and enforces a firewall
policy on that bridge. The firewall also routes traffic between the local
network and the Internet.
Overall policy:
Pod -> firewall allow ping, HTTPS, SSH
Pod <-> Pod allow ping, SSH
Pod -> Internet allow
Internet -> firewall allow ping
default not allowed
Configuration:
network {
interface {
ethernet {
ethernet1/1 {
layer3 { interface-management-profile allow-ping; dhcp-client; }
}
ethernet1/2 { layer2; }
ethernet1/3 { layer2; }
}
vlan {
units {
vlan.pod {
ip { 192.168.10.1/24; }
interface-management-profile allow-mgmt;
}
}
}
}
profiles {
interface-management-profile {
allow-mgmt { https yes; ssh yes; ping yes; }
allow-ping { ssh no; ping yes; }
}
}
virtual-router {
student-vr { interface [ ethernet1/1 vlan.pod ]; }
}
vlan {
Pod {
virtual-interface { interface vlan.pod; }
interface [ ethernet1/2 ethernet1/3 ];
}
}
}
zone {
Untrust-L3 {
network { layer3 ethernet1/1; }
}
Pod-L3 {
network { layer3 vlan.pod; }
}
Pod-L2 {
network { layer2 [ ethernet1/2 ethernet1/3 ]; }
}
}
rulebase {
security {
rules {
Pod2Untrust {
from Pod-L3;
source any;
to Untrust-L3;
destination any;
application any;
service application-default;
action allow;
}
Pod2Pod {
rule-type intrazone;
from Pod-L2;
source any;
to Pod-L2;
destination any;
application [ icmp ping ssh ];
service application-default;
action allow;
}
Pod2Firewall {
from Pod-L3;
source any;
to Pod-L3;
destination 192.168.10.1;
application any;
service application-default;
action allow;
}
}
}
default-security-rules {
rules {
intrazone-default { action deny; }
}
}
}
general-ccdc/palo_alto_firewall/example-addressbook.xml
Executable
+679
View File
@@ -0,0 +1,679 @@
<?xml version="1.0"?>
<config version="7.0.0" urldb="paloaltonetworks">
<mgt-config>
<users>
<entry name="admin">
<phash>$1$djqumuui$ScFd4Q6nPSQn25ch1FjKn.</phash>
<permissions>
<role-based>
<superuser>yes</superuser>
</role-based>
</permissions>
</entry>
</users>
</mgt-config>
<shared>
<application/>
<application-group/>
<service/>
<service-group/>
<botnet>
<configuration>
<http>
<dynamic-dns>
<enabled>yes</enabled>
<threshold>5</threshold>
</dynamic-dns>
<malware-sites>
<enabled>yes</enabled>
<threshold>5</threshold>
</malware-sites>
<recent-domains>
<enabled>yes</enabled>
<threshold>5</threshold>
</recent-domains>
<ip-domains>
<enabled>yes</enabled>
<threshold>10</threshold>
</ip-domains>
<executables-from-unknown-sites>
<enabled>yes</enabled>
<threshold>5</threshold>
</executables-from-unknown-sites>
</http>
<other-applications>
<irc>yes</irc>
</other-applications>
<unknown-applications>
<unknown-tcp>
<destinations-per-hour>10</destinations-per-hour>
<sessions-per-hour>10</sessions-per-hour>
<session-length>
<maximum-bytes>100</maximum-bytes>
<minimum-bytes>50</minimum-bytes>
</session-length>
</unknown-tcp>
<unknown-udp>
<destinations-per-hour>10</destinations-per-hour>
<sessions-per-hour>10</sessions-per-hour>
<session-length>
<maximum-bytes>100</maximum-bytes>
<minimum-bytes>50</minimum-bytes>
</session-length>
</unknown-udp>
</unknown-applications>
</configuration>
<report>
<topn>100</topn>
<scheduled>yes</scheduled>
</report>
</botnet>
<content-preview>
<application/>
<application-type>
<category/>
<technology/>
</application-type>
</content-preview>
</shared>
<devices>
<entry name="localhost.localdomain">
<network>
<interface>
<ethernet>
<entry name="ethernet1/2">
<layer3>
<ip>
<entry name="192.168.10.1/24"/>
</ip>
<interface-management-profile>allow-mgmt</interface-management-profile>
</layer3>
</entry>
<entry name="ethernet1/1">
<layer3>
<ipv6>
<neighbor-discovery>
<router-advertisement>
<enable>no</enable>
</router-advertisement>
</neighbor-discovery>
</ipv6>
<ndp-proxy>
<enabled>no</enabled>
</ndp-proxy>
<lldp>
<enable>no</enable>
</lldp>
<interface-management-profile>allow-gw-mgmt</interface-management-profile>
<dhcp-client/>
</layer3>
</entry>
<entry name="ethernet1/3">
<layer3>
<ipv6>
<neighbor-discovery>
<router-advertisement>
<enable>no</enable>
</router-advertisement>
</neighbor-discovery>
</ipv6>
<ndp-proxy>
<enabled>no</enabled>
</ndp-proxy>
<lldp>
<enable>no</enable>
</lldp>
<ip>
<entry name="172.20.1.1/24"/>
</ip>
<interface-management-profile>allow-ping</interface-management-profile>
</layer3>
</entry>
</ethernet>
<loopback>
<units>
<entry name="loopback.1">
<ip>
<entry name="192.168.1.1"/>
</ip>
<comment>Mgmt Port Interface IP</comment>
</entry>
</units>
</loopback>
</interface>
<profiles>
<monitor-profile>
<entry name="default">
<interval>3</interval>
<threshold>5</threshold>
<action>wait-recover</action>
</entry>
</monitor-profile>
<interface-management-profile>
<entry name="allow-mgmt">
<https>yes</https>
<ssh>yes</ssh>
<ping>yes</ping>
</entry>
<entry name="allow-ping">
<ssh>no</ssh>
<ping>yes</ping>
</entry>
<entry name="allow-gw-mgmt">
<permitted-ip>
<entry name="10.20.20.253"/>
</permitted-ip>
<https>yes</https>
<ssh>yes</ssh>
<ping>yes</ping>
<telnet>no</telnet>
</entry>
</interface-management-profile>
</profiles>
<ike>
<crypto-profiles>
<ike-crypto-profiles>
<entry name="default">
<encryption>
<member>aes-128-cbc</member>
<member>3des</member>
</encryption>
<hash>
<member>sha1</member>
</hash>
<dh-group>
<member>group2</member>
</dh-group>
<lifetime>
<hours>8</hours>
</lifetime>
</entry>
<entry name="Suite-B-GCM-128">
<encryption>
<member>aes-128-cbc</member>
</encryption>
<hash>
<member>sha256</member>
</hash>
<dh-group>
<member>group19</member>
</dh-group>
<lifetime>
<hours>8</hours>
</lifetime>
</entry>
<entry name="Suite-B-GCM-256">
<encryption>
<member>aes-256-cbc</member>
</encryption>
<hash>
<member>sha384</member>
</hash>
<dh-group>
<member>group20</member>
</dh-group>
<lifetime>
<hours>8</hours>
</lifetime>
</entry>
</ike-crypto-profiles>
<ipsec-crypto-profiles>
<entry name="default">
<esp>
<encryption>
<member>aes-128-cbc</member>
<member>3des</member>
</encryption>
<authentication>
<member>sha1</member>
</authentication>
</esp>
<dh-group>group2</dh-group>
<lifetime>
<hours>1</hours>
</lifetime>
</entry>
<entry name="Suite-B-GCM-128">
<esp>
<encryption>
<member>aes-128-gcm</member>
</encryption>
<authentication>
<member>none</member>
</authentication>
</esp>
<dh-group>group19</dh-group>
<lifetime>
<hours>1</hours>
</lifetime>
</entry>
<entry name="Suite-B-GCM-256">
<esp>
<encryption>
<member>aes-256-gcm</member>
</encryption>
<authentication>
<member>none</member>
</authentication>
</esp>
<dh-group>group20</dh-group>
<lifetime>
<hours>1</hours>
</lifetime>
</entry>
</ipsec-crypto-profiles>
<global-protect-app-crypto-profiles>
<entry name="default">
<encryption>
<member>aes-128-cbc</member>
</encryption>
<authentication>
<member>sha1</member>
</authentication>
</entry>
</global-protect-app-crypto-profiles>
</crypto-profiles>
</ike>
<qos>
<profile>
<entry name="default">
<class>
<entry name="class1">
<priority>real-time</priority>
</entry>
<entry name="class2">
<priority>high</priority>
</entry>
<entry name="class3">
<priority>high</priority>
</entry>
<entry name="class4">
<priority>medium</priority>
</entry>
<entry name="class5">
<priority>medium</priority>
</entry>
<entry name="class6">
<priority>low</priority>
</entry>
<entry name="class7">
<priority>low</priority>
</entry>
<entry name="class8">
<priority>low</priority>
</entry>
</class>
</entry>
</profile>
</qos>
<virtual-router>
<entry name="default">
<protocol>
<bgp>
<enable>no</enable>
<dampening-profile>
<entry name="default">
<cutoff>1.25</cutoff>
<reuse>0.5</reuse>
<max-hold-time>900</max-hold-time>
<decay-half-life-reachable>300</decay-half-life-reachable>
<decay-half-life-unreachable>900</decay-half-life-unreachable>
<enable>yes</enable>
</entry>
</dampening-profile>
</bgp>
</protocol>
</entry>
<entry name="student-vr">
<interface>
<member>ethernet1/1</member>
<member>ethernet1/2</member>
<member>loopback.1</member>
<member>ethernet1/3</member>
</interface>
<ecmp>
<algorithm>
<ip-modulo/>
</algorithm>
</ecmp>
<protocol>
<bgp>
<routing-options>
<graceful-restart>
<enable>yes</enable>
</graceful-restart>
<as-format>2-byte</as-format>
</routing-options>
<enable>no</enable>
</bgp>
</protocol>
</entry>
</virtual-router>
</network>
<deviceconfig>
<system>
<update-server>updates.paloaltonetworks.com</update-server>
<update-schedule>
<threats>
<recurring>
<weekly>
<day-of-week>wednesday</day-of-week>
<at>01:02</at>
<action>download-only</action>
</weekly>
</recurring>
</threats>
</update-schedule>
<timezone>US/Pacific</timezone>
<service>
<disable-telnet>yes</disable-telnet>
<disable-http>yes</disable-http>
</service>
<hostname>PA-VM</hostname>
<dns-setting>
<servers>
<primary>8.8.8.8</primary>
<secondary>8.8.4.4</secondary>
</servers>
</dns-setting>
<route>
<service>
<entry name="crl-status">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="dns">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="email">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="hsm">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="kerberos">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="ldap">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="mdm">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="netflow">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="ntp">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="paloalto-updates">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="panorama">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="proxy">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="radius">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="snmp">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="syslog">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="tacplus">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="uid-agent">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="url-updates">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="vmmonitor">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="wildfire-private">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
<entry name="wildfire-public">
<source>
<address>192.168.1.1</address>
<interface>loopback.1</interface>
</source>
</entry>
</service>
</route>
<ntp-servers>
<primary-ntp-server>
<ntp-server-address>0.north-america.pool.ntp.org</ntp-server-address>
<authentication-type>
<none/>
</authentication-type>
</primary-ntp-server>
<secondary-ntp-server>
<ntp-server-address>1.north-america.pool.ntp.org</ntp-server-address>
<authentication-type>
<none/>
</authentication-type>
</secondary-ntp-server>
</ntp-servers>
</system>
<setting>
<config>
<rematch>yes</rematch>
</config>
<management>
<hostname-type-in-syslog>FQDN</hostname-type-in-syslog>
</management>
<auto-mac-detect>yes</auto-mac-detect>
</setting>
</deviceconfig>
<vsys>
<entry name="vsys1">
<application/>
<application-group/>
<zone>
<entry name="Trust-L3">
<network>
<layer3>
<member>ethernet1/2</member>
</layer3>
</network>
</entry>
<entry name="Untrust-L3">
<network>
<layer3>
<member>ethernet1/1</member>
<member>ethernet1/3</member>
</layer3>
</network>
</entry>
<entry name="Mgmt-L3">
<network>
<layer3>
<member>loopback.1</member>
</layer3>
</network>
</entry>
</zone>
<service/>
<service-group/>
<schedule/>
<rulebase>
<nat>
<rules>
<entry name="MGMT-NAT-OUT">
<source-translation>
<dynamic-ip-and-port>
<interface-address>
<interface>ethernet1/1</interface>
</interface-address>
</dynamic-ip-and-port>
</source-translation>
<to>
<member>Untrust-L3</member>
</to>
<from>
<member>Mgmt-L3</member>
</from>
<source>
<member>192.168.1.1</member>
</source>
<destination>
<member>any</member>
</destination>
<service>any</service>
<to-interface>ethernet1/1</to-interface>
</entry>
</rules>
</nat>
<security>
<rules>
<entry name="MGMT-PORT-OUT">
<to>
<member>Untrust-L3</member>
</to>
<from>
<member>Mgmt-L3</member>
</from>
<source>
<member>192.168.1.1</member>
</source>
<destination>
<member>any</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<application>
<member>any</member>
</application>
<service>
<member>any</member>
</service>
<hip-profiles>
<member>any</member>
</hip-profiles>
<action>allow</action>
<description>DO NOT TAMPER WITH THIS POLICY</description>
</entry>
<entry name="allow-dns">
<from>
<member>Trust-L3</member>
</from>
<to>
<member>Untrust-L3</member>
</to>
<source>
<member>any</member>
</source>
<application>
<member>dns</member>
</application>
<service>
<member>application-default</member>
</service>
<action>allow</action>
<destination>
<member>GOOGLE_DNS</member>
</destination>
</entry>
</rules>
</security>
</rulebase>
<import>
<network>
<interface>
<member>ethernet1/1</member>
<member>loopback.1</member>
<member>ethernet1/3</member>
</interface>
</network>
</import>
<address>
<entry name="GOOGLE_DNS_0">
<ip-netmask>8.8.8.8/32</ip-netmask>
</entry>
<entry name="GOOGLE_DNS_1">
<ip-netmask>8.8.4.4/32</ip-netmask>
</entry>
</address>
<address-group>
<entry name="GOOGLE_DNS">
<static>
<member>GOOGLE_DNS_0</member>
<member>GOOGLE_DNS_1</member>
</static>
</entry>
</address-group>
</entry>
</vsys>
</entry>
</devices>
</config>
general-ccdc/palo_alto_firewall/example-config.txt
Executable
+351
View File
@@ -0,0 +1,351 @@
deviceconfig {
system {
ip-address 10.1.1.1;
netmask 255.255.255.0;
update-server updates.paloaltonetworks.com;
update-schedule {
threats {
recurring {
weekly {
day-of-week wednesday;
at 01:02;
action download-only;
}
}
}
}
timezone US/Pacific;
service {
disable-telnet yes;
disable-http yes;
}
hostname PA-VM;
default-gateway 10.1.1.254;
dns-setting {
servers {
primary 8.8.8.8;
secondary 8.8.4.4;
}
}
}
setting {
config {
rematch yes;
}
management {
hostname-type-in-syslog FQDN;
}
auto-mac-detect yes;
}
}
network {
interface {
ethernet {
ethernet1/2 {
layer3 {
ip {
192.168.10.1/24;
}
interface-management-profile allow-mgmt;
}
}
ethernet1/1 {
layer3 {
ipv6 {
neighbor-discovery {
router-advertisement {
enable no;
}
}
}
ndp-proxy {
enabled no;
}
lldp {
enable no;
}
interface-management-profile allow-ping;
dhcp-client;
}
}
}
}
profiles {
monitor-profile {
default {
interval 3;
threshold 5;
action wait-recover;
}
}
interface-management-profile {
allow-mgmt {
https yes;
ssh yes;
ping yes;
}
allow-ping {
ssh no;
ping yes;
}
}
}
ike {
crypto-profiles {
ike-crypto-profiles {
default {
encryption [ aes-128-cbc 3des];
hash sha1;
dh-group group2;
lifetime {
hours 8;
}
}
Suite-B-GCM-128 {
encryption aes-128-cbc;
hash sha256;
dh-group group19;
lifetime {
hours 8;
}
}
Suite-B-GCM-256 {
encryption aes-256-cbc;
hash sha384;
dh-group group20;
lifetime {
hours 8;
}
}
}
ipsec-crypto-profiles {
default {
esp {
encryption [ aes-128-cbc 3des];
authentication sha1;
}
dh-group group2;
lifetime {
hours 1;
}
}
Suite-B-GCM-128 {
esp {
encryption aes-128-gcm;
authentication none;
}
dh-group group19;
lifetime {
hours 1;
}
}
Suite-B-GCM-256 {
esp {
encryption aes-256-gcm;
authentication none;
}
dh-group group20;
lifetime {
hours 1;
}
}
}
global-protect-app-crypto-profiles {
default {
encryption aes-128-cbc;
authentication sha1;
}
}
}
}
qos {
profile {
default {
class {
class1 {
priority real-time;
}
class2 {
priority high;
}
class3 {
priority high;
}
class4 {
priority medium;
}
class5 {
priority medium;
}
class6 {
priority low;
}
class7 {
priority low;
}
class8 {
priority low;
}
}
}
}
}
virtual-router {
default {
protocol {
bgp {
enable no;
dampening-profile {
default {
cutoff 1.25;
reuse 0.5;
max-hold-time 900;
decay-half-life-reachable 300;
decay-half-life-unreachable 900;
enable yes;
}
}
}
}
}
student-vr {
interface [ ethernet1/2 ethernet1/1];
}
}
}
shared {
application;
application-group;
service;
service-group;
botnet {
configuration {
http {
dynamic-dns {
enabled yes;
threshold 5;
}
malware-sites {
enabled yes;
threshold 5;
}
recent-domains {
enabled yes;
threshold 5;
}
ip-domains {
enabled yes;
threshold 10;
}
executables-from-unknown-sites {
enabled yes;
threshold 5;
}
}
other-applications {
irc yes;
}
unknown-applications {
unknown-tcp {
destinations-per-hour 10;
sessions-per-hour 10;
session-length {
maximum-bytes 100;
minimum-bytes 50;
}
}
unknown-udp {
destinations-per-hour 10;
sessions-per-hour 10;
session-length {
maximum-bytes 100;
minimum-bytes 50;
}
}
}
}
report {
topn 100;
scheduled yes;
}
}
content-preview {
application;
application-type {
category;
technology;
}
}
}
zone {
Trust-L3 {
network {
layer3 ethernet1/2;
}
}
Untrust-L3 {
network {
layer3 ethernet1/1;
}
}
}
service-group;
service;
schedule;
rulebase {
nat {
rules {
POD-NAT-OUT {
source-translation {
dynamic-ip-and-port {
interface-address {
interface ethernet1/1;
}
}
}
to Untrust-L3;
from Trust-L3;
source any;
destination any;
service any;
description "Outbound NAT for POD";
to-interface ethernet1/1;
}
}
}
security {
rules {
Basic-Allowed-Apps {
to Untrust-L3;
from Trust-L3;
source any;
destination any;
source-user any;
category any;
service application-default;
hip-profiles any;
action allow;
application any;
}
}
}
}
import {
network {
interface ethernet1/1;
}
}
application-group;
application;
mgt-config {
users {
admin {
phash $1$djqumuui$ScFd4Q6nPSQn25ch1FjKn.;
permissions {
role-based {
superuser yes;
}
}
}
}
}
general-ccdc/palo_alto_firewall/example-config.xml
Executable
+433
View File
@@ -0,0 +1,433 @@
<?xml version="1.0"?>
<config version="7.0.0" urldb="paloaltonetworks">
<mgt-config>
<users>
<entry name="admin">
<phash>$1$djqumuui$ScFd4Q6nPSQn25ch1FjKn.</phash>
<permissions>
<role-based>
<superuser>yes</superuser>
</role-based>
</permissions>
</entry>
</users>
</mgt-config>
<shared>
<application/>
<application-group/>
<service/>
<service-group/>
<botnet>
<configuration>
<http>
<dynamic-dns>
<enabled>yes</enabled>
<threshold>5</threshold>
</dynamic-dns>
<malware-sites>
<enabled>yes</enabled>
<threshold>5</threshold>
</malware-sites>
<recent-domains>
<enabled>yes</enabled>
<threshold>5</threshold>
</recent-domains>
<ip-domains>
<enabled>yes</enabled>
<threshold>10</threshold>
</ip-domains>
<executables-from-unknown-sites>
<enabled>yes</enabled>
<threshold>5</threshold>
</executables-from-unknown-sites>
</http>
<other-applications>
<irc>yes</irc>
</other-applications>
<unknown-applications>
<unknown-tcp>
<destinations-per-hour>10</destinations-per-hour>
<sessions-per-hour>10</sessions-per-hour>
<session-length>
<maximum-bytes>100</maximum-bytes>
<minimum-bytes>50</minimum-bytes>
</session-length>
</unknown-tcp>
<unknown-udp>
<destinations-per-hour>10</destinations-per-hour>
<sessions-per-hour>10</sessions-per-hour>
<session-length>
<maximum-bytes>100</maximum-bytes>
<minimum-bytes>50</minimum-bytes>
</session-length>
</unknown-udp>
</unknown-applications>
</configuration>
<report>
<topn>100</topn>
<scheduled>yes</scheduled>
</report>
</botnet>
<content-preview>
<application/>
<application-type>
<category/>
<technology/>
</application-type>
</content-preview>
</shared>
<devices>
<entry name="localhost.localdomain">
<network>
<interface>
<ethernet>
<entry name="ethernet1/2">
<layer3>
<ip>
<entry name="192.168.10.1/24"/>
</ip>
<interface-management-profile>allow-mgmt</interface-management-profile>
</layer3>
</entry>
<entry name="ethernet1/1">
<layer3>
<ipv6>
<neighbor-discovery>
<router-advertisement>
<enable>no</enable>
</router-advertisement>
</neighbor-discovery>
</ipv6>
<ndp-proxy>
<enabled>no</enabled>
</ndp-proxy>
<lldp>
<enable>no</enable>
</lldp>
<interface-management-profile>allow-ping</interface-management-profile>
<dhcp-client/>
</layer3>
</entry>
</ethernet>
</interface>
<profiles>
<monitor-profile>
<entry name="default">
<interval>3</interval>
<threshold>5</threshold>
<action>wait-recover</action>
</entry>
</monitor-profile>
<interface-management-profile>
<entry name="allow-mgmt">
<https>yes</https>
<ssh>yes</ssh>
<ping>yes</ping>
</entry>
<entry name="allow-ping">
<ssh>no</ssh>
<ping>yes</ping>
</entry>
</interface-management-profile>
</profiles>
<ike>
<crypto-profiles>
<ike-crypto-profiles>
<entry name="default">
<encryption>
<member>aes-128-cbc</member>
<member>3des</member>
</encryption>
<hash>
<member>sha1</member>
</hash>
<dh-group>
<member>group2</member>
</dh-group>
<lifetime>
<hours>8</hours>
</lifetime>
</entry>
<entry name="Suite-B-GCM-128">
<encryption>
<member>aes-128-cbc</member>
</encryption>
<hash>
<member>sha256</member>
</hash>
<dh-group>
<member>group19</member>
</dh-group>
<lifetime>
<hours>8</hours>
</lifetime>
</entry>
<entry name="Suite-B-GCM-256">
<encryption>
<member>aes-256-cbc</member>
</encryption>
<hash>
<member>sha384</member>
</hash>
<dh-group>
<member>group20</member>
</dh-group>
<lifetime>
<hours>8</hours>
</lifetime>
</entry>
</ike-crypto-profiles>
<ipsec-crypto-profiles>
<entry name="default">
<esp>
<encryption>
<member>aes-128-cbc</member>
<member>3des</member>
</encryption>
<authentication>
<member>sha1</member>
</authentication>
</esp>
<dh-group>group2</dh-group>
<lifetime>
<hours>1</hours>
</lifetime>
</entry>
<entry name="Suite-B-GCM-128">
<esp>
<encryption>
<member>aes-128-gcm</member>
</encryption>
<authentication>
<member>none</member>
</authentication>
</esp>
<dh-group>group19</dh-group>
<lifetime>
<hours>1</hours>
</lifetime>
</entry>
<entry name="Suite-B-GCM-256">
<esp>
<encryption>
<member>aes-256-gcm</member>
</encryption>
<authentication>
<member>none</member>
</authentication>
</esp>
<dh-group>group20</dh-group>
<lifetime>
<hours>1</hours>
</lifetime>
</entry>
</ipsec-crypto-profiles>
<global-protect-app-crypto-profiles>
<entry name="default">
<encryption>
<member>aes-128-cbc</member>
</encryption>
<authentication>
<member>sha1</member>
</authentication>
</entry>
</global-protect-app-crypto-profiles>
</crypto-profiles>
</ike>
<qos>
<profile>
<entry name="default">
<class>
<entry name="class1">
<priority>real-time</priority>
</entry>
<entry name="class2">
<priority>high</priority>
</entry>
<entry name="class3">
<priority>high</priority>
</entry>
<entry name="class4">
<priority>medium</priority>
</entry>
<entry name="class5">
<priority>medium</priority>
</entry>
<entry name="class6">
<priority>low</priority>
</entry>
<entry name="class7">
<priority>low</priority>
</entry>
<entry name="class8">
<priority>low</priority>
</entry>
</class>
</entry>
</profile>
</qos>
<virtual-router>
<entry name="default">
<protocol>
<bgp>
<enable>no</enable>
<dampening-profile>
<entry name="default">
<cutoff>1.25</cutoff>
<reuse>0.5</reuse>
<max-hold-time>900</max-hold-time>
<decay-half-life-reachable>300</decay-half-life-reachable>
<decay-half-life-unreachable>900</decay-half-life-unreachable>
<enable>yes</enable>
</entry>
</dampening-profile>
</bgp>
</protocol>
</entry>
<entry name="student-vr">
<interface>
<member>ethernet1/2</member>
<member>ethernet1/1</member>
</interface>
</entry>
</virtual-router>
</network>
<deviceconfig>
<system>
<ip-address>10.1.1.1</ip-address>
<netmask>255.255.255.0</netmask>
<update-server>updates.paloaltonetworks.com</update-server>
<update-schedule>
<threats>
<recurring>
<weekly>
<day-of-week>wednesday</day-of-week>
<at>01:02</at>
<action>download-only</action>
</weekly>
</recurring>
</threats>
</update-schedule>
<timezone>US/Pacific</timezone>
<service>
<disable-telnet>yes</disable-telnet>
<disable-http>yes</disable-http>
</service>
<hostname>PA-VM</hostname>
<default-gateway>10.1.1.254</default-gateway>
<dns-setting>
<servers>
<primary>8.8.8.8</primary>
<secondary>8.8.4.4</secondary>
</servers>
</dns-setting>
</system>
<setting>
<config>
<rematch>yes</rematch>
</config>
<management>
<hostname-type-in-syslog>FQDN</hostname-type-in-syslog>
</management>
<auto-mac-detect>yes</auto-mac-detect>
</setting>
</deviceconfig>
<vsys>
<entry name="vsys1">
<application/>
<application-group/>
<zone>
<entry name="Trust-L3">
<network>
<layer3>
<member>ethernet1/2</member>
</layer3>
</network>
</entry>
<entry name="Untrust-L3">
<network>
<layer3>
<member>ethernet1/1</member>
</layer3>
</network>
</entry>
</zone>
<service/>
<service-group/>
<schedule/>
<rulebase>
<nat>
<rules>
<entry name="POD-NAT-OUT">
<source-translation>
<dynamic-ip-and-port>
<interface-address>
<interface>ethernet1/1</interface>
</interface-address>
</dynamic-ip-and-port>
</source-translation>
<to>
<member>Untrust-L3</member>
</to>
<from>
<member>Trust-L3</member>
</from>
<source>
<member>any</member>
</source>
<destination>
<member>any</member>
</destination>
<service>any</service>
<description>Outbound NAT for POD</description>
<to-interface>ethernet1/1</to-interface>
</entry>
</rules>
</nat>
<security>
<rules>
<entry name="Basic-Allowed-Apps">
<to>
<member>Untrust-L3</member>
</to>
<from>
<member>Trust-L3</member>
</from>
<source>
<member>any</member>
</source>
<destination>
<member>any</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<service>
<member>application-default</member>
</service>
<hip-profiles>
<member>any</member>
</hip-profiles>
<action>allow</action>
<application>
<member>any</member>
</application>
</entry>
</rules>
</security>
</rulebase>
<import>
<network>
<interface>
<member>ethernet1/1</member>
</interface>
</network>
</import>
</entry>
</vsys>
</entry>
</devices>
</config>
general-ccdc/palo_alto_firewall/example-firewall-only-config.xml
Executable
+60
View File
@@ -0,0 +1,60 @@
<?xml version="1.0"?>
<config version="7.0.0" urldb="paloaltonetworks">
<devices>
<entry name="localhost.localdomain">
<vsys>
<entry name="vsys1">
<application/>
<application-group/>
<service>
<entry name="service-http-ssh">
<protocol>
<tcp>
<port>22,80</port>
</tcp>
</protocol>
</entry>
</service>
<service-group/>
<schedule/>
<rulebase>
<security>
<rules>
<entry name="Basic-Allowed-Apps">
<to>
<member>Untrust-L3</member>
</to>
<from>
<member>Trust-L3</member>
</from>
<source>
<member>any</member>
</source>
<destination>
<member>any</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<service>
<member>application-default</member>
</service>
<hip-profiles>
<member>any</member>
</hip-profiles>
<action>allow</action>
<application>
<member>any</member>
</application>
</entry>
</rules>
</security>
</rulebase>
</entry>
</vsys>
</entry>
</devices>
</config>
general-ccdc/palo_alto_firewall/incorporatePAFW.txt
Executable
+20
View File
@@ -0,0 +1,20 @@
How to incorporate Palo Alto Firewall target into Capirca:
1. Clone the capirca git repository at https://github.com/google/capirca
2. Put the paloaltofw.py file into capirca > lib
3. In capirca > aclgen.py:
- add the following line with the other import statements: from lib import paloaltofw
- add the following line to the supported_targets dictionary in the render_filters method:
'paloaltofw': {'optimized': False, 'renderer': paloaltofw.PaloAltoFW},
4. To generate the palo alto networks xml file, run the following command from inside the capirca folder:
./aclgen.py -d ../paloaltofw/ -o ../paloaltofw/ -p ../paloaltofw/policy.pol
-d = path to the folder that contain your definitions ('.net' file)
-o = path to the folder that you want your palo alto firewall '.xml' file to be created
-p = path to your policy file ('.pol')
general-ccdc/palo_alto_firewall/paloaltofw.py
Executable
+553
View File
@@ -0,0 +1,553 @@
#!/usr/bin/python
"""Palo Alto Firewall generator."""
__author__ = 'apoorva.dornadula@berkeley.edu (Apoorva Dornadula)'
import collections
import datetime
import logging
import aclgenerator
import nacaddr
import re
class Error(Exception):
"""generic error class."""
class UnsupportedFilterError(Error):
pass
class UnsupportedHeader(Error):
pass
class PaloAltoFWDuplicateTermError(Error):
pass
class PaloAltoFWVerbatimError(Error):
pass
class PaloAltoFWOptionError(Error):
pass
class PaloAltoFWDuplicateServiceError(Error):
pass
class Term(aclgenerator.Term):
"""Representation of an individual term.
This is mostly useful for the __str__() method.
Args:
obj: a policy.Term object
term_type: type of filter to generate, e.g. inet or inet6
filter_options: list of remaining target options (zones)
"""
_ACTIONS = {'accept': 'permit',
'deny': 'deny',
'reject': 'reject',
'count': 'count',
'log': 'log'}
def __init__(self, term, term_type, zones):
self.term = term
self.term_type = term_type
self.from_zone = zones[1]
self.to_zone = zones[3]
self.extra_actions = []
def __str__(self):
"""Render config output from this term object."""
# Verify platform specific terms. Skip whole term if platform does not
# match.
if self.term.platform:
if 'paloaltofw' not in self.term.platform:
return ''
if self.term.platform_exclude:
if 'paloaltofw' in self.term.platform_exclude:
return ''
ret_str = []
# COMMENTS
comment_max_width = 68
if self.term.owner:
self.term.comment.append('Owner: %s' % self.term.owner)
comments = aclgenerator.WrapWords(self.term.comment, comment_max_width)
if comments and comments[0]:
ret_str.append(PaloAltoFW.INDENT * 3 + '/*')
for line in comments:
ret_str.append(PaloAltoFW.INDENT * 3 + line)
ret_str.append(PaloAltoFW.INDENT * 3 + '*/')
ret_str.append(PaloAltoFW.INDENT * 3 + 'policy ' + self.term.name + ' {')
ret_str.append(PaloAltoFW.INDENT * 4 + 'match {')
# SOURCE-ADDRESS
if self.term.source_address:
saddr_check = set()
for saddr in self.term.source_address:
saddr_check.add(saddr.parent_token)
saddr_check = sorted(saddr_check)
source_address_string = ''
for addr in saddr_check:
source_address_string += addr + ' '
ret_str.append(PaloAltoFW.INDENT * 5 + 'source-address [ ' +
source_address_string + '];')
else:
ret_str.append(PaloAltoFW.INDENT * 5 + 'source-address any;')
# DESTINATION-ADDRESS
if self.term.destination_address:
daddr_check = []
for daddr in self.term.destination_address:
daddr_check.append(daddr.parent_token)
daddr_check = set(daddr_check)
daddr_check = list(daddr_check)
daddr_check.sort()
destination_address_string = ''
for addr in daddr_check:
destination_address_string += addr + ' '
ret_str.append(PaloAltoFW.INDENT * 5 + 'destination-address [ ' +
destination_address_string + '];')
else:
ret_str.append(PaloAltoFW.INDENT * 5 + 'destination-address any;')
# APPLICATION
if (not self.term.source_port and not self.term.destination_port and not
self.term.icmp_type and not self.term.protocol):
ret_str.append(PaloAltoFW.INDENT * 5 + 'application any;')
else:
ret_str.append(PaloAltoFW.INDENT * 5 + 'application ' + self.term.name +
'-app;')
ret_str.append(PaloAltoFW.INDENT * 4 + '}')
# ACTIONS
for action in self.term.action:
ret_str.append(PaloAltoFW.INDENT * 4 + 'then {')
ret_str.append(PaloAltoFW.INDENT * 5 + self._ACTIONS.get(
str(action)) + ';')
# LOGGING
if self.term.logging:
ret_str.append(PaloAltoFW.INDENT * 5 + 'log {')
ret_str.append(PaloAltoFW.INDENT * 6 + 'session-init;')
ret_str.append(PaloAltoFW.INDENT * 5 + '}')
ret_str.append(PaloAltoFW.INDENT * 4 + '}')
ret_str.append(PaloAltoFW.INDENT * 3 + '}')
# OPTIONS
if self.term.option:
raise PaloAltoFWOptionError('Options are not implemented yet, please remove ' +
'from term %s' % self.term.name)
# VERBATIM
if self.term.verbatim:
raise PaloAltoFWVerbatimError('Verbatim is not implemented, please remove ' +
'the offending term %s.' % self.term.name)
return '\n'.join(ret_str)
def _Group(self, group):
"""If 1 item return it, else return [ item1 item2 ].
Args:
group: a list. could be a list of strings (protocols) or a list of
tuples (ports)
Returns:
rval: a string surrounded by '[' and '];' if len(group) > 1
or with just ';' appended if len(group) == 1
"""
def _FormattedGroup(el):
"""Return the actual formatting of an individual element.
Args:
el: either a string (protocol) or a tuple (ports)
Returns:
string: either the lower()'ed string or the ports, hyphenated
if they're a range, or by itself if it's not.
"""
if isinstance(el, str):
return el.lower()
elif isinstance(el, int):
return str(el)
# type is a tuple below here
elif el[0] == el[1]:
return '%d' % el[0]
else:
return '%d-%d' % (el[0], el[1])
if len(group) > 1:
rval = '[ ' + ' '.join([_FormattedGroup(x) for x in group]) + ' ];'
else:
rval = _FormattedGroup(group[0]) + ';'
return rval
class Service():
service_map = {}
def __init__(self, ports, service_name, protocol): # ports is a tuple of ports
global counter
if ports in self.service_map:
raise PaloAltoFWDuplicateServiceError('You have a duplicate service. A service already exists on port(s): %s'
% str(ports))
tup = str(ports)[1:-1]
if tup[-1] == ",":
tup = tup[:-1]
self.service_map[(ports, protocol)] = {"name": "service-" + protocol + "-" + tup}
class Rule():
rules = {}
def __init__(self, from_zone, to_zone, terms):
# Palo Alto Firewall rule keys
self.options = {}
self.options["from_zone"] = [from_zone]
self.options["to_zone"] = [to_zone]
self.modifyOptions(terms)
def extract_ip(self, cidr):
r = re.search("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", cidr)
return r.group() if r else "any"
def modifyOptions(self, PAFWterm):
# for PAFWterm in terms:
term = PAFWterm.term
self.options["source"] = []
self.options["destination"] = []
self.options["application"] = []
self.options["service"] = []
self.options["action"] = "allow"
if term.source_address:
for addr in term.source_address:
self.options["source"].append(self.extract_ip(str(addr)))
if term.destination_address:
for addr in term.destination_address:
self.options["destination"].append(self.extract_ip(str(addr)))
if term.action:
self.options["action"] = term.action[0]
if term.destination_port:
ports = []
for tup in term.destination_port:
ports.append(tup[0])
ports = tuple(ports)
# check to see if this service already exists
for p in term.protocol:
if (ports, p) in Service.service_map:
self.options["service"].append(Service.service_map[(ports, p)]["name"])
else:
# create service
new_service = Service(ports, term.name, p)
self.options["service"].append(Service.service_map[(ports, p)]["name"])
if term.protocol:
if term.protocol[0] == "icmp":
self.options["application"].append("ping")
self.rules[term.name] = self.options
class PaloAltoFW(aclgenerator.ACLGenerator):
"""PaloAltoFW rendering class.
This class takes a policy object and renders the output into a syntax
which is understood by Palo Alto firewalls.
Args:
pol: policy.Policy object
"""
_PLATFORM = 'paloaltofw'
_SUFFIX = '.xml'
_SUPPORTED_AF = set(('inet',))
_OPTIONAL_SUPPORTED_KEYWORDS = set(['expiration',
'logging',
'owner',
'routing_instance', # safe to skip
'timeout',
])
INDENT = ' '
def _TranslatePolicy(self, pol, exp_info):
"""Transform a policy object into a PaloAltoFW object.
Args:
pol: policy.Policy object
exp_info: print a info message when a term is set to expire
in that many weeks
Raises:
UnsupportedFilterError: An unsupported filter was specified
UnsupportedHeader: A header option exists that is not understood/usable
PaloAltoFWDuplicateTermError: Two terms were found with same name in same filter
"""
self.pafw_policies = []
self.addressbook = collections.OrderedDict()
self.applications = []
self.ports = []
self.from_zone = ''
self.to_zone = ''
self.policy_name = ''
current_date = datetime.date.today()
exp_info_date = current_date + datetime.timedelta(weeks=exp_info)
for header, terms in pol.filters:
if self._PLATFORM not in header.platforms:
continue
filter_options = header.FilterOptions(self._PLATFORM)
if (len(filter_options) < 4 or filter_options[0] != 'from-zone' or
filter_options[2] != 'to-zone'):
raise UnsupportedFilterError(
'Palo Alto Firewall filter arguments must specify from-zone and to-zone.')
self.from_zone = filter_options[1]
self.to_zone = filter_options[3]
if len(filter_options) > 4:
filter_type = filter_options[4]
else:
filter_type = 'inet'
if filter_type not in self._SUPPORTED_AF:
raise UnsupportedHeader(
'Palo Alto Firewall Generator currently does not support %s as a header option' %
(filter_type))
term_dup_check = set()
new_terms = []
for term in terms:
term.name = self.FixTermLength(term.name)
if term.name in term_dup_check:
raise PaloAltoFWDuplicateTermError('You have a duplicate term: %s'
% term.name)
term_dup_check.add(term.name)
if term.expiration:
if term.expiration <= exp_info_date:
logging.info('INFO: Term %s in policy %s>%s expires '
'in less than two weeks.', term.name, self.from_zone,
self.to_zone)
if term.expiration <= current_date:
logging.warn('WARNING: Term %s in policy %s>%s is expired.',
term.name, self.from_zone, self.to_zone)
for i in term.source_address_exclude:
term.source_address = nacaddr.RemoveAddressFromList(
term.source_address, i)
for i in term.destination_address_exclude:
term.destination_address = nacaddr.RemoveAddressFromList(
term.destination_address, i)
for addr in term.source_address:
self._BuildAddressBook(self.from_zone, addr)
for addr in term.destination_address:
self._BuildAddressBook(self.to_zone, addr)
new_term = Term(term, filter_type, filter_options)
new_terms.append(new_term)
tmp_icmptype = new_term.NormalizeIcmpTypes(
term.icmp_type, term.protocol, filter_type)
# NormalizeIcmpTypes returns [''] for empty, convert to [] for eval
normalized_icmptype = tmp_icmptype if tmp_icmptype != [''] else []
# rewrites the protocol icmpv6 to icmp6
if 'icmpv6' in term.protocol:
protocol = list(term.protocol)
protocol[protocol.index('icmpv6')] = 'icmp6'
else:
protocol = term.protocol
self.applications.append({'sport': self._BuildPort(term.source_port),
'dport': self._BuildPort(
term.destination_port),
'name': term.name,
'protocol': protocol,
'icmp-type': normalized_icmptype,
'timeout': term.timeout})
self.pafw_policies.append((header, new_terms, filter_options))
# create Palo Alto Firewall Rule object
for term in new_terms:
rule = Rule(self.from_zone, self.to_zone, term)
def _BuildAddressBook(self, zone, address):
"""Create the address book configuration entries.
Args:
zone: the zone these objects will reside in
address: a naming library address object
"""
if zone not in self.addressbook:
self.addressbook[zone] = collections.OrderedDict()
if address.parent_token not in self.addressbook[zone]:
self.addressbook[zone][address.parent_token] = []
name = address.parent_token
for ip in self.addressbook[zone][name]:
if str(address) == str(ip[0]):
return
counter = len(self.addressbook[zone][address.parent_token])
name = '%s_%s' % (name, str(counter))
self.addressbook[zone][address.parent_token].append((address, name))
def _BuildPort(self, ports):
"""Transform specified ports into list and ranges.
Args:
ports: a policy terms list of ports
Returns:
port_list: list of ports and port ranges
"""
port_list = []
for i in ports:
if i[0] == i[1]:
port_list.append(str(i[0]))
else:
port_list.append('%s-%s' % (str(i[0]), str(i[1])))
return port_list
def __str__(self):
"""Render the output of the PaloAltoFirewall policy into config."""
initial = []
# INITAL CONFIG
initial.append('<?xml version="1.0"?>"')
initial.append('<config version="7.0.0" urldb="paloaltonetworks">')
initial.append(self.INDENT * 1 + '<devices>')
initial.append(self.INDENT * 2 + '<entry name="localhost.localdomain">')
initial.append(self.INDENT * 3 + '<vsys>')
initial.append(self.INDENT * 4 + '<entry name="vsys1">')
initial.append(self.INDENT * 5 + '<application/>')
initial.append(self.INDENT * 5 + '<application-group/>')
# SERVICES
service = []
service.append(self.INDENT * 5 + "<!-- Services -->")
for k,v in Service.service_map.items():
service.append(self.INDENT * 5 + "<service>")
service.append(self.INDENT * 6 + '<entry name="' + v["name"] + '">')
service.append(self.INDENT * 7 + "<protocol>")
service.append(self.INDENT * 8 + "<" + k[1] + ">")
tup = str(k[0])[1:-1]
if tup[-1] == ",":
tup = tup[:-1]
service.append(self.INDENT * 9 + "<port>" + tup + "</port>")
service.append(self.INDENT * 8 + "</" + k[1] + ">")
service.append(self.INDENT * 7 + "</protocol>")
service.append(self.INDENT * 6 + "</entry>")
service.append(self.INDENT * 5 + "</service>")
# RULES
rules = []
rules.append(self.INDENT * 5 + "<!-- Rules -->")
rules.append(self.INDENT * 5 + "<rulebase>")
rules.append(self.INDENT * 6 + "<security>")
rules.append(self.INDENT * 7 + "<rules>")
for name, options in Rule.rules.items():
rules.append(self.INDENT * 8 + '<entry name="' + name + '">')
rules.append(self.INDENT * 9 + "<to>")
for tz in options["to_zone"]:
rules.append(self.INDENT * 10 + "<member>" + tz + "</member>")
rules.append(self.INDENT * 9 + "</to>")
rules.append(self.INDENT * 9 + "<from>")
for fz in options["from_zone"]:
rules.append(self.INDENT * 10 + "<member>" + fz + "</member>")
rules.append(self.INDENT * 9 + "</from>")
rules.append(self.INDENT * 9 + "<source>")
if options["source"] == []:
rules.append(self.INDENT * 10 + "<member>any</member>")
else:
for s in options["source"]:
rules.append(self.INDENT * 10 + "<member>" + s + "</member>")
rules.append(self.INDENT * 9 + "</source>")
rules.append(self.INDENT * 9 + "<destination>")
if options["destination"] == []:
rules.append(self.INDENT * 10 + "<member>any</member>")
else:
for d in options["destination"]:
rules.append(self.INDENT * 10 + "<member>" + d + "</member>")
rules.append(self.INDENT * 9 + "</destination>")
rules.append(self.INDENT * 9 + "<source-user>")
rules.append(self.INDENT * 10 + "<member>any</member>")
rules.append(self.INDENT * 9 + "</source-user>")
rules.append(self.INDENT * 9 + "<category>")
rules.append(self.INDENT * 10 + "<member>any</member>")
rules.append(self.INDENT * 9 + "</category>")
rules.append(self.INDENT * 9 + "<service>")
if options["service"] == []:
rules.append(self.INDENT * 10 + "<member>any</member>")
else:
for s in options["service"]:
rules.append(self.INDENT * 10 + "<member>" + s + "</member>")
rules.append(self.INDENT * 9 + "</service>")
rules.append(self.INDENT * 9 + "<hip-profiles>")
rules.append(self.INDENT * 10 + "<member>any</member>")
rules.append(self.INDENT * 9 + "</hip-profiles>")
rules.append(self.INDENT * 9 + "<action>")
rules.append(self.INDENT * 10 + "<member>" + options["action"] + "</member>")
rules.append(self.INDENT * 9 + "</action>")
rules.append(self.INDENT * 9 + "<application>")
if options["application"] == []:
rules.append(self.INDENT * 10 + "<member>any</member>")
else:
for a in options["application"]:
rules.append(self.INDENT * 10 + "<member>" + a + "</member>")
rules.append(self.INDENT * 9 + "</application>")
rules.append(self.INDENT * 8 + "</entry>")
rules.append(self.INDENT * 7 + "</rules>")
rules.append(self.INDENT * 6 + "</security>")
# Default Deny:
rules.append(self.INDENT * 6 + "<default-security-rules>")
rules.append(self.INDENT * 7 + "<rules>")
rules.append(self.INDENT * 8 + '<entry name="intrazone-default">')
rules.append(self.INDENT * 9 + "<action>")
rules.append(self.INDENT * 10 + "<member>deny</member>")
rules.append(self.INDENT * 9 + "</action>")
rules.append(self.INDENT * 8 + "</entry>")
rules.append(self.INDENT * 7 + "</rules>")
rules.append(self.INDENT * 6 + "</default-security-rules>")
rules.append(self.INDENT * 5 + "</rulebase>")
end = []
end.append(self.INDENT * 4 + "</entry>")
end.append(self.INDENT * 3 + "</vsys>")
end.append(self.INDENT * 2 + "</entry>")
end.append(self.INDENT * 1 + "</devices>")
end.append("</config>")
return '\n'.join(initial) + '\n\n' +'\n'.join(service) + "\n\n" + '\n'.join(rules) + '\n' + '\n'.join(end)
general-ccdc/palo_alto_firewall/policy.xml
Executable
+282
View File
@@ -0,0 +1,282 @@
<?xml version="1.0"?>"
<config version="7.0.0" urldb="paloaltonetworks">
<devices>
<entry name="localhost.localdomain">
<vsys>
<entry name="vsys1">
<application/>
<application-group/>
<!-- Services -->
<service>
<entry name="service-tcp-22">
<protocol>
<tcp>
<port>22</port>
</tcp>
</protocol>
</entry>
<entry name="service-tcp-443">
<protocol>
<tcp>
<port>443</port>
</tcp>
</protocol>
</entry>
</service>
<!-- Rules -->
<rulebase>
<security>
<rules>
<entry name="allow-ping-firewall">
<to>
<member>Firewall</member>
</to>
<from>
<member>Pod-public</member>
</from>
<source>
<member>any</member>
</source>
<destination>
<member>172.20.1.1</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<service>
<member>any</member>
</service>
<hip-profiles>
<member>any</member>
</hip-profiles>
<action>
<member>accept</member>
</action>
<application>
<member>ping</member>
</application>
</entry>
<entry name="allow-icmp-pod">
<to>
<member>Pod-Private</member>
</to>
<from>
<member>Pod-Private</member>
</from>
<source>
<member>192.168.10.1</member>
<member>192.168.10.10</member>
<member>192.168.10.50</member>
</source>
<destination>
<member>192.168.10.1</member>
<member>192.168.10.10</member>
<member>192.168.10.50</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<service>
<member>any</member>
</service>
<hip-profiles>
<member>any</member>
</hip-profiles>
<action>
<member>accept</member>
</action>
<application>
<member>ping</member>
</application>
</entry>
<entry name="allow-ssh-pod">
<to>
<member>Pod-Private</member>
</to>
<from>
<member>Pod-Private</member>
</from>
<source>
<member>192.168.10.1</member>
<member>192.168.10.10</member>
<member>192.168.10.50</member>
</source>
<destination>
<member>192.168.10.1</member>
<member>192.168.10.10</member>
<member>192.168.10.50</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<service>
<member>service-tcp-22</member>
</service>
<hip-profiles>
<member>any</member>
</hip-profiles>
<action>
<member>accept</member>
</action>
<application>
<member>any</member>
</application>
</entry>
<entry name="allow-ping-internet-2-firewall">
<to>
<member>Firewall</member>
</to>
<from>
<member>Internet</member>
</from>
<source>
<member>any</member>
</source>
<destination>
<member>172.20.1.1</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<service>
<member>any</member>
</service>
<hip-profiles>
<member>any</member>
</hip-profiles>
<action>
<member>accept</member>
</action>
<application>
<member>ping</member>
</application>
</entry>
<entry name="allow-https-firewall">
<to>
<member>Firewall</member>
</to>
<from>
<member>Pod-public</member>
</from>
<source>
<member>any</member>
</source>
<destination>
<member>172.20.1.1</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<service>
<member>service-tcp-443</member>
</service>
<hip-profiles>
<member>any</member>
</hip-profiles>
<action>
<member>accept</member>
</action>
<application>
<member>any</member>
</application>
</entry>
<entry name="allow-any-pod-2-internet">
<to>
<member>Internet</member>
</to>
<from>
<member>Pod-Public</member>
</from>
<source>
<member>172.20.1.1</member>
<member>172.20.1.10</member>
<member>172.20.1.50</member>
</source>
<destination>
<member>any</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<service>
<member>any</member>
</service>
<hip-profiles>
<member>any</member>
</hip-profiles>
<action>
<member>accept</member>
</action>
<application>
<member>any</member>
</application>
</entry>
<entry name="allow-ssh-firewall">
<to>
<member>Firewall</member>
</to>
<from>
<member>Pod-public</member>
</from>
<source>
<member>any</member>
</source>
<destination>
<member>172.20.1.1</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<service>
<member>service-tcp-22</member>
</service>
<hip-profiles>
<member>any</member>
</hip-profiles>
<action>
<member>accept</member>
</action>
<application>
<member>any</member>
</application>
</entry>
</rules>
</security>
<default-security-rules>
<rules>
<entry name="intrazone-default">
<action>
<member>deny</member>
</action>
</entry>
</rules>
</default-security-rules>
</rulebase>
</entry>
</vsys>
</entry>
</devices>
</config>
general-ccdc/pwgen.rb
Executable
+379
View File
@@ -0,0 +1,379 @@
words=%w(
aback abase abash abate abbey abbot abbr abed abet abhor abide able abode
abort about above abuse abut abyss ace aces ache ached aches achoo achy acid
acids acme acne acorn acre acres acrid act acted actor acts acute adage
adapt add added adder addle adds adept adieu adios admit ado adobe adopt
adore adorn ads adult afar afire afoot aft after again agate age aged agent
ages agile aging aglow ago agony agree aha ahead ahem ahoy aid aide aided
ail aim aimed aims air airy aisle ajar aka akin alarm alas album ale alert
algae alias alibi alien align alike alive all alley allot allow alloy ally
alms aloft aloha alone along aloof aloud alp alpha alps also altar alter
alto alum amass amaze amber amble amen amend amid amigo amiss amity ammo
amok among amour amp ample amply amps amuse anal and anew angel anger angle
angry angst ankle annex annoy annul anon ant ante anti antic ants anus anvil
any aorta apart ape apes apex aphid apple apply apron apt aqua arbor arc
arch arcs are area areas arena argon argue aria arid arise ark arm armed
armor arms army aroma arose array arrow arson art arts arty asap ash ashen
ashes ashy aside ask asked askew asks asp aspen ass asses asset assn ate
atlas atoll atom atoms atone atop attic attn audio audit augur auk aunt
aunts aura aural auto avail avert avian avid avoid avow await awake award
aware awash away awe awed awful awl awn awoke awry axes axiom axis axle aye
azure babe babel babes baby back bacon bad badge badly bag bagel baggy bags
bah bail bait bake baker bakes bald bale balk ball balls balm balmy balsa
ban banal band bands bandy bane bang bangs banjo bank banks bar barb barbs
bard bare barf barge bark barks barn baron bars base bash basic basil basin
basis bask bass baste bat batch bates bath bathe baths baton bats baud bawd
bawdy bawl bay bayou bays beach bead beads beady beak beam beams bean beans
bear beard bears beast beat beats beau bebop beck bed beds bee beech beef
beefy been beep beeps beer beers bees beet beets befit befog beg began beget
begin begs begun beige being belch bell belle bells belly below belt belts
bench bend bends bent beret berg berry berth beryl beset best bet beta bets
bevy bias bib bible bid bide bids bier big bigot bike biker bile bilge bilk
bill bills billy bimbo bin bind binge bingo biped birch bird birds birth
bison bit bite bites bits biz blab black blade blah blame bland blank blare
blast blat blaze bldg bleak bleat bled bleed blend bless blew blimp blind
blink blip blips bliss blitz bloat blob blobs bloc block bloke blond blood
bloom bloop blot blots blow blown blows blue blues bluff blunt blur blurs
blurt blush blvd boa boar board boast boat boats bob bobby bobs bode body
bog bogey boggy bogs bogus boil boils bold bolt bolts bomb bombs bond bone
bones bong bongo bonus bony boo boob booby book books boom boon boor boost
boot booth boots booty booze bop borax bore bored bores born boron bosom
boss bossy botch both bough bound bout bow bowed bowel bowl bowls bows box
boxed boxer boxes boxy boy boys bozo bra brace brad brag brags braid brain
brake bran brand brash brass brat brats brave bravo brawl brawn bray bread
break bred breed brew bribe brick bride brief brig brim brine bring brink
briny brisk broad broil broke brood brook broom broth brow brown brows bruin
brunt brush brute bub buck bucks bud buddy budge buds buff bug buggy bugle
bugs build built bulb bulbs bulge bulk bulky bull bulls bully bum bump bumps
bumpy bums bun bunch bunco bunk bunny buns bunt bunts buoy burg burly burn
burns burnt burp burps burro burst bury bus bush bushy buss bust busy but
butch butt butte buxom buy buyer buys buzz bye bylaw byte bytes byway cab
cabal cabin cable cache cacti cadet cafe cage caged cages cagey cairn cake
cakes calf call calls calm calms cam came camel cameo camp camps can canal
candy cane caned canes canny canoe canon cans canto cap cape caped caper car
carat card care cares caret cargo carol carp carry cars cart carve case
cases cash cask cast caste cat catch cater cats catty caulk cause cave caves
cease cedar cede cell cello cent cents chad chafe chaff chain chair chalk
champ chant chaos chap char charm chart chase chasm chat chats cheap cheat
check cheek cheer chef chess chest chew chews chewy chi chic chick chide
chief child chili chill chime chimp chin china chip chips chirp chit chive
chock choir choke chomp chop chops chord chore chose chow chub chuck chug
chum chump chunk churn chute ciao cider cigar cilia cinch circa cite city
civet civic civil clad claim clam clamp clan clang clank clap claps clash
clasp class claw claws clay clean clear cleat clef cleft clerk click cliff
climb cling clink clip cloak clock clod clog clone close clot cloth cloud
clout clove clown cloy club clubs cluck clue clues clump clung coach coal
coast coat coats coax cob cobra coca cock cocky cocoa cod coda code coded
codes coed cog cogs coif coil coils coin coins coke cola cold colon color
colt coma comb combo come comet comfy comic comma con conch condo cone conic
coo cook cool coon coop coos coot cop cope copes copra cops copy coral cord
cords core cork corn corny corp corps cost costs cot couch cough could count
coup coupe court cove coven cover covet cow cowl cows cox coy cozy crab
crack craft crag cram cramp crane crank crap craps crash crass crate crave
crawl craze crazy creak cream credo creed creek creep crepe crept cress
crest crew crib cried crime crimp crisp croak crock crone crony crook croon
crop crops cross crow crowd crown crows crud crude cruel crumb crush crust
crux cry crypt cub cube cubic cubs cud cue cues cuff cull cult cults cup
cupid cups cur curb curd cure cured curie curio curl curls curry curse curt
curve cusp cuss cut cute cuts cycle cynic cyst czar dab dad daddy daffy daft
daily dairy dais daisy dale dally dam dame damn damp dance dandy dang dank
dare dared dares dark darn dart darts dash data date dates datum daub daunt
dawn day days daze dazed dds dead deaf deal deals dealt dean dear death
debit debt debts debug debut decal decay deck decor decoy decry deed deeds
deem deep deer def defer deft defy deify deity delay deli delta delve demo
demon demur den denim dense dent dents deny depot dept depth derby desk
desks deter detox deuce devil dew dewy dial dials diary dibs dice dick did
die died dies diet diets dig digit digs dike dill dim dime dimes dimly dims
din dine diner ding dingo dingy dint diode dip dips dire dirge dirk dirt
dirty disc disco dish disk ditch ditto ditty diva divan dive dives divot
dizzy doc dock dodge dodo doe does doff dog dogma dogs doily doing dole doll
dolly dolt dome domed don done donor doom door dope dopey dorm dose dot dote
dots doubt dough douse dove doves dowel down dowry doze dozen drab draft
drag drain drake drama drank drape draw drawl drawn dread dream dregs dress
drew dried drier dries drift drill drink drip drips drive droid droll drone
drool droop drop drops drove drown drub drug drugs druid drum drums drunk
dry dryad dual dub duck ducks duct dud dude due duel dues duet duff dug duke
dull dully duly dumb dumbo dummy dump dumps dumpy dun dunce dune dung dunk
duo dupe dusk dusky dust dusty dutch duty dwarf dwell dwelt dye dyed dying
each eager eagle ear earl early earn earns ears earth ease easel east easy
eat eaten eater eats eave eaves ebb ebony echo eddy edge edges edgy edict
edify edit edits eel eerie egg eggs ego egret eight eject elate elbow elder
elect elegy elf elfin elide elite elk elks elm elms elope else elude elves
email embed ember emcee emery emit emits emote empty emu enact end ended
endow ends enema enemy enjoy ennui ensue enter entry envoy envy eon eons
epic epics epoch epoxy equal equip era erase erect ergo erode err error
erupt esp espy essay ester eta etc etch ether ethic ethos ethyl etude evade
eve even event ever every evict evil evoke ewe exact exalt exam exams excel
exec exert exile exist exit exits expel expo extol extra exult eye eyed eyes
fable face faces facet fact facts fad fade fads fail faint fair fairy faith
fake faker fall false fame fan fancy fang fangs fanny fans far farce fare
farm farms fast fat fatal fate fats fatty fault fauna fawn fax faze fear
fears feast feat fed fee feed feeds feel feels fees feet feign feint fell
felon felt femur fence fend fern ferry fetal fetch fete fetid fetus feud
fever few fez fiat fib fiber field fiend fiery fife fifth fifty fig fight
figs filch file filed files filet fill filly film films filmy filth fin
final finch find fine fined finer fink finny fir fire firm first fish fishy
fist fit fits five fix fixed fizz fjord flab flag flail flair flak flake
flaky flame flank flap flare flash flask flat flaw flax flay flea fled flee
fleet flesh flew flex flick flier flies fling flint flip flirt flit float
flock flog flood floor flop flora flour flow flown flu flub flue fluff fluid
fluke flung flush flute flux fly foal foam foamy fob focal focus foe foes
fog foggy fogy foil foist fold folio folk folly fond font food fool foot fop
for foray force ford fore forge fork form forms fort forte forth forty forum
foul found fount four fowl fox foxes foxy foyer frail frame frank fraud fray
freak free freed freer fresh fret friar fried fries frill fritz frock frog
frogs from frond front frost froth frown froze fruit fry fudge fuel fugue
full fully fume fumes fun fund funds fungi funk funky funny fur furl furry
furs fury fuse fuss fussy fuzz fuzzy gab gable gaffe gag gags gaily gain
gait gal gala gale gall game games gamma gamut gamy gang gangs gap gape
gapes gaps garb gas gash gasp gasps gassy gate gates gator gaudy gauge gaunt
gauze gave gavel gawk gawky gay gaze gazed gazes gear gears gee geese gel
geld gem gems gene genes genie genre gent germ germs get gets ghost ghoul
giant giddy gift gifts gig gild gill gills gilt gimme gimpy gin gird girl
girls girth gist give given gives gizmo glad glade gland glare glass glaze
gleam glean glee glen glib glide glint gloat glob globe gloom glory gloss
glove glow glows glue glued gluey glum glut gnash gnat gnaw gnaws gnome gnu
goad goal goals goat goats gob god godly gods goes going gold golf golly
gone gong goo good goods goody gooey goof goofy goon goose gore gorge gory
gosh got gouge gourd gout govt gown gowns grab grabs grace grad grade graft
grail grain gram grams grand grant grape graph grasp grass grate grave gravy
gray graze great greed green greet grew grid grief grill grim grime grimy
grin grind grins grip gripe grips grist grit groan grog groin groom grope
gross group grout grove grow growl grown grows grub grubs gruff grunt guano
guard guess guest guide guild guile guilt guise gulag gulf gull gulls gully
gulp gum gumbo gummy gun gunk guns guppy guru gush gust gusto gusts gusty
gut guts gutsy guy guys gym gyp gypsy gyro habit hack had hag haiku hail
hair hairs hairy half hall halls halo halt halts halve ham hams hand hands
handy hang hank happy hard hardy hare harem hark harm harms harp harps harry
harsh hart has hash hasp haste hasty hat hatch hate hates hats haul hauls
haunt have haven havoc hawk hawks hay haze hazel hazy head heads heady heal
heals heap heaps hear heard hears heart heat heath heats heave heavy heck
hedge heed heel heels heft hefty heir heirs held helix hell hello helm help
hem hemp hems hen hence hens hep her herb herbs herd here hero heron hers
hertz hew hex hexed hey hick hid hide hides high hike hikes hill hills hilly
hilt him hind hinge hint hints hip hippo hips hire hired hires his hiss hit
hitch hits hive hives hoard hoax hobby hobo hock hoe hog hogan hogs hoist
hold holds hole holes holly holy home hone honey honk honor hooch hood hoof
hook hooks hoop hoot hop hope hopes hops horde horn horny horse hose host
hot hotel hound hour house hovel hover how howdy howl howls hub hubby hubs
hue hues huff hug huge hugs huh hula hulk hull hum human humid humor hump
humps hums humus hunch hung hunk hunt hunts hurl hurry hurt hush husk husky
hut hutch hwy hydra hyena hymn hype hyper hypo ibid ice iced icing icky icon
icons icy idea ideal ideas idiom idiot idle idly idol idols iffy igloo ill
image imp impel imply imps inane inc inch incur index inept inert infer info
ingot ink inky inlay inlet inn inner inns input inset inter into intro ion
ions iota irate ire iris irk irked iron irons irony isle ism issue itch
itchy item items ivory ivy jab jack jade jaded jag jail jam jamb japan jar
jars jaunt java jaw jaws jay jazz jazzy jean jeans jeep jeer jeers jello
jelly jenny jerk jerks jerky jest jet jets jewel jiffy jig jigs jilt jimmy
jinx jive job jobs jock joey jog jogs john join joins joint joke joker jokes
jolly jolt josh jot jots joust jowl jowls joy judge judo jug jugs juice
juicy julep jumbo jump jumps jumpy jun junk junta juror jury just jut jute
kale kappa kaput karma kayak kayo kazoo keel keen keep keeps keg kegs kelp
ken kept key keyed keys khaki khan kick kicks kid kids kill kills kiln kilo
kilt kilts kin kind kinds king kings kink kinky kiosk kiss kit kite kites
kitty kiwi klutz knack knave knead knee kneel knees knelt knew knife knit
knits knob knobs knock knot knots know known knows koala koan kook kooks
kooky kraut kudos kudzu lab label labor labs lace laces lack lacks lacy lad
ladle lads lady lag lager lags laid lair lake lakes lam lamb lambs lame lamp
lamps lance land lands lane lanky lap lapel laps lapse lard large lark larks
larva laser lash lass lasso last latch late later latex lathe laud laugh
lava law lawn lawns laws lax lay layer lays lazy lbs lead leads leaf leafy
leak leaks leaky lean leap leaps learn lease leash least leave led ledge lee
leech leer leers leery left lefty leg legal legs lei lemon lend lends lens
lent leper less lest let lets levee level lever levy lewd liar liars lib
libel lice lick licks lid lids lie lied lien lies lieu life lift light like
liked likes lilac lilt lily limb limbo limbs lime limit limp limps line
linen lines lingo link lint lion lip lips lira lisp list lists lit live
liver livid load loaf loam loamy loan lob lobby lobe lobs local lock locks
lode lodge loft lofty log logic logo logs loin loins loll lone loner long
longs look looks loom loon loony loop loose loot lop lops lord lore lose
loser loses loss lost lot lots lotto lotus loud louse lousy lout love loved
lover low lower lox loyal ltd luau lucid luck lucky lug lugs lull lulu lump
lumps lumpy lunar lunch lung lunge lungs lurch lure lurid lurk lurks lush
lust lusty lute lye lying lymph lynch lynx lyre lyric mac macaw mace macho
macro mad madam made madly mafia magic magma maid maids mail maim maims main
maize major make male mall malls malt mama mambo man mane mango mania manic
manly manna manor many map maple maps mar march mare mares marge maria mark
marks marry mars marsh mart mash mask masks mason mass mast masts mat match
mate mated mates math mats matzo maul mauls maw max maxim may maybe mayo
mayor maze mazes meal meals mean means meant meat meaty mecca medal media
medic meek meet meets meg meld melee melon melt melts memo men mend mends
menu meow mercy mere merge merit merry mesa mesh mess messy met metal meter
metro mice micro mid midst might mike mild mile miles milk milky mill mills
mime mimes mimic mince mind minds mine mined miner mines mini mink minor
mint mints minty minus mire mired mirth misc miser miss mist mists misty
mite mites mitt mitts mix mixed mixer mixes moan moans moat mob mobs mock
mocks mod mode model modem mogul moist molar mold molds mole moles molly
molt mom mommy money monk mono month moo mooch mood moods moody moon moons
moor moose mop mope mopes mops moral more morn moron morph moss mossy most
mote motel moth moths motif motor motto mound mount mourn mouse mousy mouth
move moved moves movie mow mowed mower mows moxie mpg mph much muck mucus
mud muddy muff mug muggy mugs mulch mule mules mull mum mummy mumps munch
mural murk murky muse muses mush mushy music musk musky muss must musty mute
muted mutt muzak myth myths nab nabs nag nags nail nails naive naked name
named names nap nape naps nasal nasty natal naval navel navy nay near neat
neck necks need needs needy negro neigh neon nerd nerve nest nests net nets
never new newly news newt next nice nicer nick niece nifty night nil nine
ninja ninth nip nips nix noble nod node nods noel noise noisy nomad none
nook noon noose nope nor norm north nose nosy not notch note noted notes
noun nouns nova novel now nude nudge nuke null numb nun nuns nurse nut nuts
nutty nylon nymph oaf oak oaken oar oars oasis oat oath oats obese obey
obeys obit oboe occur ocean octal odd odds ode odor odors off offer often
ogle ogled ogles ogre oho oil oiled oils oily oink okay okays okra old older
ole olive omega omen omens omit omits once one onion only onset onto oops
ooze oozed opal opals open opens opera opium opt optic opus oral orb orbit
orbs order ore organ orgy other otter ouch ought ounce our ours oust out
outdo outer oval ovals ovary oven ovens over overt owe owed owes owing owl
owls own owned owner owns oxen oxide ozone pace paces pack packs pact pad
paddy pads pagan page pages paid pail pain pains paint pair pal pale palm
palms pals pan panda pane panel pang panic pans pansy pant pants papa paper
pappy par pare park parks parse part parts party pass past paste pasty pat
patch path paths patio pats patsy patty pause pave paved paves paw pawed
pawn pawns paws pay pea peace peach peak peaks pear pearl pears peas pecan
peck pecks pedal pee peed peek peel peep peer peeve peg pegs pelt pen penal
penny pens peony pep peppy per perch peril perk perks perky perm pert peso
pest pests pet petal peter pets petty phase phi phlox phone phony photo
piano pick picks picky pie piece pier piers pies piety pig piggy pigs pike
pile piles pill pills pilot pimp pin pinch pine pines ping pink pinko pins
pint pinto pinup pious pip pipe piper pit pita pitch pith pithy pits pity
pivot pixel pixie pizza place plaid plain plan plane plank plant plate play
plays plaza plea plead pleas pleat plod plods plop plot plots plow plows
ploy ploys pluck plug plugs plum plume plump plums plus plush ply poach pod
pods poem poems poet poi point poise poke poked pokes pol polar pole poles
polio polka poll polls polo pomp pond ponds pony pooch pooh pool pools poop
poor pop pope poppy pops porch pore pores pork porn port pose posed poses
posh posse post posts posy pot pots pouch pound pour pours pout pouts pow
power pox ppm prank prawn pray prays preen prep press prey price prick pride
prig prim prime print prior prism privy prize pro probe prod prods prof prom
promo prone prong proof prop props prose proud prove prow prowl proxy prude
prune pry psalm psi psych pub pubic pubs puck pudgy puff puffs puffy pug
puke pull pulls pulp pulse puma pump pumps pun punch punk punks puns punt
punts puny pup pupil puppy pure purge purr purse pus push pushy pussy put
puts putt putty pygmy pyre quack quad quail quake quart queen query quest
queue quick quiet quill quilt quip quips quirk quit quite quits quiz quota
quote rabbi rabid race raced races rack racy radar radio raft rafts rag rage
raged rags raid raids rail rails rain rains rainy raise rake raked rakes
rally ram ramp rams ran ranch rand randy rang range rank ranks rant rants
rap rape raped rapid raps rare rash rat rate rated rates ratio rats rave
raved raven raw ray rayon rays raze razor reach read reads ready real realm
reap rear rebel rebut recap recur red redo reed reeds reef reek reeks reel
reels ref refer refs regal rehab reign rein reins relax relay relic rely rem
remit remix rend renew rent rents rep repay repel reply reps rerun reset
resin rest rests retch reuse rev revel rhino rho rhyme rib ribs rice rich
rick rid ride rider ridge rifle rift rig right rigid rigs rim rims rind ring
rings rink rinse riot riots rip ripe ripen rips rise risen risk risky rite
rival river rivet roach road roads roam roar roast rob robe robin robot robs
rock rocks rocky rod rode rodeo rods roger rogue role roll rolls roman romeo
romp roof rook room rooms roomy roost root roots rope rose rosy rot rote
rots rouge rough round rouse rout route rover row rowdy rows royal rub rube
rubs ruby rude rug rugs ruin ruins rule ruler rules rum rummy rumor rump run
rune runes rung runs runt rural ruse rush rust rusts rusty rut ruts rye
saber sable sac sack sacks sad sadly safe safer safes sag saga sagas sage
sags said sail sails saint sake salad sale sales sally salon salt salts
salty salvo same sand sands sandy sane sang sank sap sappy saps saran sash
sat satin sauce saucy sauna saute save saved saves savvy saw saws sax say
says scab scald scale scalp scam scamp scan scans scar scare scarf scars
scary scat scene scent scoff scold scoop scoot scope score scorn scour scout
scow scowl scram scrap screw scrip scrod scrub scuba scuff scum sea seal
seals seam seams seamy sear sears seas seat seats sect sects sedan see seed
seeds seedy seek seeks seem seems seen seep seer seers sees seize self sell
sells semen semi send sends sense sent sepia serf serum serve servo set sets
setup seven sever sew sewed sewer sewn sews sex sexy shack shade shady shaft
shake shaky shall sham shame shank shape share shark sharp shave shawl she
sheaf shear shed sheds sheep sheer sheet shelf shell shh shift shin shine
shins shiny ship ships shirk shirt shock shoe shoes shone shoo shook shoot
shop shops shore short shot shots shout shove show shown shows shred shrew
shrub shrug shuck shun shut shuts shy shyly sic sick sicko side siege sieve
sift sifts sigh sighs sight sigma sign signs silk silks silky sill silly
silo silt sin since sinew sing sings sink sinks sins sinus sip sips sir sire
siren sis sit site sites sits six sixth sixty size sizes skate skew ski skid
skids skies skill skim skims skin skip skips skirt skis skit skits skulk
skull skunk sky slab slabs slack slain slam slams slang slant slap slaps
slash slate slave slaw slay sled sleds sleek sleep sleet slept slew slice
slick slid slide slim slime slimy sling slip slips slit slob slog sloop slop
slope slops slosh slot sloth slots slow slows slug slugs slum slump slums
slung slur slurp slurs sly slyly smack small smart smash smear smell smile
smirk smith smock smog smoke smoky smug smut snack snafu snag snail snake
snap snaps snare snarl sneak sneer sniff snip snipe snob snobs snoop snore
snort snot snout snow snows snowy snub snubs snuff snug soak soaks soap
soapy soar soars sob sober sobs sock socks sod soda sofa soft soggy soil
soils sol solar sold sole solid solo solve some son sonar song songs sonny
sons soon soot sop sore sorry sort sorts sot soul sound soup soupy sour
south sow sown sows soy spa space spade spam span spank spans spar spare
spark spas spasm spat spawn spay speak spear spec speck sped speed spell
spend spent sperm spew spice spicy spies spike spiky spill spin spine spins
spiny spire spit spite spits splat split spoil spoke spoof spook spool spoon
spore sport spot spots spout spray spree sprig spry spud spun spunk spur
spurn spurs spurt spy squad squat squid stab stabs stack staff stag stage
stain stair stake stale stalk stall stamp stand stank star stare stark stars
start stash stat state stats stay stays steak steal steam steed steel steep
steer stein stem stems step steps stern stew stick stiff still sting stink
stint stir stirs stock stoke stole stomp stone stony stood stool stoop stop
stops store stork storm story stout stove stow strap straw stray strep strip
strum strut stub stuck stud study stuff stump stun stung stunk stuns stunt
sty style suave sub subs such suck sucks suds sue sued suede sues sugar suit
suite suits sulk sulks sulky sum sumac sumo sums sun sung sunk sunny suns
sunup sup super supt sure surf surge sushi swab swag swam swami swamp swan
swank swans swap swarm swat sway sways swear sweat swede sweep sweet swell
swept swift swig swim swims swine swing swipe swirl swish swoop sword swore
sworn swum swung syrup tab table taboo tabs tack tacky taco tact tad taffy
tag tags tail tails taint take taken takes tale tales talk talks tall tally
talon tame tamer tan tang tango tangy tank tanks tans tap tape taped taper
tapes taps tar tardy tarp tarry tart tarts task taste tasty tater tau taunt
taut tax taxi tbsp tea teach teak team teams tear tease tech ted teddy tee
teen teens tees teeth tell tells temp tempo temps tempt ten tend tends tenor
tens tense tent tenth tents term terms terry terse test tests testy text
than thank that thaw thaws the theft their them theme then there these theta
they thick thief thigh thin thing think thins third this tho thong thorn
those three threw throb throw thud thug thumb thump thus thyme tiara tic
tick ticks tics tidal tide tidy tie tied tier ties tiger tight tile tiled
tiles till tilt time times timid tin tinge tinny tint tiny tip tips tipsy
tire tired tires title toad toads toast today toe toes tofu toga toil toils
token told toll tolls tom tomb tombs ton tonal tone tonic tons tony too took
tool tools toot tooth top topaz topic tops torch tore torn torso tort toss
tot total tote totem tots touch tough tour tours tout tow towel tower town
tows toxic toy toys trace track tract trade trail train trait tramp trap
traps trash tray trays tread treat tree trees trek trend trial tribe trick
tried tries trig trill trim trims trio trip tripe trips trite troll troop
trot trots trout troy truce truck true truly trunk truss trust truth try tsp
tub tuba tube tubes tubs tuck tuft tufts tug tugs tulip tuna tune tuned
tunic turf turn tush tusk tusks tut tutor tutu tux twain tweak tweed twice
twig twigs twin twine twins twirl twist twit two twos tying tyke type typed
types typo ugh ugly ulcer uncle uncut under undo undue unfit unify union
unit unite units unity untie until unto unwed upon upper ups upset urban
urge urged urges urine urn usage use used uses usher usual usurp utter uvula
vague vain val vale valet valid valor value valve vamp van vane vans vapor
vary vase vases vast vat vats vault veal veep veer veers veil vein veins
venal vend vends venom vent vents verb verbs verge verse verve very vest
vests vet veto vets vex vexed vexes via vial vibes vice vices video vie view
vigil vigor vii viii vile vine vines vinyl viola virus visa vise visit visor
vista vital viva vivid vixen vocal vodka vogue voice void volt volts vomit
vote vouch vow vowel vows wacko wacky wad wade wades wafer wag wage wager
wages wagon wags waif wail wails waist wait wake waken waldo walk wall walls
wally waltz wand want wants war ward warm warn warns warp wars wart warts
wary was wash wasp wasps waste watch water watt watts wave waved waver waves
wavy wax waxy way ways weak wear wears weary weave web webs wed wedge weds
wee weed weedy week weeks weep weeps weigh weird weld well wells welsh went
wept were west wet wets whale wham wharf what wheat whee wheel when where
whew which whiff while whim whine whip whips whir whirl white whiz who whoa
whole whom whoop whose why wick wide widen wider widow width wield wife wig
wigs wild will wills willy wilt wily wimp wimpy win wince winch wind windy
wine wines wing wings wink winks wino wins wipe wire wires wiry wise wiser
wish wisp wispy wit witch with wits witty woe woes wok woke wolf woman womb
women won woo wood woods woody woof wool woos word words wordy wore work
world worm worms wormy worn worry worse worst worth would wound wove woven
wow wrap wrath wreak wreck wren wring wrist write wrong wrote wry xerox xii
xiii xiv xvi xvii yacht yahoo yak yam yams yang yank yanks yap yard yards
yarn yawn yawns yea yeah year yearn yeast yell yelp yen yep yes yet yew yews
yield yin yip yips yodel yoga yogi yoke yokel yolk yore you young your yours
youth yrs yucca yuck yule zap zaps zeal zebra zen zero zest zesty zeta zilch
zinc zing zip zips zone zoned zoo zoom zooms zoos
)
n=(ARGV.count>0) ? ARGV[0].to_i : 1
n.times do
p=words.sample(4).map { |s| s[0..0].upcase+s[1..-1] }*""
p.sub!(/[aei]/) { |m| {a: 4, e: 3, i: 1, o: 0}[m.to_s.to_sym].to_s }
puts p
end
general-ccdc/windows_autoruns.jpg
Executable
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.2 MiB

internal-wiki/cheat-sheets/PaloAltoNetworksFirewall.md
Executable
+104
View File
@@ -0,0 +1,104 @@
# Palo Alto firewall
Palo Alto firewalls run an operating system called PAN-OS. Documentation may be
found on the PAN website https://www.paloaltonetworks.com/documentation.
## CLI configuration
The OS exposes a Juniper-like command line interface. This means there is a
*operational mode* (denoted with `>` in the command list below) which allows you
to inspect the system as it is running and a *configuration mode* (denoted with
`#` in the command list below) which allows you to stage configuration
changes.
There does not seem to be a CLI reference for version 7 of the OS, but there is
one for version 6.1:
https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/technical-documentation/pan-os-61/PAN-OS-6.1-CLI-ref.pdf
Operation | Command
-------------------------------------------------|------------------------------
Find a command | `find command keyword <name>`
Enter configuration mode | `> configure`
Run an operational-mode command | `> run <command>`
Show diff of current and candidate configuration | `> show config diff`
| `# run show config diff`
Revert unsaved changes | `# load config last-saved`
Commit and save changes | `# commit`
### Secure configuration
**TODO** add information for sane default configuration
### NAT
Configuration tree under `rulebase nat rules`.
Rules are evaluated in order, and a matching rule ends the translation process.
Don't forget to also add security policies for inter-zone traffic.
### Firewall
Configuration tree under `rulebase security rules`.
**NOTE** when using SNAT, use the post-NAT source *zone*, but pre-NAT source
*address*! Likewise, when using DNAT, use the post-NAT destination *zone*, but
pre-NAT destination *address*! See
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/networking/nat-policy-rules#72366.
**TODO** figure out if these rules hold true. Netlab lab 3 suggests otherwise
for source zone...
You can test NAT rules using `> test nat-policy-match`.
**TODO** figure out difference between *applications* and *services*.
By default, intra-zone traffic is allowed and inter-zone traffic is denied. You
can change this under `rulebase default-security-rules`.
### Loading partial configuration
Loading a partial configuration is very finicky. If you do it wrong, e.g. by
using an incorrect load command syntax, you might be logged out from your terminal without warning.
```bash
scp import configuration source-ip <IP> from <user>@<host>:<file>
load config partial from <file> mode <mode> from-xpath <path> to-xpath /config/<path>
```
Those paths do not match the paths you will see in configuration mode, instead
refer to the following table:
Xpath | Configuration mode items under this path
-----------------------------|-----------------------------------------
... | mgt-config, shared
devices/entry/... | deviceconfig, network
devices/entry/vsys/entry/... | application, application-group, import, rulebase, schedule, service, service-group, zone
There are 3 modes: *replace*, *merge* and *append*. *merge* and *append* are
both pretty much ill-defined and should basically only be used when there is a
list of multiple named entries that you want to append to.
## Guides and documentation
*Designing Networks with Palo Alto Networks Firewalls*: https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/IntegrationArticles/29/1/PaloAltoNetworks-Designs-Guide-RevB.pdf
SANS put together nice guide for securely configuring PA firewalls, but
unfortunately it mostly talks about the web interface. However, there are links
to the PAN website which usually include the equivalent CLI commands: https://www.sans.org/reading-room/whitepapers/auditing/palo-alto-firewall-security-configuration-benchmark-35777
## Netlab+ PA Firewall essentials lab series
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_01.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_02.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_03.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_04.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_05.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_06.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_07.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_08.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_09.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_10.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_11.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_12.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_13.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_14.pdf
https://openlabs.netdevgroup.com/local/ex/PAN7FE_0050_56A9_38CC_5682_DA4B/doc/PAN7_Lab_15.pdf
internal-wiki/cheat-sheets/auditd.md
Executable
+100
View File
@@ -0,0 +1,100 @@
# auditd
## Installation
CentOS, RHEL, Fedora, etc.: Usually already installed. If not, do `yum install audit audit-libs`.
Debian/Ubuntu: `apt-get install auditd audispd-plugins`
## Rules
are located in `/etc/audit/rules.d/`
* List rules: `auditctl -l`
* Delete rules: `auditctl -D`
* reload rules: `auditctl -R /etc/audit/audit.rules`
* Watch a file: `auditctl -a exit,always -F path=/etc/passwd -F perm=wa`
* Permissions: r = read, w = write, x = execute, a = attribute change
* Find events related to file access: `ausearch -f /etc/passwd`
* Interesting fields: __auid__ is the userid of the logged in user performing the action. __exe__ is the executable used for this action.
* lookup syscall ids `ausyscall x86_64 188`
* restrict rule to userid `-F auid=80`
* Man page: `man audt.rules`
# Our Rule set
## basic rule set
```
# available keys: ps, critical, high, medium, low
# ps: process creation, fork, and network access. For forensic use.
# critical: needs urgent attention, needs to be monitored at all times
# high: highly suspicious behavior, should be regularly monitored
# medium: suspicious behavior, look at this when time allows
# low: important events that do not need to be monitored but important enough to log for later investigation in case of compromise
# Delete any preexisting rules before starting to define new ones.
-D
# Set the number of buffers to take the audit messages. Depending on the level of audit logging on your system, increase or decrease this figure.
-b 8192
# Set the failure flag to use when the kernel needs to handle critical errors. Possible values are 0 (silent), 1 (printk, print a failure message), and 2 (panic, halt the system).
-f 2
# watch forks and network activity under key ps
-a always,exit -F arch=b64 -S execve -S vfork -S fork -S clone -S exit -S exit_group -S connect -S bind -S sendto -k ps
-a always,exit -F arch=b32 -S execve -S vfork -S fork -S clone -S exit -S exit_group -S socketcall -k ps
# Enable an audit context for any linking operation, such as symlink, link, unlink, or rename.
-a always,exit -F arch=b64 -S unlink -S rename -S link -S symlink -k high
-a always,exit -F arch=b32 -S unlink -S rename -S link -S symlink -k high
# Enable an audit context for any operation related to extended file system attributes.
-a always,exit -F arch=b64 -S setxattr -k high
-a always,exit -F arch=b64 -S lsetxattr -k high
-a always,exit -F arch=b64 -S fsetxattr -k high
-a always,exit -F arch=b64 -S removexattr -k high
-a always,exit -F arch=b64 -S lremovexattr -k high
-a always,exit -F arch=b64 -S fremovexattr -k high
# Enable an audit context for the mknod system call, which creates special (device) files.
-a always,exit -F arch=b64 -S mknod -k high
# More high impact Watches by tobi
-w /etc/passwd -p wa -k critical
-w /etc/shadow -k critical
-w /etc/group -p wa -k critical
-w /etc/sudoers -k critical
-w /etc/sudoers.d/ -p wa -k critical
# More medium impact watches by tobi
-w /bin/ -p wa -k medium
-w /boot/ -p wa -k medium
-w /etc/ -p wa -k medium
-w /lib/ -p wa -k medium
-w /opt/ -p wa -k medium
-w /root/ -p wa -k medium
-w /sbin/ -p wa -k medium
-w /srv/ -p wa -k medium
-w /usr/ -p wa -k medium
# no executables in /tmp/
-w /tmp/ -p x -k high
# Adjust those lines to the system at hand!
# make sure not to include dirs for cache files
-w /var/www/ -p wa -k medium
```
Short-link: http://bit.do/auditd
# ausearch
`ausearch` is a tool to query audit daemon logs.
* `ausearch -f /etc/passwd` - search for event corresponding to specific file
* `ausearch -k critical` - search for key
* `ausearch -ts recent` - all events in last 10 minutes
* `ausearch -ts 15:10` - all events since 3.10pm
# Visualization
## auditps.rb
* get it: `git clone https://github.com/jethrogb/audittools.git`
* install ruby `yum install ruby`
* run: `ausearch -r -k ps|./auditps.rb|less -S`, where the 0:0 specifies a time
## other ways
Look at https://www.suse.com/documentation/sled10/audit_sp1/data/app_audit_mkbar.html
internal-wiki/cheat-sheets/encryption.md
Executable
+7
View File
@@ -0,0 +1,7 @@
# Encryption
Sometimes you simply want to encrypt a file, e.g. the database backup file.
Encrypt: `openssl aes-256-cbc -salt -in file.tar -out file.tar.enc`
Decrypt: `openssl aes-256-cbc -d -in file.tar.enc -out file.tar.new`
You can also pipe to it by not specifying the `-in` parameter.
internal-wiki/cheat-sheets/firewallMySystemsReference.md
Executable
+101
View File
@@ -0,0 +1,101 @@
# firewallmy.systems
You can setup firewall rules really easily through
`curl http://firewallmy.systems/ipfw/t22/t80/u5000/ | /bin/bash`
```
Usage: firewallmy.systems/FIREWALL/PORTSPEC
FIREWALL = iptables | pf | ipfw
PORTSPEC = (t|u|tu|ut)PORTNUMBER [PORTSPEC]
t for TCP
u for UDP
The firewalls generated are actually shell scripts that set up those firewalls,
so feel free to pipe the output of this command into bash or something.
Example: generate an iptables firewall script opening TCP 22, 80, and UDP 5000
firewallmy.systems/iptables/t22/t80/u5000/
```
# Example Printouts
If the website is not available you'll be glad to have these printouts.
http://firewallmy.systems/iptables/t22/t80/u5000/
```
# backup
iptables -S > fms-backup.iptables
# reset
iptables -F
# preamble
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
# Allow pings
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT
# Allow open connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# specific rules follow:
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p udp --dport 5000 -j ACCEPT
echo ' >>> DONE! <<<'
```
http://firewallmy.systems/ipfw/t22/t80/u5000/
```
# backup
ipfw list > fms-backup.ipfw
# reset
ipfw -q -f flush
# preamble
ipfw -q add 10 allow all from any to any via lo0
ipfw -q add 20 deny all from any to 127.0.0.0/8
ipfw -q add 30 deny all from 127.0.0.0/8 to any
ipfw -q add 40 deny tcp from any to any frag
ipfw -q add 50 check-state
ipfw -q add 60 allow tcp from any to any established
ipfw -q add 70 allow all from any to any out keep-state
ipfw -q add 80 allow icmp from any to any
# open ports
ipfw -q add 90 allow tcp from any to any 22 in
ipfw -q add 100 allow tcp from any to any 80 in
ipfw -q add 110 allow udp from any to any 5000 in
ipfw -q add 220 deny all from any to any
echo ' >>> DONE! <<<'
```
http://firewallmy.systems/pf/t22/t80/u5000/
```
# backup
pfctl -sr > fms-backup.pf
echo '
set block-policy drop
set skip on lo0
match in all scrub (no-df max-mss 1440)
block in all
block out quick inet6 all
block in quick inet6 all
block in quick from { urpf-failed no-route } to any
pass out quick inet keep state
pass in proto tcp from any to any port 22 flags S/SA synproxy state
pass in proto tcp from any to any port 80 flags S/SA synproxy state
pass in proto udp from any to any port 5000 flags S/SA synproxy state
' > ./fms-firewall-rules.pf
pfctl -f ./fms-firewall-rules.pf
echo ' >>> DONE! <<<'
```
internal-wiki/cheat-sheets/operating_systems/JunOS.md
Executable
+351
View File
@@ -0,0 +1,351 @@
# JunOS
## Intro
**JunOS** is the operating system that runs on ''Juniper Networks'' equipment.
It is a FreeBSD derivative.
## Command-line interface
If you login as `root`, you get a `csh`. The JunOS configuration shell is
`/usr/sbin/cli`. All the documentation you will find online uses this shell.
### Basic operations
http://www.juniper.net/techpubs/software/junos/
Normally, you'll get a prompt like this:
```
root@VJX0>
```
You can view the configuration with `show configuration`. As you will see, the
configuration is hierarchical, and curly braces are used to separate levels.
You can go into configuration mode:
```
root@VJX0> edit
Entering configuration mode
[edit]
root@VJX0#
```
Once in configuration mode, use `set` to configure things, or use `delete` to
unconfigure things. There is good tab-completion, or you can also type `?` to
get a list of options. You can use `edit` again to limit your scope (e.g.
`edit system services`), and you can then use `up` to broaden your scope again
(also `up [number]`). Use `show` to show the current configuration in the
current scope.
Once you're done editing you can do any of the following:
```
exit remember changes but don't use them
show | compare show changes w.r.t. live configuration
commit check check configuration for errors
commit save changes and apply to live configuration
rollback undo all uncommitted changes
```
## Transparent firewalling
Following is a template configuration for transparent firewalling on SRX or J
devices. Note that the built-in DHCP server does not work in transparent mode!
You need to reboot if you change the router from route to transparent mode or
vice-versa.
This configuration just shows a simple in-line transparent firewall. You could
do more advanced things such as use the integrated bridging/switching for
Bastion-like setups.
```
system {
time-zone America/Los_Angeles;
root-authentication;
name-server {
[DNS-IP];
}
services {
ssh;
}
}
interfaces {
fe-0/0/0 {
unit 0 {
family bridge {
interface-mode access;
vlan-id 1;
}
}
}
fe-0/0/1 {
unit 0 {
family bridge {
interface-mode access;
vlan-id 1;
}
}
}
# etc...
irb {
unit 0 {
family inet {
address [ACCESS-IP]/8;
}
}
}
}
security {
policies {
# Policies MUST BE setup, default is block.
default-policy {
deny-all;
}
}
zones {
security-zone local {
host-inbound-traffic {
system-services {
ssh;
ping;
}
}
interfaces {
fe-0/0/1.0;
# etc...
}
}
security-zone outside {
interfaces {
fe-0/0/0.0;
}
}
}
}
bridge-domains {
bd1 {
domain-type bridge;
vlan-id 1;
routing-interface irb.0;
}
}
```
Below are some example security policies you could use. Capirca also supports
JunOS.
```
# Example policies
security {
policies {
from-zone outside to-zone local {
policy inbound-icmp {
match {
source-address any;
destination-address any;
application junos-icmp-all;
}
then {
permit;
}
}
}
from-zone local to-zone outside {
policy outbound-icmp {
match {
source-address any;
destination-address any;
application junos-icmp-all;
}
then {
permit;
}
}
policy outbound-ssh {
match {
source-address any;
destination-address any;
application junos-ssh;
}
then {
permit;
}
}
}
from-zone local to-zone local {
policy local2local-traffic {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
}
}
```
## Switching
All ports on separate VLANs with a trunk port, management IP is native on trunk
port. On SRX:
```
system {
time-zone America/Los_Angeles;
root-authentication;
name-server {
[DNS-IP];
}
services {
ssh;
}
}
interfaces {
fe-0/0/0 {
unit 0;
}
fe-0/0/1 {
unit 0 {
family ethernet-switching {
vlan {
members 1;
}
}
}
}
fe-0/0/2 {
unit 0 {
family ethernet-switching {
vlan {
members 2;
}
}
}
}
fe-0/0/7 {
unit 0 {
family ethernet-switching {
port-mode trunk;
vlan {
members all;
}
native-vlan-id 100;
}
}
}
vlan {
unit 0 {
family inet {
address [ACCESS-IP]/8;
}
}
}
}
security {
zones {
security-zone management {
host-inbound-traffic {
system-services {
ssh;
ping;
}
}
interfaces {
vlan.0;
}
}
}
}
vlans {
v100 {
vlan-id 100;
l3-interface vlan.0;
}
v1 {
vlan-id 1;
}
v2 {
vlan-id 2;
}
}
```
## Routing
TODO
## Layer 3 port mirroring
Step 1: Configure port mirroring in the forwarding options hierarchy:
[edit forwarding-options]
port-mirroring {
input {
rate 1;
run-length 10;
}
family inet {
output {
interface ge-0/0/1.0 {
next-hop 2.2.2.1;
}
}
}
}
Step 2: Configure firewall filter to port mirror
[edit firewall]
filter port-mirror {
term 1 {
from {
source-address {
0.0.0.0/0;
}
}
then {
port-mirror;
accept;
}
}
}
Step 3: Apply the filter on an interface that is to be mirrored
[edit interfaces]
ge-0/0/0 {
unit 0 {
family inet {
filter {
input port-mirror;
output port-mirror;
}
address 1.1.1.1/24;
}
}
}
**Note:** Port mirroring with ethernet-switching is not supported.
From https://kb.juniper.net/KB21833
## References
For J- and SRX-Series:
* [Interfaces Configuration Guide for Security Devices](http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/security/software-all/interfaces/index.html): PoE
* [Layer 2 Bridging and Switching Configuration Guide for Security Devices](http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/security/software-all/layer-2/index.html): Bridging, Transparent mode, VLAN
* [Initial Configuration Guide for Security Devices](http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/security/software-all/initial-config/index.html): Users, SSH, DHCP client/server
* [Routing Protocols and Policies Configuration Guide for Security Devices](http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/security/software-all/routing/index.html): BGP
* [Security Configuration Guide](http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/security/software-all/security/index.html): Packet- and flow-based filters, Security zones/policies, NAT
* [J Series and Branch SRX Series Ethernet Switching Configuration Guide](http://www.juniper.net/us/en/local/pdf/app-notes/3500196-en.pdf): Switching, VLAN
For EX-series:
* [Ethernet Switching on EX Series Switches](http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/ex-series/software-all/book-software-ex-series-ethernet-switching.pdf): Switching, VLAN
* [Network Management and Monitoring on EX Series Switches](http://www.juniper.net/techpubs/en_US/junos11.4/information-products/pathway-pages/ex-series/network-mgmt.pdf): Port mirroring (SPAN)
internal-wiki/cheat-sheets/operating_systems/OS-overview.md
Executable
+88
View File
@@ -0,0 +1,88 @@
# Linux and BSD quick start
Imagine you encounter a operating system you have never used before or heard of
before. This cheat sheet should give you the most important information about
the OS at hand.
## TODO
This document is under construction. Please improve it. At the end we want to
have:
For standard Linuxes and BSDs
* how to find out version
* where to configure repository information
* standard package manager commands
* installed packages
* update repository
* install/upgrade 1 package
* search for a package
* firewalls
### Find out what box you are sitting in front of
```bash
cat /etc/*-release
lsb_release -a
cat /proc/version
```
### Filesystem Hierarchy Standard
https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard
## Linuxes
Linux | Latest Release | Comments
-----------------|------------------------------------------|-----------------
Debian | 8.3 - Jessie (January 23, 2016) | Very stable linux, often used for servers. Uses apt as package manager.
Ubuntu | 15.10 - Wily Werewolf (October 21, 2015) | Based on Debian
Mint | 17.3 - Rosa (January 9th, 2016) | Similar to debian
RHEL | 7.2, 6.7, 5.11 (November 19, 2015) | Red Hat Enterprise Linux. Package manager: RPM. Update method: Yum / PackageKit
CentOS | 7.2-1511 (December 14th, 2015) | Release numbers are based off RHEL, binary-compatible to RHEL
Scientific Linux | | Binary-compatible to RHEL
Oracle Linux | | Binary-compatible to RHEL
Fedora | 23 (November 3rd, 2015) | See RHEL
SLES (SUSE) | 12SP1 (December 18, 2015) | (SUSE Linux Enterprise Server) Package manager: RPM. Update method: Zypper/YaST2
Void Linux | Rolling release | Entire new system
ArchLinux | |
Slackware | |
Mageia | | Update Method: urpmi (rpmdrake). Package manager: RPM
ClearOS | |
Gentoo | |
## BSDs
BSD | Comments
--------------| -------------
FreeBSD | by far most popular BSD. Latest version is 10.2 (2015-08-13)
OpenBSD | Latest version: 5.8 (2015-10-18)
NetBSD | Latest version: 7.0 (2015-10-08)
Darwin | Latest version: 15.0.0 (2015-09-16), released by Apple. OX X is based on Darwin. Package manager: No standard. There are ports available for MacPorts (formerly DarwinPorts), Fink, Homebrew, RPM, pkgsrc, and Portage
DragonFly BSD | Based on FreeBSD, Latest version: 4.0.3 (2015-01-21). Package manager: pkgng
## Package Managers
Manager | Info
--------|------------
RPM | There are binary rpms (BRPMs) and source rpms (SRPMs), indicated by “.src.rpm”
yum | Used for RHEL, CentOS, Fedora, etc. Uses .rpm packages
pacman | Package manager for Arch, lots of community support online
dpkg | Debian-based package installer (.deb packages) `dpkg -i <package>` installs a package, `dpkg -L <package>` shows files installed by a package
APT | Pretty much just a front-end for `dpkg` over the network
portage | Gentoo package manager, uses `emerge` behind the scenes
## Update Methods
Update Method | Info
--------------|----------
apt-get | Uses dpkg as backend. See https://wiki.archlinux.org/index.php/Pacman/Rosetta and https://help.ubuntu.com/community/AptGet/Howto
pacman | See https://wiki.archlinux.org/index.php/Pacman/Rosetta
dnf | See https://wiki.archlinux.org/index.php/Pacman/Rosetta
zypper | See https://wiki.archlinux.org/index.php/Pacman/Rosetta
emerge | See https://wiki.archlinux.org/index.php/Pacman/Rosetta
xbps | See https://wiki.archlinux.org/index.php/Pacman/Rosetta
urpmi | x
YaST2 | x
yum | Uses rpm as backend
internal-wiki/cheat-sheets/operating_systems/bsd.md
Executable
+37
View File
@@ -0,0 +1,37 @@
# BSD Cheat Sheet
### Explore the system, see what is running
* `sockstat` -- lists open sockets
* `tail -f -n 30 /var/log/syslog` monitor log
### General BSD hints
* The group wheel allows you to su (and maybe other stuff)
* For package management there are two ways: ports (installing from source) and
packages (installing binaries). Both understand dependencies
* The package manager is `pkg`
* `pkg search`, `pkg update`, `pkg upgrade`, as usual, `pkg delete` for
uninstall
* repos configured under `/usr/local/etc/pkg/repos/`. Default repo can be
disabled by creating `FreeBSD.conf` with content `FreeBSD: {enabled: no}`
* startup configuration is `/etc/rc.conf`
* config files are in `/usr/local/etc/`
* undeletable flag: `chflags sunlink file1`, `chflags nosunlink file1`. View
flags: `ls -lo file1`
* change to bash (permanently) `chsh -s /usr/local/bin/bash`
* set http proxy `setenv HTTP_PROXY http://ProxyNameOrIp:8080`
* network config file: `/etc/rc.conf`.
### rc.conf
```
hostname="new.host.name"
```
### Package Management
There is `pkg` for managing pre-compiled packages and ports for compiling from
source.
* Download the official ports collection: `portsnap fetch; portsnap extract`
* To update, use `portsnap fetch update`
* To install a port: `cd /usr/ports/yourArea/yourPackage` and `make install`.
Can also do `make deinstall`.
internal-wiki/cheat-sheets/operating_systems/freebsd.md
Executable
+17
View File
@@ -0,0 +1,17 @@
# FreeBSD Essentials
## Networking
Issue | Solution
---|---
Upgrade packages | `pkg update`
Set HTTP proxy|`setenv HTTP_PROXY http://proxy.berke1337.org:8080/`
configure DHCP|in file `/etc/rc.conf` set `ifconfig_em0="DHCP"`
configure static ip|in file `/etc/rc.conf` set `ifconfig_em0="inet 10.10.10.100 netmask 255.255.255.0" defaultrouter="10.10.10.1"`
restart networking | `/etc/rc.d/netif restart && /etc/rc.d/routing restart`
## User Management
Issue | Solution
---|---
add user | `adduser`
add group |`pw groupadd teamtwo`
add user to group | `pw groupmod teamtwo -M peter`
internal-wiki/cheat-sheets/operating_systems/solaris.md
Executable
+17
View File
@@ -0,0 +1,17 @@
# Solaris
## History, Overview
Solaris is a Unix operating system originally developed by Sun Microsystems. It superseded their earlier SunOS in 1993. Oracle Solaris, so named as of 2010, has been owned by Oracle Corporation since the Sun acquisition by Oracle in January 2010.
At some point, Sun open-sourced parts of Solaris as OpenSolaris. Oracle discontinued the OpenSolaris project. It has been forked as illumos. OpenIndiana is a popular illumos distribution.
## OpenIndiana
### Package Management
The package manager is `pkg`.
### Networking
* Show interfaces: `dladm show-ether`
* Rename interface: `dladm rename-link rtls0 eth0 `
* Setup DHCP: `ipadm create-addr –T dhcp eth0/v4dhcp `
### Service Management
* restart service: `svcadm restart ssh`
internal-wiki/cheat-sheets/orange.md
Executable
+23
View File
@@ -0,0 +1,23 @@
# Dealing with the Orange Team
## Policy Creation
Some injects may involve dealing with creating policies (i.e. Acceptable Use). Use an existing template for this
* [SANS](https://www.sans.org/security-resources/policies/)
* [California's Department of Technology](http://www.cio.ca.gov/OIS/Government/library/samples.asp)
## Incident Reporting
* Make sure that there are logs and audits for this
* Windows LSP/GPO set for Auditing; make sure no program is piping to /dev/null
* Check /var/log/, but make sure not to get overloaded by useless information
* Must demonstrate some issue other than just port scanning
* Before uninstalling rootkits/mitigation, send the report first
## Presentation Topics
* In regionals, you have two hours or more to prepare for a five minute presentation, with the ability to bring a PowerPoint.
* Whoever does it shouldn't have much to do; they will have to be with the rest of the teams until everyone is done
* ~1 hour; early leave/late arrival is 0 points
* Topics are usually easily searchable and business (buzzword) related, such as "Next Gen End Point Security"
## Other Reporting (i.e. Vuln. Scans, Usage)
* They will occasionally ask for a vulnerability scan of the system or a usage check of a service
* For the former, a nmap picture is *not* enough
internal-wiki/cheat-sheets/package-managers.xlsx
Executable
BIN
View File
Binary file not shown.
internal-wiki/cheat-sheets/package_manager_reference.md
Executable
+65
View File
@@ -0,0 +1,65 @@
# Package Managers Reference Configurations
### Debian - apt
default /etc/apt/sources.list:
#### Debian 8 Jessie (April 2015)
```
deb http://ftp.us.debian.org/debian jessie main
deb-src http://ftp.us.debian.org/debian jessie main
deb http://ftp.us.debian.org/debian jessie-updates main
deb-src http://ftp.us.debian.org/debian jessie-updates main
deb http://security.debian.org/ jessie/updates main
deb-src http://security.debian.org/ jessie/updates main
```
For Debian 7.0 Wheezy (May 2013) or Debian 6.0 Squeeze (February 2011) or even
earlier versions, just replace `jessie` with the correct codeword.
### Ubuntu - apt
sources.list generator under https://repogen.simplylinux.ch/
#### Ubuntu Trusty 14.04 LTS
```
###### Ubuntu Main Repos
deb http://us.archive.ubuntu.com/ubuntu/ trusty main restricted universe
deb-src http://us.archive.ubuntu.com/ubuntu/ trusty main restricted universe
###### Ubuntu Update Repos
deb http://us.archive.ubuntu.com/ubuntu/ trusty-security main restricted universe
deb-src http://us.archive.ubuntu.com/ubuntu/ trusty-security main restricted universe
```
Add missing public key: `apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEY_ID` KEY_ID should look like 2EA8F35793D8809A.
### Centos - yum
Example /etc/yum.repos.d/CentOS-Base.repo:
```
# Change gpgcheck to 0 if the keys have also been "optimized" off the system
[base]
name=CentOS-$releasever - Base
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os
#baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
# Released updates
[updates]
name=CentOS-$releasever - Updates
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates
#baseurl=http://mirror.centos.org/centos/$releasever/updates/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
# Additional packages that may be useful
[extras]
name=CentOS-$releasever - Extras
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras
#baseurl=http://mirror.centos.org/centos/$releasever/extras/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
```
internal-wiki/cheat-sheets/ports.md
Executable
+271
View File
@@ -0,0 +1,271 @@
## Well-known ports
The port numbers in the range from 0 to 1023 are the ''well-known ports'' or ''system ports''. They are used by system processes that provide widely used types of network services. On Unix-like operating systems, a process must execute with superuser privileges to be able to bind a network socket to an IP address using one of the well-known ports.
| Port | TCP | UDP | Description | Status|
|------|-----|-----|-------------|-------|
| 0 | n/a | n/a | In programming APIs (not in communication between hosts), requests a system-allocated (dynamic) port | n/a
| 0 | TCP | UDP | Reserved | Official
| 1 | TCP | UDP | TCP Port Service Multiplexer (TCPMUX). Historic. Both TCP and UDP have been assigned to TCPMUX by IANA, | Official
| 4 | TCP | UDP | Unassigned | Official
| 5 | TCP | UDP | Remote job entry | Official
| 6 | TCP | UDP | Unassigned | Official
| 7 | TCP | UDP | Echo Protocol | Official
| 8 | TCP | UDP | Unassigned | Official
| 9 | | UDP | Wake-on-LAN | Unofficial
| 10 | TCP | UDP | Unassigned | Official
| 11 | TCP | UDP | Active Users (Systat (protocol)|systat service) | Official
| 12 | TCP | UDP | Unassigned | Official
| 13 | TCP | UDP | Daytime Protocol | Official
| 14 | TCP | UDP | Unassigned | Official
| 15 | TCP | UDP | Previously netstat service | Unofficial
| 16 | TCP | UDP | Unassigned | Official
| 17 | TCP | UDP | QOTD|Quote of the Day (QOTD) | Official
| 18 | TCP | UDP | Message Send Protocol | Official
| 19 | TCP | UDP | Character Generator Protocol (CHARGEN) | Official
| 20 | TCP | UDP | File Transfer Protocol (FTP) data transfer | Official
| 21 | TCP | UDP | File Transfer Protocol (FTP) control (command) | Official
| 22 | TCP | UDP | Secure Shell (SSH), secure logins, file transfers (secure copy|scp, SSH file transfer protocol|sftp) and port forwarding | Official
| 23 | TCP | UDP | Telnet protocol—unencrypted text communications | Official
| 25 | TCP | UDP | Simple Mail Transfer Protocol (SMTP), used for email routing between mail servers | Official
| 26 | TCP | UDP | Unassigned | Official
| 37 | TCP | UDP | Time Protocol | Official
| 38 | TCP | UDP | Route Access Protocol (RAP)Importance inline|date=October 2016 | Official
| 39 | TCP | UDP | Resource Location Protocol (RLP)Importance inline|date=September 2016—used for determining the location of higher level Service (systems architecture)|services from Host (network)|hosts on a Computer network|network | Official
| 40 | TCP | UDP | Unassigned | Official
| 42 | TCP | UDP | ARPA Host Name Server Protocol|Host Name Server Protocol | Official
| 43 | TCP | UDP | WHOIS protocol | Official
| 49 | TCP | UDP | TACACS+ Login Host protocolUpdate inline|?=yes|date=September 2016|reason=As of to date, there is ongoing work on publishing a new TACACS standard at IETF under draft document draft-ietf-opsawg-tacacs. | Official
| 50 | TCP | UDP | Remote Mail Checking ProtocolImportance inline|date=September 2016 | Official
| 51 | | | Reserved | Official
| 51 | TCP | UDP | Previously Interface Message Processor logical address managementCitation needed|date=October 2016 | Unofficial
| 52 | TCP | UDP | Xerox Network Systems (XNS) Time ProtocolImportance inline|date=October 2016 | Official
| 53 | TCP | UDP | Domain Name System (DNS) | Official
| 54 | TCP | UDP | Xerox Network Systems (XNS) clearinghouseImportance inline|date=October 2016 | Official
| 56 | TCP | UDP | Xerox Network Systems (XNS) authenticationImportance inline|date=October 2016 | Official
| 57 | TCP | UDP | Any private terminal accessElucidate|date=October 2016 | Official
| 58 | TCP | UDP | Xerox Network Systems (XNS) MailImportance inline|date=October 2016 | Official
| 67 | TCP | UDP | Bootstrap Protocol (BOOTP) server; also used by Dynamic Host Configuration Protocol (DHCP) | Official
| 68 | TCP | UDP | Bootstrap Protocol (BOOTP) client; also used by Dynamic Host Configuration Protocol (DHCP) | Official
| 69 | TCP | UDP | Trivial File Transfer Protocol (TFTP) | Official
| 70 | TCP | UDP | Gopher (protocol)|Gopher protocol | Official
| 71–74 | TCP | UDP | NETRJS protocol | Official
| 75 | TCP | UDP | Any private dial out serviceElucidate|date=October 2016 | Official
| 77 | TCP | UDP | Any private Remote job entryElucidate|date=October 2016 | Official
| 79 | TCP | UDP | Finger protocol | Official
| 80 | TCP | UDP | Hypertext Transfer Protocol (HTTP) | Official
| 80 | | UDP | QUIC (from Chromium (web browser)|Chromium) for HTTP | Unofficial
| 81 | | | Unassigned | Official
| 81 | TCP | | TorPark onion routingVerify source|date=October 2016 | Unofficial
| 82 | | UDP | TorPark controlVerify source|date=October 2016 | Unofficial
| 87 | | | Any private terminal linkElucidate|date=October 2016 | Official
| 88 | TCP | UDP | Kerberos (protocol)|Kerberos authentication system | Official
| 90 | TCP | UDP | PointCast (dotcom)Third-party inline|date=October 2016 | Unofficial
| 99 | TCP | | WIP message protocolVerify source|date=October 2016 | Unofficial
| 100 | | | Unassigned (with known unauthorized useElucidate|date=October 2016)<!-- Previous list item for port 100 was "CyberGate RAT protocol" --> | Official
| 102 | TCP | UDP | International Organization for Standardization|ISO Transport Service Access Point (TSAP) Class 0 protocol; | Official
| 105 | TCP | UDP | CCSO Nameserver | Official
| 107 | TCP | UDP | Rtelnet|Remote User Telnet Service (RTelnet) | Official
| 108 | TCP | UDP | IBM Systems Network Architecture (SNA) gateway access server | Official
| 109 | TCP | UDP | Post Office Protocol, version 2 (POP2) | Official
| 110 | TCP | UDP | Post Office Protocol, version 3 (POP3) | Official
| 111 | TCP | UDP | Open Network Computing Remote Procedure Call ('''ONC RPC''', sometimes referred to as '''Sun RPC''') | Official
| 113 | TCP | | Ident protocol|Ident, authentication service/identification protocol, used by Internet Relay Chat|IRC servers to identify users | Official
| 113 | TCP | UDP | Authentication Service (auth), the predecessor to ''identification protocol''. Used to determine a user's identity of a particular TCP connection. | Official
| 114 | | | Unassigned (deprecated since June 2004) | Official
| 115 | TCP | UDP | Simple File Transfer Protocol | Official
| 117 | TCP | UDP | UUCP Mapping Project (path service)Citation needed|date=October 2016 | Official
| 118 | TCP | UDP | Structured Query Language (SQL) ServicesTechnical statement|date=October 2016 | Official
| 119 | TCP | UDP | Network News Transfer Protocol (NNTP), | Official
| 123 | TCP | UDP | Network Time Protocol (NTP), used for time synchronization | Official
| 126 | TCP | UDP | Formerly Unisys Unitary Login, renamed by Unisys to NXEdit. Used by Unisys Programmer's Workbench for Clearpath MCP, an IDE for Unisys MCP programming languages|Unisys MCP software development | Official
| 135 | TCP | UDP | Distributed Computing Environment|DCE Communication endpoint|endpoint resolution | Official
| 135 | TCP | UDP | Microsoft EPMAP (End Point Mapper), also known as DCE/Remote procedure call|RPC Locator service, used to remotely manage services including DHCP server, Domain Name System|DNS server and Windows Internet Name Service|WINS. Also used by Distributed Component Object Model|DCOM | Official
| 137 | TCP | UDP | NetBIOS Name Service, used for name registration and Name resolution (computer systems)|resolution | Official
| 138 | TCP | UDP | NetBIOS Datagram Service | Official
| 139 | TCP | UDP | NetBIOS Session Service | Official
| 143 | TCP | UDP | Internet Message Access Protocol (IMAP), | Official
| 152 | TCP | UDP | Background File Transfer Program (BFTP)Importance inline|date=October 2016 | Official
| 153 | TCP | UDP | Simple Gateway Monitoring Protocol (SGMP), a protocol for remote inspection and alteration of gateway management information | Official
| 156 | TCP | UDP | Structured Query Language (SQL) ServiceTechnical statement|date=October 2016 | Official
| 158 | TCP | UDP | Distributed Mail System Protocol ('''DMSP''', sometimes referred to as '''Pcmail''')Importance inline|date=October 2016 | Official
| 161 | TCP | UDP | Simple Network Management Protocol (SNMP)Citation needed|reason=Please add citations for SNMPv2 and SNMPv3 protocols.|date=October 2016 | Official
| 162 | TCP | UDP | Simple Network Management Protocol Trap (SNMPTRAP)Citation needed|reason=Please add citations for SNMPv2 and SNMPv3 protocols.|date=October 2016 | Official
| 170 | TCP | UDP | Print serverVerify source|date=October 2016 | Official
| 177 | TCP | UDP | X Display Manager Control Protocol (XDMCP), used for remote logins to an X Display Manager serverSelf-published inline|certain=yes|date=October 2016 | Official
| 179 | TCP | UDP | Border Gateway Protocol (BGP), used to exchange routing and reachability information among Autonomous system (Internet)|autonomous systems (AS) on the Internet | Official
| 194 | TCP | UDP | Internet Relay Chat (IRC) | Official
| 199 | TCP | UDP | SNMP multiplexing protocol (SMUX)Importance inline|date=October 2016 | Official
| 201 | TCP | UDP | AppleTalk Routing Maintenance | Official
| 209 | TCP | UDP | Quick Mail Transfer Protocol | Official
| 210 | TCP | UDP | ANSI Z39.50 | Official
| 213 | TCP | UDP | Internetwork Packet Exchange (IPX) | Official
| 218 | TCP | UDP | Message posting protocol (MPP) | Official
| 220 | TCP | UDP | Internet Message Access Protocol (IMAP), version 3 | Official
| 259 | TCP | UDP | Efficient Short Remote Operations (ESRO) | Official
| 262 | TCP | UDP | Arcisdms | Official
| 264 | TCP | UDP | Border Gateway Multicast Protocol (BGMP) | Official
| 280 | TCP | UDP | http-mgmt | Official
| 300 | TCP | | ThinLinc Web Access | |Unofficial
| 308 | TCP | | Novastor Online Backup | Official
| 311 | TCP | | Mac OS X Server Admin) | Official
| 318 | TCP | UDP | PKIX Time Stamp Protocol (TSP) | Official
| 319 | | UDP | Precision Time Protocol (PTP) event messages | Official
| 320 | | UDP | Precision Time Protocol (PTP) general messages | Official
| 350 | TCP | UDP | Mapping of Airline Traffic over Internet Protocol (MATIP) type A | Official
| 351 | TCP | UDP | MATIP type B | Official
| 356 | TCP | UDP | cloanto-net-1 (used by Cloanto Amiga Explorer and VMs) | Official
| 366 | TCP | UDP | On-Demand Mail Relay (ODMR) | Official
| 369 | TCP | UDP | Rpc2portmap | Official
| 370 | TCP | | codaauth2, Coda authentication server | Official
| 370 | | UDP | codaauth2, Coda authentication server | Official
| 370 | | UDP | securecast1, outgoing packets to McAfee|NAI's SecureCast serversAs of|2000 | Official
| 371 | TCP | UDP | ClearCase albd | Official
| 383 | TCP | UDP | HP data alarm manager | Official
| 384 | TCP | UDP | A Remote Network Server System | Official
| 387 | TCP | UDP | AURP (AppleTalk Update-based Routing Protocol) | Official
| 389 | TCP | UDP | Lightweight Directory Access Protocol (LDAP) | Official
| 399 | TCP | UDP | Digital Equipment Corporation DECnet (Phase V+) over TCP/IP | Official
| 401 | TCP | UDP | Uninterruptible power supply (UPS) | Official
| 427 | TCP | UDP | Service Location Protocol (SLP) | Official
| 433 | TCP | UDP | NNSP, part of Network News Transfer Protocol | Official
| 434 | TCP | UDP | Mobile IP Agent (RFC 5944) | Official
| 443 | TCP | UDP | Hypertext Transfer Protocol over Transport Layer Security|TLS/Secure Sockets Layer|SSL (HTTPS) | Official
| 443 | | UDP | QUIC (from Chromium) for HTTPS | Unofficial
| 444 | TCP | UDP | Simple Network Paging Protocol (SNPP), RFC 1568 | Official
| 444 | TCP | | Well known Slither.io port | Unofficial
| 445 | TCP | | Microsoft-DS Active Directory, Windows shares | Official
| 445 | TCP | | Microsoft-DS Server Message Block|SMB file sharing | Official
| 464 | TCP | UDP | Kerberos (protocol)|Kerberos Change/Set password | Official
| 465 | TCP | | URL Rendezvous Directory for SSM (Cisco protocol) | Official
| 465 | TCP | | Authenticated Simple Mail Transfer Protocol|SMTP over Transport Layer Security|TLS/Secure Sockets Layer|SSL (SMTPS) | Unofficial
| 475 | TCP | UDP | tcpnethaspsrv, Aladdin Knowledge Systems Hasp services | Official
| 491 | TCP | | GO-Global|GO-Global remote access and application publishing software | Unofficial
| 497 | TCP | | Retrospect (software)|Dantz Retrospect | Official
| 500 | TCP | UDP | Internet Security Association and Key Management Protocol (ISAKMP) / Internet Key Exchange (IKE) | Official
| 502 | TCP | UDP | Modbus Protocol | Official
| 504 | TCP | UDP | Citadel/UX|Citadel, multiservice protocol for dedicated clients for the Citadel groupware system | Official
| 510 | TCP | UDP | FirstClass Protocol (FCP), used by FirstClass client/server groupware system | Official
| 512 | TCP | | Remote Process Execution|Rexec, Remote Process Execution | Official
| 512 | | UDP | comsat, together with Biff (computing)|biff | Official
| 513 | TCP | | rlogin | Official
| 513 | | UDP | Who | Official
| 514 | TCP | | Remote Shell, used to execute non-interactive commands on a remote system (Remote Shell, rsh, remsh) | Official
| 514 | | UDP | Syslog, used for system logging | Official
| 515 | TCP | | Line Printer Daemon protocol|Line Printer Daemon (LPD), print service | Official
| 517 | | UDP | Talk | Official
| 518 | | UDP | NTalk | Official
| 520 | TCP | | efs, extended file name server | Official
| 520 | | UDP | Routing Information Protocol (RIP) | Official
| 521 | | UDP | Routing Information Protocol#RIPng|Routing Information Protocol Next Generation (RIPng) | Official
| 524 | TCP | UDP | NetWare Core Protocol (NCP) is used for a variety things such as access to primary NetWare server resources, Time Synchronization, etc. | Official
| 525 | | UDP | Timed, Timeserver | Official
| 530 | TCP | UDP | Remote procedure call (RPC) | Official
| 531 | TCP | UDP | AOL Instant Messenger | Unofficial
| 532 | TCP | | netnews | Official
| 533 | | UDP | netwall, For Emergency Broadcasts | Official
| 540 | TCP | | Unix-to-Unix Copy Protocol (UUCP) | Official
| 542 | TCP | UDP | commerce (Commerce Applications) | Official
| 543 | TCP | | klogin, Kerberos (protocol)|Kerberos login | Official
| 544 | TCP | | kshell, Kerberos (protocol)|Kerberos Remote shell | Official
| 545 | TCP | | OSIsoft PI (VMS), OSISoft PI Server Client Access | Unofficial
| 546 | TCP | UDP | DHCPv6 client | Official
| 547 | TCP | UDP | DHCPv6 server | Official
| 548 | TCP | | Apple Filing Protocol (AFP) over Transmission Control Protocol|TCP | Official
| 550 | TCP | UDP | new-rwho, new-who | Official
| 554 | TCP | UDP | Real Time Streaming Protocol (RTSP) | Official
| 556 | TCP | | Remotefs, Remote File System|RFS, rfs_server | Official
| 560 | | UDP | rmonitor, Remote Monitor | Official
| 561 | | UDP | monitor | Official
| 563 | TCP | UDP | NNTP over Transport Layer Security|TLS/Secure Sockets Layer|SSL (NNTPS) | Official
| 564 | TCP | | 9P (protocol)|9P (Plan 9 from Bell Labs|Plan 9) | Unofficial
| 585 | N/a | N/a | De-registeredWhen|date=October 2016 (with recommendation to use port 993 instead) | Official
| 585 | TCP | Dunno | Legacy use of Internet Message Access Protocol over Transport Layer Security|TLS/Secure Sockets Layer|SSL (IMAPS) | Unofficial
| 587 | TCP | | Mail submission agent|email message submission (Simple Mail Transfer Protocol|SMTP) | Official
| 591 | TCP | | FileMaker 6.0 (and later) Web Sharing (HTTP Alternate, also see port 80) | Official
| 593 | TCP | UDP | HTTP RPC Ep Map, Remote procedure call over Hypertext Transfer Protocol, often used by Distributed Component Object Model services and Microsoft Exchange Server | Official
| 601 | TCP | | Reliable Syslog Service — used for system logging | Official
| 604 | TCP | | TUNNEL profile, a protocol for BEEP Peer-to-peer|peers to form an application layer Tunneling protocol|tunnel | Official
| 623 | | UDP | ASF Remote Management and Control Protocol (ASF-RMCP) & IPMI Remote Management Protocol | Official
| 625 | TCP | | Open Directory Proxy (ODProxy) | Unofficial
| 631 | TCP | UDP | Internet Printing Protocol (IPP) | Official
| 631 | TCP | UDP | Common Unix Printing System (CUPS) administration console (extension to IPP) | Unofficial
| 635 | TCP | UDP | RLZ DBase | Official
| 636 | TCP | UDP | Lightweight Directory Access Protocol over Transport Layer Security|TLS/Secure Sockets Layer|SSL (LDAPS) | Official
| 639 | TCP | UDP | MSDP, Multicast Source Discovery Protocol | Official
| 641 | TCP | UDP | SupportSoft Nexus Remote Command (control/listening), a proxy gateway connecting remote control traffic | Official
| 643 | TCP | UDP | SANity | Official
| 646 | TCP | UDP | Label Distribution Protocol (LDP), a routing protocol used in Multiprotocol Label Switching|MPLS networks | Official
| 647 | TCP | | Dynamic Host Configuration Protocol|DHCP Failover protocol | Official
| 648 | TCP | | Registry Registrar Protocol (RRP) | Official
| 651 | TCP | UDP | IEEE-MMS | Official
| 653 | TCP | UDP | SupportSoft Nexus Remote Command (data), a proxy gateway connecting remote control traffic | Official
| 654 | TCP | | Media Management System (MMS) Media Management Protocol (MMP) | Official
| 655 | TCP | UDP | Tinc (protocol)|Tinc VPN daemon | Official
| 657 | TCP | UDP | IBM RMC (Remote monitoring and Control) protocol, used by IBM System p|System p5 IBM AIX (operating system)|AIX Integrated Virtualization Manager (IVM) and IBM Hardware Management Console|Hardware Management Console to connect managed LPAR|logical partitions (LPAR) to enable dynamic partition reconfiguration | Official
| 660 | TCP | | Mac OS X Server administration, | Official
| 666 | TCP | UDP | Doom (game)|Doom, first online first-person shooter | Official
| 666 | TCP | | [http://www.aircrack-ng.org/doku.php?id=airserv-ng airserv-ng], aircrack-ng's server for remote-controlling wireless devices | Unofficial
| 674 | TCP | | Application Configuration Access Protocol (ACAP) | Official
| 688 | TCP | UDP | REALM-RUSD (ApplianceWare Server Appliance Management Protocol) | Official
| 690 | TCP | UDP | Velneo Application Transfer Protocol (VATP) | Official
| 691 | TCP | | Microsoft|MS Microsoft Exchange Server|Exchange Routing | Official
| 694 | TCP | UDP | Linux-HA high-availability heartbeat | Official
| 695 | TCP | | IEEE Media Management System over Transport Layer Security|SSL (IEEE-MMS-SSL) | Official
| 698 | | UDP | Optimized Link State Routing protocol|Optimized Link State Routing (OLSR) | Official
| 700 | TCP | | Extensible Provisioning Protocol (EPP), a protocol for communication between domain name registry|domain name registries and domain name registrar|registrars (RFC 5734) | Official
| 701 | TCP | | Link Management Protocol (LMP), a protocol that runs between a pair of Node (networking)|nodes and is used to manage Teletraffic engineering|traffic engineering (TE) Telecommunications link|links | Official
| 702 | TCP | | IRIS (RFC 3983) | Official
| 706 | TCP | | SILC (protocol)|Secure Internet Live Conferencing (SILC) | Official
| 711 | TCP | | Cisco Tag Distribution Protocol | Official
| 712 | TCP | | Topology Broadcast based on Reverse-Path Forwarding routing protocol (TBRPF; RFC 3684) | Official
| 749 | TCP | UDP | Kerberos (protocol) administration | Official
| 750 | | UDP | kerberos-iv, Kerberos (protocol)|Kerberos version IV | Official
| 751 | TCP | UDP | kerberos_master, Kerberos (protocol)|Kerberos authentication | Unofficial
| 752 | | UDP | passwd_server, Kerberos (protocol)|Kerberos password (kpasswd) server | Unofficial
| 753 | TCP | | Reverse Routing Header (RRH) | Official
| 753 | | UDP | Reverse Routing Header (RRH) | Official
| 753 | | UDP | userreg_server, Kerberos (protocol)|Kerberos userreg server | Unofficial
| 754 | TCP | | tell send | Official
| 754 | TCP | | krb5_prop, Kerberos (protocol)|Kerberos v5 slave propagation | Unofficial
| 754 | | UDP | tell send | Official
| 760 | TCP | UDP | krbupdate [kreg], Kerberos (protocol)|Kerberos registration | Unofficial
| 782 | TCP | | Conserver serial-console management server | Unofficial
| 783 | TCP | | SpamAssassin spamd daemon | Unofficial
| 800 | TCP | UDP | mdbs-daemon | Official
| 808 | TCP | | Microsoft Net.TCP Port Sharing Service | Unofficial
| 829 | TCP | | Certificate Management Protocol| Unofficial
| 830 | TCP | UDP | NETCONF over Secure Shell|SSH | Official
| 831 | TCP | UDP | NETCONF over BEEP| Official
| 832 | TCP | UDP | NETCONF for SOAP over HTTPS | Official
| 833 | TCP | UDP | NETCONF for SOAP over BEEP | Official
| 843 | TCP | | Adobe Flash| Unofficial
| 847 | TCP | | Dynamic Host Configuration Protocol#Reliability|DHCP Failover protocol | Official
| 848 | TCP | UDP | Group Domain Of Interpretation (GDOI) protocol | Official
| 853 | TCP | UDP | Domain Name System|DNS over Transport Layer Security|TLS (RFC 7858) | Official
| 860 | TCP | | iSCSI (RFC 3720) | Official
| 861 | TCP | UDP | OWAMP control (RFC 4656) | Official
| 862 | TCP | UDP | TWAMP control (RFC 5357) | Official
| 873 | TCP | | rsync file synchronization protocol | Official
| 888 | TCP | | cddbp, CD database|CD DataBase (CDDB) protocol (CDDBP) | Unofficial
| 888 | TCP | | IBM Endpoint Manager Remote Control | Unofficial
| 897 | TCP | UDP | Brocade Communications Systems|Brocade SMI-S RPC | Unofficial
| 898 | TCP | UDP | Brocade Communications Systems|Brocade SMI-S RPC SSL | Unofficial
| 902 | TCP | UDP | VMware ESXi | Unofficial
| 903 | TCP | | VMware ESXi | Unofficial
| 914-988 | | | Unassigned | Official
| 944 | | UDP | Network File System ServiceCitation needed|date=October 2016 | Unofficial
| 953 | TCP | | BIND remote name daemon control (RNDC) | Unofficial
| 981 | TCP | | Remote HTTPS management for firewall devices running embedded Check Point VPN-1 software | Unofficial
| 987 | TCP | | Microsoft Windows SBS SharePointCitation needed|date=October 2016 | Unofficial
| 989 | TCP | UDP | FTPS Protocol (data), FTP over Transport Layer Security|TLS/Secure Sockets Layer|SSL | Official
| 990 | TCP | UDP | FTPS Protocol (control), FTP over Transport Layer Security|TLS/Secure Sockets Layer|SSL | Official
| 991 | TCP | UDP | Netnews Administration System (NAS) | Official
| 992 | TCP | UDP | Telnet protocol over Transport Layer Security|TLS/Secure Sockets Layer|SSL | Official
| 993 | TCP | | Internet Message Access Protocol over Transport Layer Security|TLS/Secure Sockets Layer|SSL (IMAPS) | Official
| 994 | TCP | UDP | Reserved | Official
| 994 | TCP | UDP | Internet Relay Chat over Transport Layer Security|TLS/Secure Sockets Layer|SSL (IRCS) | Unofficial
| 995 | TCP | | Post Office Protocol 3 over Transport Layer Security|TLS/Secure Sockets Layer|SSL (POP3S) | Official
| 1010| TCP | | ThinLinc web-based administration interfaceSelf-published inline|date=October 2016 | Unofficial
| 1023| TCP | UDP | Reserved | Official
internal-wiki/cheat-sheets/services/apache.md
Executable
+123
View File
@@ -0,0 +1,123 @@
# Apache Cheatsheet
* Default process name: `httpd`. Config usually in `/etc/apache2/httpd.conf`.
### Setup as reverse proxy
* `a2enmod proxy` or `LoadModule proxy_module modules/mod_proxy.so`
* Configure the Proxy
```
<VirtualHost *:*>
ProxyPass /app1/ http://localhost:81/
</VirtualHost>
```
#### Default configuration
FreeBSD `pkg install apache24`, excluding comments, with __mod_php__ installed
```
ServerRoot "/usr/local"
Listen 80
LoadModule authn_file_module libexec/apache24/mod_authn_file.so
LoadModule authn_core_module libexec/apache24/mod_authn_core.so
LoadModule authz_host_module libexec/apache24/mod_authz_host.so
LoadModule authz_groupfile_module libexec/apache24/mod_authz_groupfile.so
LoadModule authz_user_module libexec/apache24/mod_authz_user.so
LoadModule authz_core_module libexec/apache24/mod_authz_core.so
LoadModule access_compat_module libexec/apache24/mod_access_compat.so
LoadModule auth_basic_module libexec/apache24/mod_auth_basic.so
LoadModule ratelimit_module libexec/apache24/mod_ratelimit.so
LoadModule reqtimeout_module libexec/apache24/mod_reqtimeout.so
LoadModule filter_module libexec/apache24/mod_filter.so
LoadModule mime_module libexec/apache24/mod_mime.so
LoadModule log_config_module libexec/apache24/mod_log_config.so
LoadModule env_module libexec/apache24/mod_env.so
LoadModule headers_module libexec/apache24/mod_headers.so
LoadModule unique_id_module libexec/apache24/mod_unique_id.so
LoadModule setenvif_module libexec/apache24/mod_setenvif.so
LoadModule version_module libexec/apache24/mod_version.so
LoadModule mpm_prefork_module libexec/apache24/mod_mpm_prefork.so
LoadModule unixd_module libexec/apache24/mod_unixd.so
LoadModule status_module libexec/apache24/mod_status.so
LoadModule autoindex_module libexec/apache24/mod_autoindex.so
LoadModule dir_module libexec/apache24/mod_dir.so
LoadModule alias_module libexec/apache24/mod_alias.so
LoadModule php5_module libexec/apache24/libphp5.so
IncludeOptional etc/apache24/modules.d/[0-9][0-9][0-9]_*.conf
<IfModule unixd_module>
User www
Group www
</IfModule>
ServerAdmin you@example.com
ServerName bsd.local #insert your hostname here
<Directory />
AllowOverride none
Require all denied
</Directory>
DocumentRoot "/usr/local/www/apache24/data"
<Directory "/usr/local/www/apache24/data">
Options FollowSymLinks
AllowOverride None
Require all granted
</Directory>
<IfModule dir_module>
DirectoryIndex index.php index.html
</IfModule>
<Files ".ht*">
Require all denied
</Files>
ErrorLog "/var/log/httpd-error.log"
LogLevel warn
<IfModule log_config_module>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
<IfModule logio_module>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
</IfModule>
CustomLog "/var/log/httpd-access.log" common
</IfModule>
<IfModule alias_module>
ScriptAlias /cgi-bin/ "/usr/local/www/apache24/cgi-bin/"
</IfModule>
<Directory "/usr/local/www/apache24/cgi-bin">
AllowOverride None
Options None
Require all granted
</Directory>
<IfModule mime_module>
TypesConfig etc/apache24/mime.types
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
</IfModule>
<IfModule proxy_html_module>
Include etc/apache24/extra/proxy-html.conf
</IfModule>
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
Include etc/apache24/Includes/*.conf
<FilesMatch "\.php$">
SetHandler application/x-httpd-php
</FilesMatch>
<FilesMatch "\.phps$">
SetHandler application/x-httpd-php-source
</FilesMatch>
```
internal-wiki/cheat-sheets/services/dns.md
Executable
+108
View File
@@ -0,0 +1,108 @@
# DNS
At worst case/high paranoia, just replace your internal network with filled-in hostfiles, rather than an internal DNS server
## Linux (i.e. BIND/named)
Most DNS operations will be handled in `/etc/named.conf`,`/etc/named/*.zone` and `/etc/resolv.conf`.
### Forwarding
In `named.conf`:
```bash
zone "example.com" IN {
type forward;
forwarders { X.X.X.X; };
forward only;
};
```
* Note: `forward only` may be omitted if lookup doesn't have to use forwarders.
### Master
In zone file for `domain.com`:
```bash
@ IN SOA ns1.domain.com. admin.domain.com. (
12083 ; serial number # Don't forget to update this on change
3h ; refresh interval
30m ; retry interval
3w ; expiry period
1h ; negative TTL
)
www IN A X.X.X.X
```
In `named.conf`:
```bash
zone "domain.com" {
type master;
file "/etc/bind/zones/domain.com.zone";
};
```
### ACLs
Before `options`:
#### Allow Only
```bash
acl goodclients {
X.X.X.X
X.X.X.X/X;
localhost;
localnets;
};
```
#### Allow But
```bash
acl badclients {
!X.X.X.X;
!X.X.X.X/X;
any;
};
```
* localnets tries to guess current subnet using given IP address and subnet mask.
* Can shorten subnet (i.e. X/X, X.X/X, X.X.X/X)
* Can nest ACLs in other ACLs
* `none` and `any` are base ACLs
Then in `options`:
```bash
options {
...
allow-query { goodclients; };
...
};
```
* ACLs affect any `allow-` attributes
## Windows
Windows DNS Server (a role found in Server Manager) should be relatively self-intuitive.
### Filtering
DNS servers can restrict who they reply back to with various configurations.
```powershell
dnscmd <ServerName> /ResetListenAddresses [<ListenAddress> ...]
```
### Rate Limiting
Starting from Windows 2016, one can enable rate limiting by using
```powershell
Set-DNSServerRRL
```
One can set exception lists like this (where EQ means equal):
```powershell
Add-DnsServerResponseRateLimitingExceptionlist -Name “SafeList1” -Fqdn “EQ,*.contoso.com”
Add-DnsServerResponseRateLimitingExceptionlist -Name “SafeInterface” -ServerInterface “EQ,20.0.0.1”
```
## Links
### Linux
* [Zytrax's *DNS for Rocket Scientists*](http://www.zytrax.com/books/dns/)
* [Digital Ocean's *An Introduction to Managing DNS*](https://www.digitalocean.com/community/tutorial_series/an-introduction-to-managing-dns)
* [Digital Ocean's DNS Guides](https://www.digitalocean.com/community/tags/dns?type=tutorials)
### Windows
* [Window Server 2016 DNS](https://technet.microsoft.com/en-us/windows-server-docs/networking/dns/dns-top)
* [Windows Rate Limiting](https://technet.microsoft.com/itpro/powershell/windows/dnsserver/set-dnsserverresponseratelimiting)
* [Windows Server 2012 DNS](https://technet.microsoft.com/en-us/library/hh831667(v=ws.11).aspx)
* [Windows Server 2008 DNS](https://technet.microsoft.com/en-us/library/cc730921(v=ws.11).aspx)
internal-wiki/cheat-sheets/services/email.md
Executable
+63
View File
@@ -0,0 +1,63 @@
# Email (i.e. POP3, SMTP)
## Postfix
The default Mail Transfer Agent in [many](https://wiki.debian.org/Postfix) Linux distributions, Postfix uses Simple Mail Transfer Protocol to do its job. It replaced sendmail in popularity. It can be configured by modifying the `/etc/postfix/main.cf` file. Its status can be verified through Telnet (i.e. `telnet localhost 25`) or nmap (i.e. `nmap -sT -p 25 localhost`)
If starting on scratch and [on Ubuntu](https://help.ubuntu.com/community/Postfix#Configuration), run `sudo dpkg-reconfigure postfix` to get a quick configuration up and running.
### [Configurations](http://www.postfix.org/postconf.5.html)
Should be edited through [postconf](http://www.postfix.org/postconf.1.html), Postfix's configuration utility. 'postconf -e "<name>=<value>' edits main.cf and affects the program after next reload, which can be done as `postfix reload`.
* `mydestination`
* List of email domains to give mail to. Default $myhostname, localhost.$mydomain, localhost
* `inet_interfaces`
* Which networks to listen on. Default is all, though some highly restrict it to just localhost.
* `smtpd_client_connection_rate_limit`
* Max attempts per client per unit time. Default 0.
* `smtpd_client_message_rate_limit`
* Max delivery requests per client per unit time. Default 0.
* `smtpd_client_event_limit_exceptions`
* Exclude various networks from limits. Default is $mynetworks
### Aliases
`/etc/aliases` is the file where plaintext [email aliases](https://wiki.debian.org/Postfix#Forward_Emails) can be configured in `<username>: <email>` format. Always run `newaliases` after modifying to update the datahase and run `postfix reload` to refresh the DB with Postfix.
* Note: It doesn't send a local copy back to the server unless the username is also specified on the side with emails.
### [SASL](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Securing_Services.html#sect-Security_Guide-Securing_Postfix-Configuring_Postfix_to_Use_SASL)
SMTP Authentication can be done by the Dovecot or Cyrus SASL implementations. Dovecot configuration can be found in `/etc/dovecot/conf.d/` with settings like using Unix sockets or TCP sockets. It doesn't encrypt the emails though. That instead can be done using [TLS on Postfix](https://www.sans.org/reading-room/whitepapers/email/protecting-email-hostile-world-tls-postfix-578).
## qmail
Another MTA, most of its configuration can be found in `/var/qmail/control` and in `~<username>/.qmail-*`.
`~<username>/.qmail-*` is used to direct where mail actually goes (`./Mailbox` for mbox, `./Maildir`, `&a@b.com` for forwarding, and `<Username>` for local copy).
### Aliasing
```bash
echo \&<Username> > /var/qmail/alias/.qmail-<Alias>
```
## Dovecot
The most common IMAP and POP3 server
## Roundcube
A browser-based IMAP client.
## Mail-in-a-Box
Running in a Ubuntu 14.04 container, this handles all configuration for a hopefully cheap and fast setup of a mail server with online interface. *Untested*
## Links
### Postfix
* [Ubuntu Community Help Wiki on Postfix](https://help.ubuntu.com/community/Postfix)
* [Arch Wiki on Postfix](https://wiki.archlinux.org/index.php/Postfix)
### qmail
* [Dave Sill's *Life with qmail*](http://www.lifewithqmail.org/lwq.html)
### Dovecot
* [Dovecot 2.0 Documentation](https://wiki2.dovecot.org/)
### Roundcube
* [Roundcube Github Repo](https://github.com/roundcube/roundcubemail)
### Mail-in-a-box
* [Homepage](https://mailinabox.email/)
internal-wiki/cheat-sheets/services/mysql.md
Executable
+78
View File
@@ -0,0 +1,78 @@
# MySQL Cheat Sheet
taken from https://en.wikibooks.org/wiki/MySQL/CheatSheet
### Connect/Disconnect
```bash
mysql -h <host> -u <user> -p
```
### Backup and Restore
Hint: Backup the different databases into different files to make selective
restoring possible.
```bash
mysqldump --databases db1 db2 db3 --user=root --password > all_databases.sql
mysql -uroot -p < all_databases.sql
```
### Browsing
```sql
SHOW DATABASES;
USE mbase; #switch to the database named mbase
SHOW TABLES;
DESCRIBE tbl; #show the schema of the table
```
### Query
```sql
SELECT * FROM table
SELECT field1, field2, ... FROM table1, table2, ... WHERE condition
```
### Create / delete / select / alter database
```sql
CREATE DATABASE mabase CHARACTER SET utf8
DROP DATABASE mabase
```
### Privileges
```sql
CREATE USER 'user'@'localhost' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON base.* TO 'user'@'localhost' IDENTIFIED BY 'password';
GRANT SELECT, INSERT, DELETE ON base.* TO 'user'@'localhost' IDENTIFIED BY 'password'; # The .* is mandatory!
REVOKE ALL PRIVILEGES ON base.* FROM 'user'@'host'; -- one db permission only
REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'user'@'host'; -- all permissions
SET PASSWORD = PASSWORD('new_pass')
SET PASSWORD FOR 'user'@'host' = PASSWORD('new_pass')
SET PASSWORD = OLD_PASSWORD('new_pass')
DROP USER 'user'@'host'
```
### Reset root password
```bash
$ service mysql stop
$ mysqld_safe --skip-grant-tables &
$ mysql # on another terminal
mysql> UPDATE mysql.user SET password=PASSWORD('nouveau') WHERE user='root';
## Kill mysqld_safe from the terminal, using Control + \
$ /etc/init.d/mysql start
```
### Repair tables after unclean shutdown
```bash
mysqlcheck --all-databases
mysqlcheck --all-databases --fast
```
### Data Manipulation
```sql
INSERT INTO table1 (field1, field2, ...) VALUES (value1, value2, ...)
LOAD DATA INFILE '/tmp/mydata.txt' INTO TABLE table1
FIELDS TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"' ESCAPED BY '\\'
DELETE FROM table1 / TRUNCATE table1
DELETE FROM table1 WHERE condition
```
internal-wiki/cheat-sheets/services/rdp.md
Executable
+4
View File
@@ -0,0 +1,4 @@
# Remote Desktop Protocol
## Windows
## Linux (xrdp)
internal-wiki/cheat-sheets/shell-help.md
Executable
+114
View File
@@ -0,0 +1,114 @@
# Useful command line help
### screen - creates virtual "screens" in the command line
Screen is a useful "window manager" of sorts within the terminal. Always works
in full screen, unlike tmux (see section below). Supports multiple windows that
can be switched between. Each screen can have multiple windows, and each window
can have a program running in it independent from other windows or screens.
All commands aimed at controlling screen while in a screen must be prefixed with
a key combination. By default this combination is "Ctrl-a". Other commands not
related to screen can be run as normal. Here is a list of common screen
commands to run from inside screen:
| Key | Action |
|-----|---------------------------------------------------------|
| c | create new screen window |
| n | switch to next window |
| p | switch to prev window |
| d | detach from screen (it stays running in the background) |
Some screen commands are run from outside a screen session, for instance to
connect or list currently running screen sessions. They can also be run from
inside screen as regular commands, which can be useful to tell, for instance,
which screen you are connected to.
```bash
# List all screen sessions that can be connected to
screen -list
# Reconnect to a screen listed above. If no argument is given after -r and only
# one screen session is running, it will reconnect to that one. Otherwise, it
# lists available screens to connect to. Tab completion works to choose one!
screen -r <screen_name>
# Attempt to reconnect to an existing session, or if none exist, start a new one
screen -R
```
### tmux - pretty much like screen, but newer and supports panes
Tmux is very similar to screen, but is newer, and doesn't have to be in full
screen all the time. This is nice, because you can then see two (or more)
different terminal prompts side-by-side and interact with them all. To start
tmux, simply run `tmux`, and to reconnect to a detached session, run
`tmux attach`. When all sessions in tmux are exited from, tmux itself will exit.
Tmux runs a server that others can connect to through sockets in /tmp, so
multiple users can connect to one tmux session at once. One disadvantage of not
working in full screen is that scrolling does not work. To scroll, use a
separate command found in the table below. All commands below require a prefix,
like screen. By default tmux uses a prefix of "Ctrl-b", but you can change it
in ~/.tmux.conf
| Key | Action |
|----------------|---------------------------------------------------------|
| c | create new tmux window, shown in the tabs at the bottom |
| any number key | switches to the window with the specified number |
| any arrow key | switches to the pane in the direction of the arrow key |
| hold arrow key | resizes the current pane in the direction of the arrow |
| , | rename the tmux window |
| % | create a vertical split (new pane) |
| " | create a horizontal split (new pane) |
| n | switch to next window |
| p | switch to prev window |
| d | detach from screen (it stays running in the background) |
| [ | start scrolling, press q to exit. Line # is at the top |
### SCP - Secure Copy over SSH
Remote Host -> Local host:
`scp your_username@remotehost.edu:remotefile.txt /local/dir`
Localhost -> remotehost
`scp localfile.txt your_username@remotehost.edu:/remote/dir`
### Navigating in bash
http://ss64.com/bash/syntax-keyboard.html
### Vim
A more extensive list to print out is at
http://tnerual.eriogerg.free.fr/vimqrc.pdf
| Key | Action |
|------------------------|-----------------------------------------|
| x | delete char |
| i | insert text |
| A | append at end of line |
| dw | delete word |
| d$ | delete until eol |
| dd | delete whole line |
| rx | replace char with x |
| cM | change. delete and go to insertion. |
| R | replace mode |
| __motions__ |
| w | start of next word excluding first char |
| e | start of next word including first char |
| $ | to eol |
| 0 | start of line |
| __history & copying__ |
| u | undo |
| p | put prev deleted content |
| y | yank |
| __view__ |
| G | bottom of file |
| gg | top of file |
| nG | go to line n |
| / | search |
| n | next |
| N | previous |
| ? | search back |
| __external cmd__ |
| :!cmd | execute cmd |
internal-wiki/cheat-sheets/useful-commands.md
Executable
+6
View File
@@ -0,0 +1,6 @@
`fdisk -l` list devices
`lsmod` list kernel modules
`mount /dev/hda1 /mnt/a/` mount device hda1 to folder /mnt/a/
`nmap -p1-1000` scan first 1000 ports
`route`
`ssh -oUserKnownHostsFile=/dev/null root@host` ssh without key fingerprint checking
internal-wiki/cheat-sheets/websites.md
Executable
+9
View File
@@ -0,0 +1,9 @@
# Web Services
## Joomla
## Wordpress
### Important Plugins
## Drupal
internal-wiki/export.sh
Executable
+22
View File
@@ -0,0 +1,22 @@
#!/bin/bash
# Bash has dumb defaults, make them less dumb
set -euo pipefail
# Put the printable files in the to-print directory
# Also create subdirectories, because pandoc doesn't do that
# TODO: Clean this up, automatically mirror the directory structure in
# guides/ and cheat-sheets/ instead.
mkdir -p to-print
mkdir -p to-print/2017
mkdir -p to-print/2017/guides
mkdir -p to-print/2017/guides/hardening
mkdir -p to-print/2017/cheat-sheets
mkdir -p to-print/2017/cheat-sheets/services
mkdir -p to-print/2017/cheat-sheets/operating_systems
# Convert all markdown files in guides and cheat-sheets to PDFs for printing
for file in $(find {guides,cheat-sheets} -name '*.md'); do
outputFile="to-print/2017/${file%.*}.pdf"
pandoc "$file" -o "$outputFile" -V geometry:'top=1cm, bottom=1cm, left=1cm, right=1cm'
done
internal-wiki/guides/Firewall.md
Executable
+196
View File
@@ -0,0 +1,196 @@
# Firewall Quickstart
## Good Stuff to Know
### [IPv4 Address Ranges For Private Networks](https://tools.ietf.org/html/rfc5735)
Block the following ranges on public interfaces:
* 10.0.0.0/8 (A)
* 172.16.0.0/12 (B)
* 192.168.0.0/16 (C)
* 224.0.0.0/4 ("D"/Multicast)
* 240.0.0.0/5 ("E")
* 127.0.0.0/8 (Loopback)
## [Linux - nftables](https://wiki.nftables.org/wiki-nftables/index.php/Main_Page)
nftables is supposed to replace the other *tables programs. Its syntax seems easier to deal with.
Matches: See man page. Basically descriptions that can apply to packets.
Statements
* Log (level {emerg, alert, ... })
* Reject
* Limit
* Nat
* Drop
* Accept
> List Current Tables
```bash
nft list tables {ip, arp, ip6, bride, inet, netdev}
```
> List Current Chains
```bash
nft list chain (table)
```
> List Current Rules
```bash
nft list chain {table} {chain}
```
> Rule Creation
```bash
nft add rule {ip, arp, ...} {table} {chain} {match} {statement}
```
## [Linux - iptables](http://linux.die.net/man/8/iptables)
iptables is a user-space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall (implemented as different Netfilter modules) and the chains and rules it stores. Different kernel modules and programs are currently used for different protocols; iptables applies to IPv4, ip6tables to IPv6, arptables to ARP, and ebtables to Ethernet frames.
### [CentOS Instructions](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html#sec-Using_iptables)
CentOS (or RHEL) uses [firewalld](https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7) by default, so follow these commands to switch to iptables.
```bash
systemctl disable firewalld
systemctl stop firewalld
yum install iptables-services
systemctl start iptables
systemctl enable iptables
service iptables save
```
### Definitions
* __Chains:__ Lists of rules applicable to packets, ordered.
* __Targets:__ What to do when a rule is matched. It is specified by `-j` or `--jump`. Targets include user-defined chains, special "extensions" such as auditing or editing, __ACCEPT__ to let packet through, __DROP__, and __RETURN__ to break chain progression.
* __Tables:__ Contains packet filter rules. There are always at least five present. __filter__ contains chains for packets going to local sockets (__INPUT__), routed to others (__FORWARD__), or locally-generated (__OUTPUT__). __nat__ deals with new connections for __PREROUTING__, __OUTPUT__, and __POSTROUTING__. There is also __mangle__ for packet alteration, __security__ for Mandatory Access Control, and __raw__ for special usage.
### Important Commands
__Note:__ Commands missing -t arguments use the __filter__ table by default. Similarly, not specifying the chain will try to apply the command onto all chains in the default table.
```bash
iptables -L --line-numbers
```
> List rules from all chains, marked with rules' positions on chain
```bash
iptables -F
```
> Deletes rules from all chains in table
```bash
iptables -N *chain*
```
> Creates new chain *chain*
```bash
iptables -X
```
> Deletes user-defined chain only if chain has no rules.
```bash
iptables -P *chain* *target*
```
> Sets policy for chain *chain* to target *target*.
### Examples
Delete 4th rule form chain INPUT?
```bash
iptables -D INPUT 4
```
or
```bash
iptables -D INPUT -s 202.54.1.1 -j DROP
```
Block 202.54.1.1?
```bash
iptables -A INPUT -s 202.54.1.1 -j DROP
```
[Logging](http://ipset.netfilter.org/iptables-extensions.man.html)?
```bash
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j LOG --log-prefix "IP_SPOOF A: "
```
[Restrict number of active connections to 5](http://ipset.netfilter.org/iptables-extensions.man.html)?
```bash
iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 5 -j REJECT
```
### Loading Rules
1. List firewall rules
```bash
iptables-save | tee iptables.rules
```
2. Edit the file you created in the last step to lock it down, or start from
scratch. Here is an example file:
```
# Drop incoming packets by default
*filter
:INPUT DROP
:FORWARD DROP
:OUTPUT ACCEPT
# Allow established connections
# If conntrack is supported use this:
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Otherwise use
# -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow pings to this box
-A INPUT -p icmp -j ACCEPT
# Allow traffic on loopback
-A INPUT -i lo -j ACCEPT
# For each port you want to open (i.e. ssh)
-A INPUT -p tcp --dport 22 -j ACCEPT
# Save rules
COMMIT
```
3. Load the firewall rules you just created
```bash
iptables-restore < iptables.rules
```
## [Solaris - ipf](https://docs.oracle.com/cd/E23824_01/html/821-1453/euqex.html)
1. List active rules
```bash
ipfstat -io
```
2. Create a file to store firewall rules, here is an example:
```
# Allow all traffic on loopback.
pass in quick on lo0 all
pass out quick on lo0 all
# Allow all out, including incoming packets from established connections
pass out quick keep state
# Allow pings in
pass in quick proto icmp keep state
# Allow certain ports (i.e. ssh)
pass in quick proto tcp from any to any port = 22 keep state
# Drop incoming packets by default
block in all
```
3. Load rules
```bash
# Make sure ipfilter is enabled
svcadm enable network/ipfilter
# Load rules
ipf -Fa -f ipf.rules
```
internal-wiki/guides/backup.md
Executable
+68
View File
@@ -0,0 +1,68 @@
# Backup Guide
## Recommendations
`git` is your friend. Know how to use it. Use it. In addition to putting every
directory into git (or at least `/etc` and `/var`, since those typically contain
important information), make a copy into `/root/backup` (or something less
obvious) in case the red team tampers with the `.git` folder too.
## Specific Services
**Make sure to include the dump files in git and make multiple copies of them!**
### Webserver
Usually under `/var/www`, but check webserver configuration to see exactly
where the web roots are. There is a webroot finding script at
[webroot][webroot], just copy the files from the directory it gives to some
backup location. Make sure to backup web applcation databases too! (see sections
below)
[webroot]: https://github.com/berke1337/public_ccdc/blob/master/rootfind.sh
### MySQL
* To dump: `mysqldump -u [username] -p [dbname] > dump.sql`. Use `-h host` and
`-P port` if remote, and use `--all-databases` if all databases should be
backed up, or `--databases` followed by a list of databases if multiple
different databases should be included.
* To restore: `mysql -u [username] -p [dbname] < dump.sql`, with
`-h host` and `-P port` if remote. `[dbname]` is optional, and shouldn't be
included if restoring multiple databases (dumped with `--all-databases`).
### PostgreSQL
#### Single database
* To dump: `pg_dump [dbname] > dump.sql`. Use `-h host` and `-p port` if remote.
* To restore: `psql [dbname] < dump.sql`. Make sure the database `dbname` is
created before running this, e.g. with `createdb -T template0 [dbname]`
#### All databases
* To dump: `pg_dumpall > dump.sql`. Use `-h host` and `-p port` if remote.
* To restore: `psql -f dump.sql postgres`, where `postgres` is the default
cluster name.
### MongoDB
#### mongodump
Using `mongodump` is probably your best bet, it will dump data in a `BSON`
format that `mongorestore` can use to restore from. This can be done while
`mongod` is running. It will not include index data, but that's probably fine,
as nobody cares about performance in the competition as long as things sorta
work. `mongodump` can be given `--host <hostname><:port>` to dump from if the
MongoDB is remote, and `--ssl` to connect with if TLS/SSL is used. To
authenticate, give `--username <username>` and it should prompt for a password.
By default, it dumps into a `dump` directory in the current working directory,
give `--out <path>` if you want a different location, or `--out -` for stdout.
`mongorestore` takes pretty much the same arguments.
#### Just using cp
Stopping `mongod` and then just copying its files is fine too.
`/etc/mongodb.conf` should have a line `dbpath` that says where the data is
stored so that it can be copied.
internal-wiki/guides/central-logging.md
Executable
+47
View File
@@ -0,0 +1,47 @@
# Centralized Logging
TODO: Nicer UI; one that actually may be useful for incident reports (i.e. ELK?)
For CCDC, Centralized Logging generally means setting up syslog environment with a Linux machine in the center,
though it should be one that is user friendly.
## Data Collectors and Forwarders
### Linux
#### rsyslog server
Install `rsyslog`, and then on the server side, add these lines to
`/etc/rsyslog.conf` to enable listening on UDP and TCP (both port 514 for
convenience):
# Listen on UDP
module(load="imudp")
input(type="imudp" port="514")
# Listen on TCP
module(load="imtcp")
input(type="imtcp" port="514")
# Put remove logs into their own directory based on hostname
$template RemoteLog, "/var/log/remote/%HOSTNAME%.log"
:inputname, isequal, "imtcp" ?RemoteLog
:inputname, isequal, "imudp" ?RemoteLog
### rsyslog Client
Install the `rsyslog` package, and then add this line to the rsyslog config
(probably located at `/etc/rsyslog.conf`. Make sure you know the IP of the
syslog server set up in the previous part:
*.* @@<ip or domain name of syslog server>:514
Also make sure the hostname of the client is set to something reasonable, not
`localhost` or something weird, since that is what the server will use to put
the logs in the right place.
## Windows
| Product | Notes |
| ------- | ----- |
| [Event Log Forwarder](http://www.solarwinds.com/free-tools/event-log-forwarder-for-windows) | Used in 2017; no dependencies |
| [OSSEC](https://ossec.github.io/index.html) | Untested; Windows can only send |
| [Logstash](https://www.elastic.co/products/logstash) | Untested |
| [Splunk](https://www.splunk.com/) | Installation Issues; try again later |
| [rsyslog Windows Agent](http://www.rsyslog.com/windows-agent/about-rsyslog-windows-agent/) | Used in 2017; depends on .NET 3.5 |
internal-wiki/guides/fail2ban.md
Executable
+15
View File
@@ -0,0 +1,15 @@
# Fail2ban
Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show
malicious signs -- too many password failures, seeking for exploits, etc.
Generally Fail2Ban is then used to update firewall rules to reject the IP
addresses for a specified amount of time, although any arbitrary other action
(e.g. sending an email) could also be configured. Out of the box Fail2Ban comes
with filters for various services (apache, courier, ssh, etc).
In the competition, fail2ban helps reducing the noise produced by red team
activity, especially automated scanning.
The red team probably will not heavily rely on online password bruteforcing but
we have seen automated vulnerability scans on web applications in the past.
fail2ban relies on __python__.
internal-wiki/guides/git-remote.md
Executable
+17
View File
@@ -0,0 +1,17 @@
# Setup a git Server
This guide has been tested on Debian. On CentOS I have had some problems I couldn't resolve...
### On the Server:
* `sudo useradd -m -d /var/git -s /bin/bash -c 'Git' git`
* `sudo su - git`
* `mkdir .ssh`
* `vim .ssh/authorized_keys`
* `chmod 700 .ssh`
* `git --bare init test.git`
* `logout`
* `sudo chsh -s /usr/bin/git-shell git`
### On the Client:
* `git remote add origin git@server.com:test.git`
* if not done already, `git add bla.txt`, `git commit`
* `git push origin master`
internal-wiki/guides/git-version-control.md
Executable
+35
View File
@@ -0,0 +1,35 @@
# Version Control with git
Hosting configuration files in git helps not only to smoothly roll-back
configuration changes (possibly malicious ones), but also provides a backup in
case of data loss.
### Create a central repository (with creating a user)
```bash
adduser git
mkdir /backups
chown git:git /backups
su git
git init --bare /backups
```
### Put a directory under version control
```bash
# Can be done right away
cd /
git init
git checkout -b $HOSTNAME
git add $DIRS
git commit -m 'Initial import of $HOSTNAME'
# After central repo has been set up
git remote add origin ssh://git@$GITHOST/backups
git fetch origin
git push origin HEAD
```
When you change files in a version controlled directory, make sure to commit
_and_ push the changes. Also make sure to periodically fetch from origin so that
the backups are distributed across our network.
internal-wiki/guides/grsecurity.md
Executable
+20
View File
@@ -0,0 +1,20 @@
# grsecurity
## Introduction
grsecurity is a set of patches for the vanilla Linux kernel which emphasizes security enhancements. They protect the kernel against certain exploits and also provide some additional functionalities, e.g. better access control, better chroots, and various other stuff.
A major component bundled with grsecurity is PaX, which is a patch that, amongst other things, flags data memory, such as that on the stack, as non-executable, and program memory as non-writable. The aim is to prevent executable memory pages from being overwritten with injected machine code, which prevents exploitation of many types of security vulnerabilities, such as buffer overflows. PaX also provides address space layout randomization (ASLR), which randomizes important memory addresses to hinder attacks that rely on such addresses being easily known. PaX is not itself developed by the grsecurity developers, and is also available independently from grsecurity.
## Use in the Competition
A grsecurity-hardened kernel is nice to have because it mitigates some kernel vulnerabilities that can possibly be used for privilege escalation and it also makes other applications harder to exploit. Usually this is good enough to prevent exploitation through the standard metasploit modules. We will not be able to make use of all the additional features grsecurity provides because it would need too much time to configure.
## Installation
grsecurity is a set of patches for the vanilla Linux kernel. Hence the usual installation process would be to get the linux sources, apply the patches and compile. This is of course not reasonable to do in the competition. However there are some packages available for some distributions.
### Debian
There are official Debian packages for the grsecurity kernel patches available: linux-patch-grsecurity2
Note that these are not configurable as to security/performance and overhead, as it's usually done with manually building grsec/PaX support for the Linux kernel.
Add the unstable repositories to your apt sources.list and install via:
`apt-get install -t unstable linux-grsec`
internal-wiki/guides/hardening/Linux-hardening.md
Executable
+133
View File
@@ -0,0 +1,133 @@
# Linux Hardening
## General Hardening
Do this first for every \*nix machine!
1. Briefly check for physical tempering (tape under the mouse, raspberry pi under the table, Keyloggers, ... )
1. Change your user password and the root password.
1. Watch out for suspicious aliases
* List all set aliases with `alias`.
1. Look at history for different users: `history` or `~/.bash_history`
1. __Inventory__
* `hostname`
* `cat /proc/version` (might say RedHat instead of CentOS)
* or `uname -a`
* `lsb_release -a` (not available everywhere)
1. __Firewall off__ the system except for ports that are in use
* Get a list of ports you need to keep open
* `netstat -plunt` for listening ports
* `netstat -punt` for open connections. It does not show UDP connections. Can not reliably detect short-lived connections as well.
* At this stage, you might want to leave some ports open when you are not sure about whether they are being used. Come back later and close them when you know more.
* Use firewallmy.system, e.g.
`curl http://firewallmy.systems/iptables/t22/t80/u5000/ | /bin/bash`
* __Warning__: Rules are only appended. So check all rules with `iptables -L --line-numbers` after running this. Delete rules, e.g. `iptables -D INPUT 4` to delete the 4th input rule.
1. __System Exploration__
* look at `getent passwd`, `getent group`, `getent shadow`, `/etc/sudoers`
* __change all user account passwords__: `bash <(curl -sL https://t0b.pw/chpasswd.sh)`
* `ps auxww | less`, if output is not too noisy
* `netstat -punt`
* Check for installed SSH keys: `bash <(curl -sL https://t0b.pw/ssh-key-list.sh)`
* Check DNS resolver `less /etc/resolv.conf`
* if running webserver, find webroots: `bash <(curl -sL https://goo.gl/aKdZTI)`
* (Optional) check package sources `/etc/apt/sources.list` or `/etc/yum.repos.d/*` and the sub-directories. For other package managers see OS-overview.md.
1. __Change passwords__ for __all__ services. This includes all mysql users, all web applications, etc.
* Do this carefully. Do not overlook any service.
* For WebApps it is a good idea to first just __disable__ admin accounts, as changing their passwords would take too much time. Do that by prepending `000_` to the password hash.
* By now you should have a detailed overview of which services are running on the machine. Pay particular attention to which services might be dangerous, which services might get scored and which services might be critical for other services to function properly.
* Uninstall/kill any unnecessary services.
1. Setup __basic auditing__
* Create a list of processes so that we can diff it later.
* `mkdir /root/normal/ && cd /root/normal/ && git init`
* `ps auxww > ps.txt`
* `netstat -plunt > netstat-plunt.txt`
* `netstat -punt > netstat-punt.txt`
* `git add * && git commit`
* put the following directories in version control:
* `cd /etc/`, `git init`, `git add *`, `git commit`
* /etc/
* /home/
* /var/www or other web application folders
1. __>>>BACKUP DATA<<<__
* see backup guide
1. check __setuid/setgid__ files and make list of valid ones. `find / -user root -perm /6000 -exec ls -ldb {} \; 2>/dev/null`
1. __restrict crontab__
* remove crontab completely if not needed: `service crontab stop`, might also be called `cron` or `crond`
* Otherwise disable crontab for users other than root:
* `rm /etc/cron.deny /etc/at.deny`
* `echo "root" > /etc/cron.allow`
* `chmod 600 /etc/cron.allow`
* `echo "root" > /etc/at.allow`
* `chmod 600 /etc/at.allow`
1. __Harden__
* __On older systems:__ Enable Data Execution Prevention (DEP) and ASLR. If the files do not exist, DEP and ASLR are probably already activated by default. Not needed for FreeBSD.
* `echo 1 > /proc/sys/kernel/exec-shield`,
* `echo 2 > /proc/sys/kernel/randomize_va_space`
* `/etc/sysctl.conf`: `kernel.exec-shield = 1` and `kernel.randomize_va_space = 2`.
* Disable IPv6
* `sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1`
* `sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1`
* `/etc/sysconfig/network`: `NETWORKING_IPV6=no`, `IPV6INIT=no`
1. Run __lynis__. Good way to be assured we did not overlook something important.
* `git clone https://github.com/CISOfy/lynis`
* `./lynis/lynis audit system`, note down relevant system information
* option `--reverse-colors` helpful for bright terminals
1. __Update__ internet-facing software. Including website software like Roundcube, Joomla, Wordpress, zen-cart, etc. These web-apps are known to have lots of RCEs.
1. Check if __system package upgrades__ are available: `apt-get upgrade --dry-run`, `yum check-update`
__Now is a good time to switch to a different machine. Continue here later__
## Second priority
1. Double-check that all default credentials have been changed.
* Think of Users in WebApps, E-Mail users managed through a database, any VMs that might be running, etc.
1. __Privilege separation__
* Check under which privileges exposed services are running.
* Check file permissions of sensitive data. And permissions of scripts, including web software (e.g. `/var/www/`).
1. (Optional) configure __auditd__. Therefore see cheat-sheets/auditd.md
1. Make logs append-only: `chattr +a /var/log/foo`
1. Harden host-specific applications
* PHP (very important)
* Web Applications
* If they are older than a few month there is usually a remote code execution exploit available. Update web applications if possible. If not possible, consider mod_security.
* Webserver
* Databases
* etc.
1. Harden SSH
```
vi /etc/ssh/sshd_config
Protocol 2
AllowUsers root admin webmaster
AllowGroup sshusers
PasswordAuthentication no
HostbasedAuthentication no
RSAAuthentication yes
PubkeyAuthentication yes
PermitEmptyPasswords no
PermitRootLogin no
ServerKeyBits 2048
IgnoreRhosts yes
RhostsAuthentication no
RhostsRSAAuthentication no
```
## Things to consider when enough time
1. Get a safe toolchain
* Download busybox: http://packetstormsecurity.com/files/125705/Busybox-Statically-Compiled-With-Ash.html
* Mirror under https://github.com/berke1337/public_ccdc
* Short link: __ http://bit.do/busyboxtar __
* `tar xf busyboxtar && cd busybox && chmod u+x busybox64`
* see available commands `./busybox64 | less`
* Get Almquist shell: `PATH='' ./busybox64 ash`
1. Secure mount options
```
in /etc/fstab
set "nosuid,noexec,nodev" for
/tmp
/var/tmp
/var/log
/var/log/audit
/var/www
set "nosuid" for
/var
```
1. check PAM configuration (very system dependent). Good place to start is `/etc/pam.d/common-auth`.
internal-wiki/guides/hardening/New-windows-hardening.md
Executable
+111
View File
@@ -0,0 +1,111 @@
**Secure AD domain controllers and DNS servers first**
### Acronyms and Common Items
* ADUC: [Active Directory Users and Computers](https://technet.microsoft.com/en-us/library/cc754217(v=ws.11).aspx)
* Domain Controller only. Either in Server Manager options, or clip-on using MMC.
* GPM: [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc753298(v=ws.11).aspx)
* Usually Domain Controller. Run `gpmc.msc`, or find under Admin. Tools
* LSP: [Local Security Policy](https://technet.microsoft.com/en-us/library/dn135243(v=ws.10).aspx)
* Non-Domain only. Run `secpol.msc`, or find under Admin. Tools
* MMC: [Microsoft Management Console](https://technet.microsoft.com/en-us/library/cc709659(v=ws.11).aspx)
* Run `mmc.msc`
* SysInternals: Referring the the Suite of Tools, it ranges from more detailed looks at processes to networking information to logging
### Physical Tampering
* Check all ports for malicious tampering (USBs, dongles)
* If given choice, use wired keyboard?
* Check surroundings for wireless devices
### User accounts
* Change Administrator password
* i.e. CTRL-ALT-DELETE
* Failures may result from bad configuration in LSP or GPM.
* Change other passwords
* Must do in either MMC's Local Users and Groups or ADUC
* If competition requires notification, do so first to make sure passwords are not the reason for downtime
* Try `%SystemRoot%\system32\control userpasswords2`?
* Check User Privileges and Groups
* Add users to Protected Users (against Mimikatz)
* Disable all unnecessary/unrequired user accounts
* `net user <username> /active:no` or AD Users and Groups interface
* Remove admin privileges wherever possible
* `net localgroup administrators <username> /delete` or ADUC
* Later want to check other groups, some of which have limited admin priv
* E.g., Cryptographic Operators, Network Configuration Operators, Power Users
* If possible, in LSP or GPM:
* Rename administrator
* Disable Guest
* **Set Important Policies**
### Patching
* ms08_067 https://support.microsoft.com/en-us/kb/958644
* ms09_050 http://support.microsoft.com/kb/975518
* KB2871997 https://support.microsoft.com/en-us/kb/2871997
* Explore BatchPatch, WSUS Offline Update, WSUS Later
### Firewall and Program/Services
* Verify Firewall is Running
* Do so in GPM or in Control Panel
* Verify exceptions are only for necessary services and minimum ports
* For Necessary Services (i.e. SQL Server, Web Apps, IIS/Apache/nginx):
* Remove unnecessary accounts
* Change default passwords
* For Unnecessary Services (e.g. VNC, RDP, telnet, fileshares, *FTP, etc.):
* Suspend using Process Explorer (SysInternals) before deletion
* Control Panel's Programs and Features (incl. Windows Features)
* Admin. Tools has Services, Server Manager (for roles)
* [Revo Uninstaller?](http://www.revouninstaller.com/revo_uninstaller_free_download.html)
* [CCleaner?](https://www.piriform.com/ccleaner/download)
* Verify Port Usage
* Use [nmap](https://nmap.org/download.html)
* `netstat -abno`
* TCPview (SysInternals)
### Re-verify Program Details
* Task Manager (CTRL-ALT-DEL) or Process Explorer (SysInternals)
* [System Configuration](https://support.microsoft.com/en-us/help/950093/how-to-use-the-system-configuration-utility-to-troubleshoot-configuration-errors-in-windows-vista) (`msconfig`) or 'Master Control Panel' (`explorer.exe shell:::{ED7BA470-8E54-465E-825C-99712043E01C}`)
* [File Ownership](https://www.saotn.org/powershell-find-files-owned-user/)?
* Make sure all Program Files* Directories are checked
### Malware and Viruses
* Microsoft Defender works fine for Windows 8+
* Windows MSE for Windows 7+
* Malwarebytes for others or for overkill
* [Microsoft Security Scanner](https://www.microsoft.com/security/scanner/en-us/default.aspx) (overkill)
### Other Things
* [EMET](https://support.microsoft.com/en-us/kb/2458544), but has a .NET v4 requirement
* [OSSEC](http://ossec.github.io/), though Windows only act as clients
* Syslog/Centralized Logging: See Centralized Logging Guide
* [Nessus](https://www.tenable.com/products/nessus-home) if there is much spare time
* Microsoft Baseline Security Analyzer, Microsoft Security Assessment Tool, Microsoft Security Compliance Manager
* [CIS-CAT](https://learn.cisecurity.org/cis-cat-landing-page) for Windows 10
* Wireshark, Snort, Bro?
* Edit Registry
* In `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\WDigest`, set `UseLogonCrednetial` to 0.
### Active Directory
* GPO, file system encryption, DNS, remote access, Exchange, SharePoint, etc…
* Forest > Trees > Domains
* Domains can be grouped into organizational units (OUs), but placing objects in OUs doesn’t necessarily assign the OUs right to the object
* Document what you have
* Be aware of admin users/groups in forests and trees, not just domains
* Distribution of admin accounts
* Multiple admin accounts that perform diff tasks is ideal
* Realistically, each admin user has a diff account
* Reset DSRM password
* IPsec?
* Under GPO:
* Audit logons (esp failed), policy changes, account management, and object access
* Disable LM hash storage, NTLM v2 and refuse LM and NTLM
* Windows Server Backup
### Links:
* [O'Reilly Books](http://proquest.safaribooksonline.com/); must be in Berkeley IP zone
* [Windows 2008 Checklist](https://utsacloud-public.sharepoint.com/Pages/Security/PDF/Server_Hardening_Checklist_Win_2008R2.pdf) from UT Austin
* [Windows 2012 Checklist](https://wikis.utexas.edu/display/ISO/Windows+Server+2012+R2+Hardening+Checklist) from UT Austin
* https://technet.microsoft.com/en-us/library/cc526440.aspx
* https://technet.microsoft.com/en-us/magazine/2006.05.smarttips
* https://technet.microsoft.com/library/Bb727032
* https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/plan/security-best-practices/reducing-the-active-directory-attack-surface
internal-wiki/guides/hardening/Old-windows-hardening.md
Executable
+42
View File
@@ -0,0 +1,42 @@
# Windows Hardening
1. Check for physical tampering
* Look for keyloggers on mouse/keyboard cabling
* Look for sources of interference (tape under mouse, poor ethernet cables)
2. Change passwords
3. Get a safe toolchain
* Download Sys Interals Suite
(http://download.sysinternals.com/files/SysinternalsSuite.zip)
* Download with PowerShell if browser unavailable (hacksheet)
* Scan running processes with Process Explorer
* Show signatures and image paths (hacksheet)
* Check autoruns with Autoruns tool
* Verify code signatures and hide Microsoft entries (hacksheet)
* Run a virus scan (Malwarebytes Anti-Malware:
http://downloads.malwarebytes.org/mbam-download.php)
4. Harden network
* Windows Server: activate Windows Firewall in block mode and only allow
ports of required services (LDAP, DNS, Web) (hacksheet)
* Windows XP: Stop known vulnerable services (Server service is necessary,
don't stop it) (also see Seconfig XP at
http://seconfig.sytes.net/getfile.php) (hacksheet)
* Patch ms08_067 and ms09_050 immediately
* Patch for ms08_067_netapi:
http://www.microsoft.com/en-us/download/details.aspx?id=3205
* Patch for ms09_050: http://support.microsoft.com/kb/975517
* Check for suspicious connections using TCPView or the command line
(hacksheet)
* http://live.sysinternals.com/tools/Tcpview.exe if not already downloaded
* Look first at LISTENING connections and associated processes
* Then sort by “Remote Address” and look for suspicious connections
* Nmap scan from a unix host to verify firewall status externally
5. Look for other users on the machine
* PsLoggedonUsers
* Task Manager to disconnect (hacksheet)
6. Lock down
* Inspect local user accounts on system (hacksheet)
* Determine if joined to a domain
* Disable ipv6 (hacksheet)
* Install OSSEC
* Install [EMET](http://support.microsoft.com/kb/2458544):
http://technet.microsoft.com/en-us/security/jj653751
internal-wiki/guides/hardening/apache-hardening.md
Executable
+99
View File
@@ -0,0 +1,99 @@
# Apache Hardening
* Check global config in `/etc/apache*/httpd.conf or /usr/local/etc/apache*/httpd.conf`
* Disable SSI (Server Side Includes), if the web apps are not _super_ legacy and might need it:
* Look for the following lines and disable them:
```
#AddOutputFilter INCLUDES .shtml
#XBitHack on
#Options +Includes
```
* The option `Includes` should be disabled everywhere
* Check installed modules: the statically compiled with `httpd -l` and for
dynamically loaded: `apachectl -M`. The minimal install has only `core.c`,
`mod_so.c`, and `http_core.c` statically compiled. If there are more,
check them!
* Check all sub-config files that are include in the httpd.conf
* Make sure the following is set in httpd.conf:
```
<Directory />
AllowOverride None
Require all denied
Options None
Order deny,allow
Deny from all
</Directory>
## allow access to specific dirs (check dirs!)
<Directory "/usr/local/www/apache24/data">
Require all granted
</Directory>
## should be default
<Files ".ht*">
Require all denied
</Files>
```
* `Options` should never contain `Indexes` (this would enable directory listing)
* `ServerTokens Prod` - dont give away version number in header
* `Header set Server "Microsoft-IIS/5.0"` - make the red team laugh
## mod_security
More info on mod_security can be found here: https://www.feistyduck.com/library/apache-security/online/apachesc-CHP-12.html
* Check if it is loaded: `apachectl -M | grep --color security`.
* Otherwise install: `apt-get install libapache2-mod-security` /
`yum install mod_security` / `pkg install www/mod_security`
* Now install the rule sets:
```
cd $APACHE_CONFIG_DIR
mkdir modsecurity
cd modsecurity
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs crs
fetch https://raw.github.com/SpiderLabs/ModSecurity/master/unicode.mapping
cp crs/modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
```
* Edit the modsecurity config file:
```
<IfModule security2_module>
# Include ModSecurity configuration
Include modsecurity/modsecurity.conf
# Include OWASP Core Rule Set (CRS) configuration and base rules
Include modsecurity/modsecurity_crs_10_setup.conf
Include modsecurity/crs/base_rules/*.conf
SecDebugLog "/var/log/modsec_audit.log"
SecDebugLogLevel 5
SecRuleEngine DetectionOnly
SecRequestBodyAccess On
SecResponseBodyAccess On
SecRequestBodyLimit 13107200 ## this is 12.5MB
SecServerSignature "Microsoft-IIS/5.0" #make the red team laugh
# Add custom configuration and CRS exceptions here. Example:
# SecRuleRemoveById 960015
SecAuditLogParts ABCFHZ
</IfModule>
```
* Let the webapps run for a while to catch false positives in `/var/log/modsec_audit.log`. Resolve them.
* When everything looks good, switch `SecRuleEngine On`
### modsec.conf
```
[Definition]
failregex = \[.*?\]\s[\w-]*\s<HOST>\s
ignoreregex =
```
## Paranoid considerations
* Compile Apache statically to prevent dynamic loading of malicious modules.
* Isolate all web applications. For each one, install a separate apache in a
chroot and setup nginx as a reverse proxy to redirect to the right apache
instances.

Some files were not shown because too many files have changed in this diff Show More