Firewall: iptables

filter

-N INPUT-tcp-22
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 67,123,1194 -j ACCEPT
-A INPUT -p tcp --dport 22 -m state --state NEW -j INPUT-tcp-22
-A INPUT -p tcp --dport 53 -m set --match-set named src -j ACCEPT //применяется ipset
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT-tcp-22 -s 172.16.0.0/12,192.168.0.0/16 -m limit --limit 2/hour --limit-burst 2 -j ACCEPT
-A INPUT-tcp-22 -j RETURN

-N DMZ
-N all-in-0.0/22
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 172.16.0.5,172.16.0.53,172.16.0.55 -j DMZ
-A FORWARD -s 172.16.0.0/22 -d 172.16.0.0/22 -j all-in-0.0/22
-A FORWARD -i eth0.2 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A DMZ -d 172.16.0.5 -p udp -m multiport --dports 1194,1195 -j ACCEPT
-A DMZ -d 172.16.0.55 -p tcp -m multiport --dports 80,443 -m state --state NEW -m limit --limit 30/sec --limit-burst 30 -j ACCEPT
-A DMZ -d 172.16.0.53 -p udp --dport 10000 -j ACCEPT
-A all-in-0.0/22 -d 172.16.0.60 -p tcp --dport 7667 -j ACCEPT
-A all-in-0.0/22 -d 172.16.0.51,172.16.0.135 -p tcp --dport 445 -m state --state NEW -j ACCEPT
-A all-in-0.0/22 -d 172.16.0.45 -p tcp -m multiport --dports 9702,49152:65535 -m state --state NEW -j ACCEPT
-A all-in-0.0/22 -o eth0.8 -p udp --dport 13000 -j ACCEPT
-A fbd-GS -m mac --mac-source 70:85:c2:a6:38:61 -s 172.16.2.42 -j ACCEPT
-A innet -d 10.0.0.0/8 -j REJECT --reject-with icmp-host-prohibited

nat

-A PREROUTING -s 172.16.1.101 -d 172.16.0.1 -p udp --dport 53 -j DNAT --to-destination 77.88.8.7
-A PREROUTING -s 172.16.0.16/28,172.16.0.82 -d 195.82.146.120/30 -p tcp --dport 80 -j DNAT --to-destination 163.172.167.207:3128
-A PREROUTING -d 91.206.148.15,172.16.0.55 -p udp -m multiport --dports 1194,1195 -j DNAT --to-destination 172.16.0.5

-A POSTROUTING -s 172.16.0.66,172.16.0.78,172.16.0.82 -d 172.16.1.0/24 -p tcp --dport 5900 -j SNAT --to-source 172.16.0.17
-A POSTROUTING -s 172.16.2.0/24 -d 172.16.0.20 -j SNAT --to-source 172.16.0.17
-A POSTROUTING -d 192.168.100.0/24 -j SNAT --to-source 192.168.100.1
-A POSTROUTING -d 172.16.0.133 -p tcp --dport 9702 -j SNAT --to-source 172.16.0.129

mangle

-N ovpn_mark_pre
-N ovpn_mark_post
-A PREROUTING -s 192.168.11.192/27 -p tcp -m state --state NEW -m connmark --mark 0 -j ovpn_mark_pre
-A POSTROUTING -d 192.168.11.192/27 -p tcp -j ovpn_mark_post
-A ovpn_mark_post -j CONNMARK --restore-mark
-A ovpn_mark_post -m mark --mark 1 -j CLASSIFY --set-class 1:11 //применяется tc
-A ovpn_mark_post -m mark --mark 2 -j CLASSIFY --set-class 1:12
-A ovpn_mark_post -j RETURN
-A ovpn_mark_pre -s 192.168.11.195 -j CONNMARK --set-mark 1
-A ovpn_mark_pre -s 192.168.11.206/31 -j CONNMARK --set-mark 2
-A ovpn_mark_pre -j RETURN

ipset

ipset {-X,destroy} [setname] //удалить группы

ipset del setname [entry] //удалить записи группы

ipset {-N,create} setname hash:ip //новая группа адресов

ipset {-e,rename} [setname-old] [setname-new] //новая группа адресов

ipset {-L,list} //отобразить список

ipset {-A,add} setname 192.168.11.164 //добавить адрес в группу

ipset {-S,save} > /etc/sysconfig/ipset //сохранить правила

ipset {-R,restore} < /etc/sysconfig/ipset //загрузить правила