-o eth0 -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT -i eth0 -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT -o eth0 -p udp --dport 67 --sport 68 -m state --state NEW,ESTABLISHED -j ACCEPT -i eth0 -p udp --dport 68 --sport 67 -m state --state ESTABLISHED -j ACCEPT -d 0.0.0.0/8,10.0.0.0/8,100.64.0.0/10,169.254.0.0/16,172.16.0.0/12,192.0.0.0/24,192.0.2.0/24,192.168.0.0/16,198.18.0.0/15,198.51.100.0/24,203.0.113.0/24,224.0.0.0/4,240.0.0.0/4 -j DROP -m comment --comment "martian-filter" -s 0.0.0.0/8,10.0.0.0/8,100.64.0.0/10,169.254.0.0/16,172.16.0.0/12,192.0.0.0/24,192.0.2.0/24,192.168.0.0/16,198.18.0.0/15,198.51.100.0/24,203.0.113.0/24,224.0.0.0/4,240.0.0.0/4 -j DROP -m comment --comment "martian-filter" -o eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -p tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -p tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -p tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -p tcp --dport 8081 -m state --state NEW,ESTABLISHED -j ACCEPT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -p tcp --sport 8081 -m state --state ESTABLISHED -j ACCEPT -i eth0 -p tcp --dport 22 -m state --state NEW -m limit --limit 60/minute --limit-burst 10 -j ACCEPT -i eth0 -p tcp --dport 22 -m state --state NEW -m connlimit --connlimit-above 20 --connlimit-mask 24 -j DROP -i eth0 -p tcp --dport 22 -m state --state ESTABLISHED -j ACCEPT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT -i eth0 -p tcp --dport 80 -m state --state NEW -m limit --limit 60/minute --limit-burst 10 -j ACCEPT -i eth0 -p tcp --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 --connlimit-mask 24 -j DROP -i eth0 -p tcp --dport 80 -m state --state ESTABLISHED -j ACCEPT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT -i eth0 -p tcp --dport 443 -m state --state NEW -m limit --limit 60/minute --limit-burst 10 -j ACCEPT -i eth0 -p tcp --dport 443 -m state --state NEW -m connlimit --connlimit-above 20 --connlimit-mask 24 -j DROP -i eth0 -p tcp --dport 443 -m state --state ESTABLISHED -j ACCEPT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -p tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -p tcp --dport 8081 -m state --state NEW,ESTABLISHED -j ACCEPT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -p tcp --sport 8081 -m state --state ESTABLISHED -j ACCEPT -i eth0 -p tcp --dport 8080 -m state --state NEW -m limit --limit 60/minute --limit-burst 10 -j ACCEPT -i eth0 -p tcp --dport 8080 -m state --state NEW -m connlimit --connlimit-above 20 --connlimit-mask 24 -j DROP -i eth0 -p tcp --dport 8080 -m state --state ESTABLISHED -j ACCEPT -o eth0 -p tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT -m limit --limit 12/minute --limit-burst 2 -j LOG -m limit --limit 12/minute --limit-burst 2 -j LOG -j DROP -j DROP