From 83fcf869002ea711a30674a5631555b5a330f60b Mon Sep 17 00:00:00 2001 From: staticsafe Date: Wed, 21 Aug 2019 23:20:29 -0400 Subject: [PATCH] POSTROUTING should be in nat chain --- .../files/demonreach.asininetech.net.rules.v4 | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ubuntu/roles/firewall-ruleset-deploy/files/demonreach.asininetech.net.rules.v4 b/ubuntu/roles/firewall-ruleset-deploy/files/demonreach.asininetech.net.rules.v4 index 6b50eff..2d18aea 100644 --- a/ubuntu/roles/firewall-ruleset-deploy/files/demonreach.asininetech.net.rules.v4 +++ b/ubuntu/roles/firewall-ruleset-deploy/files/demonreach.asininetech.net.rules.v4 @@ -2,7 +2,6 @@ :INPUT DROP :FORWARD ACCEPT :OUTPUT ACCEPT -:POSTROUTING ACCEPT -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p icmp --icmp-type ping -j ACCEPT @@ -12,5 +11,10 @@ -A INPUT -p tcp -m multiport --dports 5269,5222 -j ACCEPT -A INPUT -p udp --dport 1194 -j ACCEPT -A INPUT -p udp --dport 53 -s 10.8.0.1/24 -j ACCEPT +*nat +:PREROUTING ACCEPT [226186:10260607] +:INPUT ACCEPT [226019:10250847] +:OUTPUT ACCEPT [14254:1056679] +:POSTROUTING ACCEPT [14254:1056679] -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE COMMIT