daily autocommit

diff --git a/iptables/rules.v4 b/iptables/rules.v4
index 870cd64fe14618bfa35d1192ce2dbd27bef4d318..21f29514c8222ad20894e53860ba0e26ceb582e1 100644 (file)
--- a/iptables/rules.v4
+++ b/iptables/rules.v4
@@ -1,47 +1,13 @@
-# Generated by iptables-save v1.6.1 on Mon Sep 10 09:36:11 2018
-*nat
-:PREROUTING ACCEPT [738:307739]
-:INPUT ACCEPT [647:302131]
-:OUTPUT ACCEPT [2377:231463]
-:POSTROUTING ACCEPT [2390:230591]
--A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
--A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
--A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
--A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
--A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
--A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
--A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
--A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
--A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
--A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
--A POSTROUTING -o eth1 -j MASQUERADE
-COMMIT
-# Completed on Mon Sep 10 09:36:11 2018
-# Generated by iptables-save v1.6.1 on Mon Sep 10 09:36:11 2018
-*mangle
-:PREROUTING ACCEPT [29110:23617436]
-:INPUT ACCEPT [28972:23609086]
-:FORWARD ACCEPT [77:5730]
-:OUTPUT ACCEPT [18987:2640204]
-:POSTROUTING ACCEPT [19717:2724769]
--A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
--A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
-COMMIT
-# Completed on Mon Sep 10 09:36:11 2018
-# Generated by iptables-save v1.6.1 on Mon Sep 10 09:36:11 2018
+# Generated by iptables-save v1.6.1 on Mon Oct 15 23:49:06 2018
 *filter
 :INPUT DROP [0:0]
 :FORWARD DROP [0:0]
-:OUTPUT ACCEPT [26:2734]
+:OUTPUT ACCEPT [70:17009]
 :ssh_spam - [0:0]
 -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
 -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
 -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
 -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
--A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
--A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
--A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
--A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
 -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
 -A INPUT -m conntrack --ctstate RELATED -j ACCEPT
 -A INPUT -p tcp -m tcp --dport 22 -j ssh_spam
@@ -56,6 +22,7 @@ COMMIT
 -A INPUT -s 10.12.11.0/24 -i enp2s0 -j ACCEPT
 -A INPUT -s 10.12.11.0/24 -i eth0 -j ACCEPT
 -A INPUT -s 10.12.11.0/24 -i br0 -j ACCEPT
+-A INPUT -i virbr0 -j ACCEPT
 -A INPUT -i tun0 -j NFLOG --nflog-prefix  "INPUT ACCEPT tun0" --nflog-threshold 1
 -A INPUT -i tun0 -j ACCEPT
 -A INPUT -p icmp -j ACCEPT
@@ -79,6 +46,11 @@ COMMIT
 -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
 -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
 -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
+-A FORWARD -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
+-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
+-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
+-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
 -A FORWARD -m conntrack --ctstate ESTABLISHED -j ACCEPT
 -A FORWARD -m conntrack --ctstate RELATED -j ACCEPT
 -A FORWARD -p icmp -j ACCEPT
@@ -90,6 +62,7 @@ COMMIT
 -A FORWARD -j DROP
 -A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
 -A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
+-A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
 -A ssh_spam -s 216.32.92.138/32 -j DROP
 -A ssh_spam -s 133.9.187.135/32 -m comment --comment "Waseda-Net Japan" -j DROP
 -A ssh_spam -s 125.65.42.0/24 -j DROP
@@ -103,4 +76,40 @@ COMMIT
 -A ssh_spam -s 106.240.0.0/12 -j DROP
 -A ssh_spam -s 58.208.0.0/13 -m comment --comment CHINANET-JS -j DROP
 COMMIT
-# Completed on Mon Sep 10 09:36:11 2018
+# Completed on Mon Oct 15 23:49:06 2018
+# Generated by iptables-save v1.6.1 on Mon Oct 15 23:49:06 2018
+*mangle
+:PREROUTING ACCEPT [2390952:956348385]
+:INPUT ACCEPT [2386571:956136688]
+:FORWARD ACCEPT [506:38300]
+:OUTPUT ACCEPT [1266823:209971073]
+:POSTROUTING ACCEPT [1347695:219412193]
+-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
+-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
+-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
+COMMIT
+# Completed on Mon Oct 15 23:49:06 2018
+# Generated by iptables-save v1.6.1 on Mon Oct 15 23:49:06 2018
+*nat
+:PREROUTING ACCEPT [157427:48880613]
+:INPUT ACCEPT [152316:48607199]
+:OUTPUT ACCEPT [118292:17186995]
+:POSTROUTING ACCEPT [116641:16784686]
+-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
+-A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
+-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
+-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
+-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
+-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
+-A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
+-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
+-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
+-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
+-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
+-A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
+-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
+-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
+-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
+-A POSTROUTING -o eth1 -j MASQUERADE
+COMMIT
+# Completed on Mon Oct 15 23:49:06 2018

diff --git a/iptables/rules.v6 b/iptables/rules.v6
index 9ff08612daf3961f810c93c5e9a8d3fc29441f28..ad724e36c8a71b3a62bbd182132a6ae807b4328f 100644 (file)
--- a/iptables/rules.v6
+++ b/iptables/rules.v6
@@ -1,17 +1,8 @@
-# Generated by ip6tables-save v1.6.1 on Mon Sep 10 09:36:11 2018
-*mangle
-:PREROUTING ACCEPT [196:39445]
-:INPUT ACCEPT [97:18102]
-:FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [122:16450]
-:POSTROUTING ACCEPT [193:29388]
-COMMIT
-# Completed on Mon Sep 10 09:36:11 2018
-# Generated by ip6tables-save v1.6.1 on Mon Sep 10 09:36:11 2018
+# Generated by ip6tables-save v1.6.1 on Mon Oct 15 23:49:06 2018
 *filter
 :INPUT DROP [0:0]
 :FORWARD DROP [0:0]
-:OUTPUT ACCEPT [122:16450]
+:OUTPUT ACCEPT [689:85197]
 :f_mail - [0:0]
 -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
 -A INPUT -m conntrack --ctstate RELATED -j ACCEPT
@@ -60,4 +51,13 @@ COMMIT
 -A f_mail -j NFLOG --nflog-prefix  "IPv6 F_MAIL Reject " --nflog-threshold 1
 -A f_mail -j REJECT --reject-with icmp6-port-unreachable
 COMMIT
-# Completed on Mon Sep 10 09:36:11 2018
+# Completed on Mon Oct 15 23:49:06 2018
+# Generated by ip6tables-save v1.6.1 on Mon Oct 15 23:49:06 2018
+*mangle
+:PREROUTING ACCEPT [11068:3531070]
+:INPUT ACCEPT [1931:312595]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [689:85197]
+:POSTROUTING ACCEPT [1265:163377]
+COMMIT
+# Completed on Mon Oct 15 23:49:06 2018

diff --git a/logrotate.d/ulogd2 b/logrotate.d/ulogd2
index 56c691eebefd504d1bcd24b5bea8e31e0714c2ae..8ec1541510f8371a6c386a5536d4ec9ee8f07e79 100644 (file)
--- a/logrotate.d/ulogd2
+++ b/logrotate.d/ulogd2
@@ -1,8 +1,14 @@
 /var/log/ulog/*.log /var/log/ulog/*.pcap {
+    dateext
     missingok
+    minsize 4M
+    rotate 10
+    notifempty
+    daily
     compress
-    sharedscripts
+    delaycompress
     create 640 ulog adm
+    sharedscripts
     postrotate
        invoke-rc.d ulogd2 reload > /dev/null
     endscript

diff --git a/ulogd.conf b/ulogd.conf
index 331d53853f9185b9a52656c66e356c32bf96d580..46f297a4c3429c1f89a778766a93d81800482498 100644 (file)
--- a/ulogd.conf
+++ b/ulogd.conf
@@ -328,3 +328,5 @@ host="127.0.0.1"
 port="2003"
 # Prefix of data name sent to graphite server
 prefix="netfilter.nfacct"
+
+# vim: filetype=dosini