*mangle

:PREROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

COMMIT

*nat

:PREROUTING ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:WANPREROUTING - [0:0]

-A PREROUTING -i vlan2 -d 192.168.1.1/255.255.255.0 -j DROP

-A PREROUTING -i vlan2 -d 10.22.0.1/255.255.255.0 -j DROP

-A PREROUTING -i vlan2 -d 192.168.3.2/255.255.255.0 -j DROP

-A POSTROUTING  -o vlan2 -j MASQUERADE

-A POSTROUTING -o br0 -s 192.168.1.1/255.255.255.0 -d 192.168.1.1/255.255.255.0 -j SNAT --to-source 192.168.1.1

-A POSTROUTING -o br1 -s 10.22.0.1/255.255.255.0 -d 10.22.0.1/255.255.255.0 -j SNAT --to-source 10.22.0.1

-A POSTROUTING -o br2 -s 192.168.3.2/255.255.255.0 -d 192.168.3.2/255.255.255.0 -j SNAT --to-source 192.168.3.2

COMMIT

*filter

:INPUT DROP [0:0]

:OUTPUT ACCEPT [0:0]

:logdrop - [0:0]

-A logdrop -m state --state NEW -m limit --limit 60/m -j LOG --log-prefix "DROP " --log-macdecode --log-tcp-sequence --log-tcp-options --log-ip-options

-A logdrop -j DROP

:logreject - [0:0]

-A logreject -m limit --limit 60/m -j LOG --log-prefix "REJECT " --log-macdecode --log-tcp-sequence --log-tcp-options --log-ip-options

-A logreject -p tcp -j REJECT --reject-with tcp-reset

:logaccept - [0:0]

-A logaccept -m state --state NEW -m limit --limit 60/m -j LOG --log-prefix "ACCEPT " --log-macdecode --log-tcp-sequence --log-tcp-options --log-ip-options

-A logaccept -j ACCEPT

-A INPUT -m state --state INVALID -j DROP

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-N shlimit

-A shlimit -m recent --set --name shlimit

-A shlimit -m recent --update --hitcount 4 --seconds 60 --name shlimit -j logdrop

-A INPUT -p tcp --dport 22 -m state --state NEW -j shlimit

-A INPUT -i lo -j ACCEPT

-A INPUT -i br0 -j ACCEPT

-A INPUT -i br1 -j ACCEPT

-A INPUT -i br2 -j ACCEPT

-A INPUT -p udp --sport 67 --dport 68 -j logaccept

-A INPUT -j logdrop

:FORWARD DROP [0:0]

-A FORWARD -m account --aaddr 192.168.1.0/255.255.255.0 --aname lan

-A FORWARD -m account --aaddr 10.22.0.0/255.255.255.0 --aname lan1

-A FORWARD -m account --aaddr 192.168.3.0/255.255.255.0 --aname lan2

-A FORWARD -i br0 -o br0 -j ACCEPT

-A FORWARD -i br1 -o br1 -j ACCEPT

-A FORWARD -i br2 -o br2 -j ACCEPT

-A FORWARD -i br0 -o br1   -j ACCEPT

-A FORWARD -i br2 -o br1 -s 192.168.3.120  -j ACCEPT

-A FORWARD -i br1 -o br2 -s 1.1.4.0/24 -d 192.168.3.120 -j ACCEPT

-A FORWARD -i br1 -o br2 -s 10.22.0.0/24 -d 192.168.3.120 -j ACCEPT

-A FORWARD -m state --state INVALID -j DROP

-A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

:wanin - [0:0]

:wanout - [0:0]

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -i br0 -o br2 -j DROP

-A FORWARD -i br1 -o br0 -j DROP

-A FORWARD -i br1 -o br2 -j DROP

-A FORWARD -i br2 -o br0 -j DROP

-A FORWARD -i br2 -o br1 -j DROP

-A FORWARD -i vlan2 -j wanin

-A FORWARD -o vlan2 -j wanout

-A FORWARD -i br0 -j logaccept

-A FORWARD -i br1 -j logaccept

-A FORWARD -i br2 -j logaccept

COMMIT