内容纲要

前言:以前在 Linux 中添加防火墙规则都是添加到默认链中,在新的工作环境中看到自定义的iptables链,刚开始还是有一些懵后来才知道是自定义链😅,自定义链是为了将iptables规则进行分类管理,能够根据业务或服务设置规则,更有效去管理防火墙规则

当iptables规则特别多时,我们需要具备模块化思想,需要将不同目的iptables规则进行归类。
将同一类型的iptables规则作为一个模块(web类,mysql类….),使其更加具有条理性,清爽整洁。
自定义链是除了iptables自带的5个链外,由我们自己定义的新链。
在自定义链中定义的规则不会生效,他需要被内置链引用才可以生效。
删除自定义链,需要将自定义链中的规则先清除,后再删除自定义链。

iptables添加自定义链的方法:

-N:new, 自定义一条新的规则链 。
-E:重命名自定义链;
-X:delete,删除自定义的空的规则链 。

1、创建自定义链

语法
iptables -N 链名
iptables -N test_rule

[root@test 22:27:49 ~]# iptables -L
Chain test_rule (0 references)
target     prot opt source               destination  

现在创建好了1个自定义链,references表示当前链被引用的次数,新创建的链都显示0,说明未被引用。

2、在自定义链上设置规则

iptables -A test_rule -s 192.168.10.144 -p tcp --dport 81  -j DROP

这时候自定义链的规则还不能使用,必须借助于默认链来是实现。自定义链应该被哪调默认的链引用,取决于应用场景,比如说要匹配入站报文,所以可以在INPUT链中引用

3、将自定义好的链关联至内置链上。引用test_rule链

iptables -A INPUT -j test_rule

4、查看自定义链test_rule中定义的规则。

[root@test 23:18:18 ~]# iptables -vnL test_rule
Chain test_rule (1 references)
pkts bytes target     prot opt in     out     source               destination        
0     0 DROP       tcp  --  *      *       192.168.10.144       0.0.0.0/0            tcp dpt:81

5、重命名自定义链

iptables -E test_rule in_test_rule

6、删除自定义链

iptables -L --line-numbers 查看策略的序号
iptables -D INPUT 规则行  删除被默认链所引用规则
iptables -F in_test_rule 清空才能删除
iptables -X in_test_rule

7、iptables 规则实例

[root@cloudos02 ~]# iptables -nvL --line-number
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1     592M  569G BLOCK_PORTS  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp
2     323M  268G BLOCK_PORTS  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp
3     118G  123T KUBE-NODEPORT-NON-LOCAL  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* Ensure that non-local NodePort traffic can flow */
4      71G   63T KUBE-EXTERNAL-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes externally-visible service portals */
5     118G  123T OPENSHIFT-FIREWALL-ALLOW  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* firewall overrides */
6      38G   44T KUBE-FIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
7      38G   44T ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
8    2233K  175M ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
9     700M   55G ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
10     13M  696M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
11    101M 5374M OS_FIREWALL_ALLOW  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
12     12M  473M REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 BLOCK_PORTS  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp
2     721M  214G BLOCK_PORTS  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp
3      61G   35T DOCKER-ISOLATION  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
4     561K   43M DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0           
5        4   288 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
6     518K   39M ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0           
7        0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0           
8      61G   35T MYSQL3306  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
9      61G   35T KUBE-FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes forwarding rules */
10    167M   10G OPENSHIFT-ADMIN-OUTPUT-RULES  all  --  tun0   !tun0   0.0.0.0/0            0.0.0.0/0            /* administrator overrides */
11   2114M  127G OPENSHIFT-FIREWALL-FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* firewall overrides */
12     417 26660 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 29086 packets, 22M bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1      69G   51T KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes service portals */
2     116G  108T KUBE-FIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain BLOCK_PORTS (4 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 RETURN     tcp  --  *      *       10.200.91.35         0.0.0.0/0            tcp
2        0     0 RETURN     udp  --  *      *       10.200.91.35         0.0.0.0/0            udp
3     786M  338G RETURN     tcp  --  *      *       10.240.0.0/12        0.0.0.0/0            tcp
4    5882K  514M RETURN     udp  --  *      *       10.240.0.0/12        0.0.0.0/0            udp
5        0     0 RETURN     tcp  --  *      *       10.249.50.0/24       0.0.0.0/0            tcp
6        0     0 RETURN     udp  --  *      *       10.249.50.0/24       0.0.0.0/0            udp
7        0     0 RETURN     tcp  --  *      *       10.30.144.145        0.0.0.0/0            tcp
8        0     0 RETURN     udp  --  *      *       10.30.144.145        0.0.0.0/0            udp
9      579 30964 RETURN     tcp  --  *      *       10.71.142.66         0.0.0.0/0            tcp
10       0     0 RETURN     udp  --  *      *       10.71.142.66         0.0.0.0/0            udp
11       0     0 RETURN     tcp  --  *      *       10.71.144.0/25       0.0.0.0/0            tcp
12       0     0 RETURN     udp  --  *      *       10.71.144.0/25       0.0.0.0/0            udp
13    409K   29M RETURN     tcp  --  *      *       10.71.144.145        0.0.0.0/0            tcp
14       0     0 RETURN     udp  --  *      *       10.71.144.145        0.0.0.0/0            udp
15       0     0 RETURN     tcp  --  *      *       10.71.144.146        0.0.0.0/0            tcp
16       0     0 RETURN     udp  --  *      *       10.71.144.146        0.0.0.0/0            udp
17       0     0 RETURN     tcp  --  *      *       10.71.144.147        0.0.0.0/0            tcp
18       0     0 RETURN     udp  --  *      *       10.71.144.147        0.0.0.0/0            udp
19       0     0 RETURN     tcp  --  *      *       10.71.144.148        0.0.0.0/0            tcp
20       0     0 RETURN     udp  --  *      *       10.71.144.148        0.0.0.0/0            udp
21       0     0 RETURN     tcp  --  *      *       10.71.148.240        0.0.0.0/0            tcp
22       0     0 RETURN     udp  --  *      *       10.71.148.240        0.0.0.0/0            udp
23       0     0 RETURN     tcp  --  *      *       10.71.148.241        0.0.0.0/0            tcp
24       0     0 RETURN     udp  --  *      *       10.71.148.241        0.0.0.0/0            udp
25    6058  285K RETURN     tcp  --  *      *       10.71.149.0/24       0.0.0.0/0            tcp
26       0     0 RETURN     udp  --  *      *       10.71.149.0/24       0.0.0.0/0            udp
27     11M 2019M RETURN     tcp  --  *      *       127.0.0.1            0.0.0.0/0            tcp
28   9563K 1201M RETURN     udp  --  *      *       127.0.0.1            0.0.0.0/0            udp
29    7885  778K RETURN     tcp  --  *      *       172.17.0.0/16        0.0.0.0/0            tcp
30       0     0 RETURN     udp  --  *      *       172.17.0.0/16        0.0.0.0/0            udp
31       0     0 RETURN     tcp  --  *      *       189.100.137.0/24     0.0.0.0/0            tcp
32       0     0 RETURN     udp  --  *      *       189.100.137.0/24     0.0.0.0/0            udp
33      29  3552 RETURN     tcp  --  *      *       189.100.61.0/24      0.0.0.0/0            tcp
34       0     0 RETURN     udp  --  *      *       189.100.61.0/24      0.0.0.0/0            udp
35       0     0 RETURN     tcp  --  *      *       189.101.130.0/24     0.0.0.0/0            tcp
36       0     0 RETURN     udp  --  *      *       189.101.130.0/24     0.0.0.0/0            udp
37    7152  538K RETURN     tcp  --  *      *       189.101.131.0/24     0.0.0.0/0            tcp
38       0     0 RETURN     udp  --  *      *       189.101.131.0/24     0.0.0.0/0            udp
39    241M  141G RETURN     tcp  --  *      *       189.101.132.0/24     0.0.0.0/0            tcp
40    577M  567G RETURN     udp  --  *      *       189.101.132.0/24     0.0.0.0/0            udp
41       0     0 RETURN     tcp  --  *      *       189.101.16.0/24      0.0.0.0/0            tcp
42       0     0 RETURN     udp  --  *      *       189.101.16.0/24      0.0.0.0/0            udp
43       0     0 RETURN     tcp  --  *      *       189.101.17.0/24      0.0.0.0/0            tcp
44       0     0 RETURN     udp  --  *      *       189.101.17.0/24      0.0.0.0/0            udp
45       0     0 RETURN     tcp  --  *      *       189.101.189.0/24     0.0.0.0/0            tcp
46       0     0 RETURN     udp  --  *      *       189.101.189.0/24     0.0.0.0/0            udp
47       0     0 RETURN     tcp  --  *      *       189.101.22.0/24      0.0.0.0/0            tcp
48       0     0 RETURN     udp  --  *      *       189.101.22.0/24      0.0.0.0/0            udp
49       0     0 RETURN     tcp  --  *      *       189.101.23.0/24      0.0.0.0/0            tcp
50       0     0 RETURN     udp  --  *      *       189.101.23.0/24      0.0.0.0/0            udp
51       0     0 RETURN     tcp  --  *      *       189.101.247.0/24     0.0.0.0/0            tcp
52       0     0 RETURN     udp  --  *      *       189.101.247.0/24     0.0.0.0/0            udp
53    6319  341K RETURN     tcp  --  *      *       189.101.29.0/24      0.0.0.0/0            tcp
54       0     0 RETURN     udp  --  *      *       189.101.29.0/24      0.0.0.0/0            udp
55    1103  178K RETURN     tcp  --  *      *       189.101.77.0/24      0.0.0.0/0            tcp
56       0     0 RETURN     udp  --  *      *       189.101.77.0/24      0.0.0.0/0            udp
57      40  8156 RETURN     tcp  --  *      *       188.98.0.0/17        0.0.0.0/0            tcp
58       0     0 RETURN     udp  --  *      *       188.98.0.0/17        0.0.0.0/0            udp
59       0     0 RETURN     tcp  --  *      *       188.98.128.0/17      0.0.0.0/0            tcp
60       0     0 RETURN     udp  --  *      *       188.98.128.0/17      0.0.0.0/0            udp
61     462 33351 RETURN     tcp  --  *      *       192.168.96.253       0.0.0.0/0            tcp
62       0     0 RETURN     udp  --  *      *       192.168.96.253       0.0.0.0/0            udp
63   3115K  219M RETURN     tcp  --  *      *       195.180.1.0/24       0.0.0.0/0            tcp
64       0     0 RETURN     udp  --  *      *       195.180.1.0/24       0.0.0.0/0            udp
65       0     0 RETURN     tcp  --  *      *       195.180.3.0/24       0.0.0.0/0            tcp
66       0     0 RETURN     udp  --  *      *       195.180.3.0/24       0.0.0.0/0            udp
67       0     0 RETURN     tcp  --  *      *       195.180.4.0/24       0.0.0.0/0            tcp
68       0     0 RETURN     udp  --  *      *       195.180.4.0/24       0.0.0.0/0            udp
69       0     0 RETURN     tcp  --  *      *       30.1.1.104/29        0.0.0.0/0            tcp
70       0     0 RETURN     udp  --  *      *       30.1.1.104/29        0.0.0.0/0            udp
71    291K   28M RETURN     tcp  --  *      *       30.1.4.0/24          0.0.0.0/0            tcp
72       0     0 RETURN     udp  --  *      *       30.1.4.0/24          0.0.0.0/0            udp
73    982K  213M RETURN     tcp  --  *      *       30.1.48.0/20         0.0.0.0/0            tcp
74       0     0 RETURN     tcp  --  *      *       127.0.0.1            0.0.0.0/0            tcp
75       0     0 RETURN     udp  --  *      *       127.0.0.1            0.0.0.0/0            udp
76      14   840 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2375
77       0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:2375
78      11   660 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:11211
79       1    43 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:11211

Chain DOCKER (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1     561K   43M ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.2           tcp dpt:5000

Chain DOCKER-ISOLATION (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1      61G   35T RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain KUBE-EXTERNAL-SERVICES (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cloudos-iaas/os-cas-svc:os-cas-svc has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:8080 reject-with icmp-port-unreachable
2        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cloudos-iaas/os-cas-svc:cvktocvm has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:20045 reject-with icmp-port-unreachable
3        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cloudos-iaas/os-cas-svc:casserver2 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:20041 reject-with icmp-port-unreachable
4        0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cloudos-iaas/os-cas-svc:hatoback has no endpoints */ ADDRTYPE match dst-type LOCAL udp dpt:20042 reject-with icmp-port-unreachable
5        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* qunding/qunding-svc:qunding-mysql has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:23308 reject-with icmp-port-unreachable
6        0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cloudos-iaas/os-cas-svc:casserver1 has no endpoints */ ADDRTYPE match dst-type LOCAL udp dpt:162 reject-with icmp-port-unreachable
7        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* qunding/qunding-svc:qunding has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:28089 reject-with icmp-port-unreachable
8        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cloudos-iaas/os-cas-svc:casmoninternal has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:20044 reject-with icmp-port-unreachable
9        0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cloudos-iaas/os-cas-svc:hatocvm has no endpoints */ ADDRTYPE match dst-type LOCAL udp dpt:20043 reject-with icmp-port-unreachable
10       0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cloudos-iaas/os-cas-svc:cvmtocvk has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:20046 reject-with icmp-port-unreachable

Chain KUBE-FIREWALL (2 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

Chain KUBE-FORWARD (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes forwarding rules */ mark match 0x1/0x1
2    20568 4671K ACCEPT     all  --  *      *       10.240.0.0/12        0.0.0.0/0            /* kubernetes forwarding conntrack pod source rule */ ctstate RELATED,ESTABLISHED
3      707 2424K ACCEPT     all  --  *      *       0.0.0.0/0            10.240.0.0/12        /* kubernetes forwarding conntrack pod destination rule */ ctstate RELATED,ESTABLISHED

Chain KUBE-NODEPORT-NON-LOCAL (1 references)
num   pkts bytes target     prot opt in     out     source               destination         

Chain KUBE-SERVICES (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.69.157        /* default/ame-ingress-nginx-controller-admission:https-webhook has no endpoints */ tcp dpt:443 reject-with icmp-port-unreachable
2        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.62.32         /* cloudos-iaas/os-cas-svc:os-cas-svc has no endpoints */ tcp dpt:8080 reject-with icmp-port-unreachable
3        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.62.32         /* cloudos-iaas/os-cas-svc:cvktocvm has no endpoints */ tcp dpt:20045 reject-with icmp-port-unreachable
4        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.62.32         /* cloudos-iaas/os-cas-svc:casserver2 has no endpoints */ tcp dpt:20041 reject-with icmp-port-unreachable
5        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.124.202       /* default/os-sys-app-svc:os-sys-app-svc has no endpoints */ tcp dpt:16300 reject-with icmp-port-unreachable
6        0     0 REJECT     udp  --  *      *       0.0.0.0/0            10.100.62.32         /* cloudos-iaas/os-cas-svc:hatoback has no endpoints */ udp dpt:20042 reject-with icmp-port-unreachable
7        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.231.239       /* qunding/qunding-svc:qunding-mysql has no endpoints */ tcp dpt:3306 reject-with icmp-port-unreachable
8        0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.60.85         /* cloudos-iaas/os-trove-svc:trove-endpoint has no endpoints */ tcp dpt:8779 reject-with icmp-port-unreachable
9        0     0 REJECT     udp  --  *      *       0.0.0.0/0            10.100.62.32         /* cloudos-iaas/os-cas-svc:casserver1 has no endpoints */ udp dpt:162 reject-with icmp-port-unreachable
10       0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.231.239       /* qunding/qunding-svc:qunding has no endpoints */ tcp dpt:8888 reject-with icmp-port-unreachable
11       0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.62.32         /* cloudos-iaas/os-cas-svc:casmoninternal has no endpoints */ tcp dpt:20044 reject-with icmp-port-unreachable
12       0     0 REJECT     udp  --  *      *       0.0.0.0/0            10.100.62.32         /* cloudos-iaas/os-cas-svc:hatocvm has no endpoints */ udp dpt:20043 reject-with icmp-port-unreachable
13       0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.62.32         /* cloudos-iaas/os-cas-svc:cvmtocvk has no endpoints */ tcp dpt:20046 reject-with icmp-port-unreachable
14       0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.100.37.100        /* prometheus-monitoring/default-alertmanager:web has no endpoints */ tcp dpt:31093 reject-with icmp-port-unreachable

Chain MYSQL3306 (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 127.0.0.1 ctorigdstport 3306
2      48G   10T RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 10.240.0.0/12 ctorigdstport 3306
3      419  165K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 189.101.132.4 ctorigdstport 3306
4        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 189.101.132.3 ctorigdstport 3306
5        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 189.101.132.2 ctorigdstport 3306
6        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 189.101.132.2 ctorigdstport 3306
7        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 189.101.132.3 ctorigdstport 3306
8        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 189.101.132.4 ctorigdstport 3306
9     325K   15M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 189.101.131.222 ctorigdstport 3306
10     30M 5188M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 189.101.132.201 ctorigdstport 3306
11       0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigsrc 189.101.132.1 ctorigdstport 3306
12      18   984 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT ctorigdstport 3306

Chain OPENSHIFT-ADMIN-OUTPUT-RULES (1 references)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OPENSHIFT-FIREWALL-ALLOW (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1      69G   63T ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:4789 /* VXLAN incoming */
2      10G   17T ACCEPT     all  --  tun0   *       0.0.0.0/0            0.0.0.0/0            /* from SDN to localhost */
3       54  3438 ACCEPT     all  --  docker0 *       0.0.0.0/0            0.0.0.0/0            /* from docker to localhost */

Chain OPENSHIFT-FIREWALL-FORWARD (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1      11M  543M DROP       all  --  *      *       10.240.0.0/12        0.0.0.0/0            /* attempted resend after connection close */ ctstate INVALID
2    1934M  116G ACCEPT     all  --  *      *       0.0.0.0/0            10.240.0.0/12        /* forward traffic from SDN */
3     169M   10G ACCEPT     all  --  *      *       10.240.0.0/12        0.0.0.0/0            /* forward traffic to SDN */

Chain OS_FIREWALL_ALLOW (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1     3764  200K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:9100
2       23  1542 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:9100
3     289K   15M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:10250
4    10028  595K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:10256
5    2560K  154M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80
6    9749K  584M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:443
7        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW udp dpt:4789
8      76M 4145M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpts:1:65535
9    35003 2661K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW udp dpts:1:65535
10       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpts:9000:10000
11       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:1936
12       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:10080
13       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:10443
14       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:6579
15       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:6679
16       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:2369
17       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:2390
18       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:2375
19       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpts:7000:7100
20       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:2379
21       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:2380
22       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:8443
23       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:8444
24       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:8053
25       0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW udp dpt:8053