Shorewall 4.5.5.3 Dump at philipp.info - Sun Sep  8 21:25:10 CEST 2013

Shorewall is running
State:Started (Sun Sep  8 21:13:49 CEST 2013) from /etc/shorewall/
Counters reset Sun Sep  8 21:13:49 CEST 2013

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   10   320 xenbrI_in  all  --  xenbrI *       0.0.0.0/0            0.0.0.0/0           
   10   320 xenbrD_in  all  --  xenbrD *       0.0.0.0/0            0.0.0.0/0           
35991   12M xenbrE_in  all  --  xenbrE *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
   10   320 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
14471 5337K xenbrE_fwd  all  --  xenbrE *       0.0.0.0/0            0.0.0.0/0           
17830 4559K xenbrI_fwd  all  --  xenbrI *       0.0.0.0/0            0.0.0.0/0           
  549  117K xenbrD_fwd  all  --  xenbrD *       0.0.0.0/0            0.0.0.0/0           
 2946  149K Reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 2946  149K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 6 prefix "Shorewall:FORWARD:REJECT:"
 2946  149K reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2929  117K xenbrI_out  all  --  *      xenbrI  0.0.0.0/0            0.0.0.0/0           
   27  1040 xenbrD_out  all  --  *      xenbrD  0.0.0.0/0            0.0.0.0/0           
19285 6400K xenbrE_out  all  --  *      xenbrE  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain Broadcast (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    5   160 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            224.0.0.0/4         

Chain Drop (3 references)
 pkts bytes target     prot opt in     out     source               destination         
   11   416            all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 reject     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:113 /* Auth */
   11   416 Broadcast  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3 code 4 /* Needed ICMP types */
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11 /* Needed ICMP types */
    6   256 Invalid    all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 135,445 /* SMB */
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:137:139 /* SMB */
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:137 dpts:1024:65535 /* SMB */
    5   216 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 135,139,445 /* SMB */
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1900 /* UPnP */
    1    40 NotSyn     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:53 /* Late DNS Replies */

Chain Invalid (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID

Chain NotSyn (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags:! 0x17/0x02

Chain Reject (6 references)
 pkts bytes target     prot opt in     out     source               destination         
 2946  149K            all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 reject     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:113 /* Auth */
 2946  149K Broadcast  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3 code 4 /* Needed ICMP types */
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11 /* Needed ICMP types */
 2946  149K Invalid    all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 reject     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 135,445 /* SMB */
    0     0 reject     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:137:139 /* SMB */
    0     0 reject     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:137 dpts:1024:65535 /* SMB */
    0     0 reject     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 135,139,445 /* SMB */
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1900 /* UPnP */
 2946  149K NotSyn     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:53 /* Late DNS Replies */

Chain dmz2ext (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  420  103K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
   49  3004 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain dmz2fw (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    5   160 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain dmz2int (2 references)
 pkts bytes target     prot opt in     out     source               destination         
   55  9423 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       192.168.1.100        192.168.2.40         tcp dpt:389
    3   180 ACCEPT     all  --  *      *       192.168.1.100        192.168.2.70        
    0     0 Reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 6 prefix "Shorewall:dmz2int:REJECT:"
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain dmz2vpn (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 Reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 6 prefix "Shorewall:dmz2vpn:REJECT:"
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain dmz_frwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   58  9603 dmz2int    all  --  *      xenbrI  0.0.0.0/0            192.168.2.0/24       policy match dir out pol none
    0     0 dmz2int    all  --  *      xenbrI  0.0.0.0/0            224.0.0.0/4          policy match dir out pol none
  469  106K dmz2ext    all  --  *      xenbrE  0.0.0.0/0            0.0.0.0/0            policy match dir out pol none
    0     0 dmz2vpn    all  --  *      xenbrE  0.0.0.0/0            192.168.178.0/24     policy match dir out pol ipsec
    0     0 dmz2vpn    all  --  *      xenbrE  0.0.0.0/0            91.119.56.143        policy match dir out pol ipsec

Chain dynamic (6 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ext2dmz (2 references)
 pkts bytes target     prot opt in     out     source               destination         
  367 51233 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
   13   732 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.100        tcp dpt:80 ctorigdst 178.63.18.4
   13   676 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.100        tcp dpt:443 ctorigdst 178.63.18.4
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.66         tcp dpt:31337 ctorigdst 178.63.18.4
    3   192 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.100        tcp dpt:81 ctorigdstport 80 ctorigdst 178.63.18.40
    3   192 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.100        tcp dpt:444 ctorigdstport 443 ctorigdst 178.63.18.40
    0     0 Reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 6 prefix "Shorewall:ext2dmz:REJECT:"
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain ext2fw (1 references)
 pkts bytes target     prot opt in     out     source               destination         
17211 6547K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     esp  --  *      *       91.119.56.143        0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      *       91.119.56.143        0.0.0.0/0            udp dpt:500 ctstate NEW
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22 ctorigdst 178.63.18.4
    2   168 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 ctorigdst 178.63.18.4
   11   416 Drop       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    1    40 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 6 prefix "Shorewall:ext2fw:DROP:"
    1    40 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ext2int (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    8   608 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.2.40         tcp dpt:3389 ctorigdstport 3389 ctorigdst 178.63.18.4
    6   360 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.2.70         tcp dpt:25 ctorigdstport 25 ctorigdst 178.63.18.40
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.2.70         tcp dpt:587 ctorigdstport 587 ctorigdst 178.63.18.40
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            192.168.2.70         icmptype 8 ctorigdst 178.63.18.40
    0     0 Drop       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 6 prefix "Shorewall:ext2int:DROP:"
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ext2vpn (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 Drop       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 6 prefix "Shorewall:ext2vpn:DROP:"
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ext_frwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   14   968 ext2int    all  --  *      xenbrI  0.0.0.0/0            192.168.2.0/24       policy match dir out pol none
    0     0 ext2int    all  --  *      xenbrI  0.0.0.0/0            224.0.0.0/4          policy match dir out pol none
  399 53025 ext2dmz    all  --  *      xenbrD  0.0.0.0/0            192.168.1.0/24       policy match dir out pol none
    0     0 ext2dmz    all  --  *      xenbrD  0.0.0.0/0            224.0.0.0/4          policy match dir out pol none
    0     0 ext2vpn    all  --  *      xenbrE  0.0.0.0/0            192.168.178.0/24     policy match dir out pol ipsec
    0     0 ext2vpn    all  --  *      xenbrE  0.0.0.0/0            91.119.56.143        policy match dir out pol ipsec

Chain fw2dmz (3 references)
 pkts bytes target     prot opt in     out     source               destination         
   22   880 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    5   160 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fw2ext (1 references)
 pkts bytes target     prot opt in     out     source               destination         
17444 5942K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     esp  --  *      *       0.0.0.0/0            91.119.56.143       
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            91.119.56.143        udp dpt:500 ctstate NEW
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fw2int (3 references)
 pkts bytes target     prot opt in     out     source               destination         
 2924  117K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    5   160 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fw2vpn (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 1841  458K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain int2dmz (2 references)
 pkts bytes target     prot opt in     out     source               destination         
   44 32359 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain int2ext (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    8   608 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain int2fw (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    5   160 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain int2vpn (2 references)
 pkts bytes target     prot opt in     out     source               destination         
12863 4274K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
 1991  104K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain int_frwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   44 32359 int2dmz    all  --  *      xenbrD  0.0.0.0/0            192.168.1.0/24       policy match dir out pol none
    0     0 int2dmz    all  --  *      xenbrD  0.0.0.0/0            224.0.0.0/4          policy match dir out pol none
    8   608 int2ext    all  --  *      xenbrE  0.0.0.0/0            0.0.0.0/0            policy match dir out pol none
14854 4378K int2vpn    all  --  *      xenbrE  0.0.0.0/0            192.168.178.0/24     policy match dir out pol ipsec
    0     0 int2vpn    all  --  *      xenbrE  0.0.0.0/0            91.119.56.143        policy match dir out pol ipsec

Chain logdrop (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain logreject (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain reject (13 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match src-type BROADCAST
    0     0 DROP       all  --  *      *       224.0.0.0/4          0.0.0.0/0           
    0     0 DROP       2    --  *      *       0.0.0.0/0            0.0.0.0/0           
 2946  149K REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with tcp-reset
    0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-unreachable
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain shorewall (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain vpn2dmz (2 references)
 pkts bytes target     prot opt in     out     source               destination         
   40  7584 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.100        tcp dpt:22 ctorigdstport 2201
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.66         tcp dpt:22 ctorigdstport 2202
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.50         tcp dpt:22 ctorigdstport 2203
    4   240 ACCEPT     tcp  --  *      *       192.168.178.58       192.168.1.66         tcp dpt:5666 ctorigdstport 5667
    0     0 Reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 6 prefix "Shorewall:vpn2dmz:REJECT:"
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain vpn2ext (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 Reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 6 prefix "Shorewall:vpn2ext:REJECT:"
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain vpn2fw (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 2457  176K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
16310 5680K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain vpn2int (2 references)
 pkts bytes target     prot opt in     out     source               destination         
13803 5260K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  211 14964 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain vpn_frwd (2 references)
 pkts bytes target     prot opt in     out     source               destination         
14014 5275K vpn2int    all  --  *      xenbrI  0.0.0.0/0            192.168.2.0/24       policy match dir out pol none
    0     0 vpn2int    all  --  *      xenbrI  0.0.0.0/0            224.0.0.0/4          policy match dir out pol none
   44  7824 vpn2dmz    all  --  *      xenbrD  0.0.0.0/0            192.168.1.0/24       policy match dir out pol none
    0     0 vpn2dmz    all  --  *      xenbrD  0.0.0.0/0            224.0.0.0/4          policy match dir out pol none
    0     0 vpn2ext    all  --  *      xenbrE  0.0.0.0/0            0.0.0.0/0            policy match dir out pol none

Chain xenbrD_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   74  4504 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW
  549  117K dmz_frwd   all  --  *      *       192.168.1.0/24       0.0.0.0/0            policy match dir in pol none

Chain xenbrD_in (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   10   320 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW
    5   160 dmz2fw     all  --  *      *       192.168.1.0/24       0.0.0.0/0            policy match dir in pol none

Chain xenbrD_out (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   22   880 fw2dmz     all  --  *      *       0.0.0.0/0            192.168.1.0/24       policy match dir out pol none
    0     0 fw2dmz     all  --  *      *       0.0.0.0/0            255.255.255.255      policy match dir out pol none
    5   160 fw2dmz     all  --  *      *       0.0.0.0/0            224.0.0.0/4          policy match dir out pol none

Chain xenbrE_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  253 17356 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW
14058 5283K vpn_frwd   all  --  *      *       192.168.178.0/24     0.0.0.0/0           [goto]  policy match dir in pol ipsec
    0     0 vpn_frwd   all  --  *      *       91.119.56.143        0.0.0.0/0           [goto]  policy match dir in pol ipsec
  413 53993 ext_frwd   all  --  *      *       0.0.0.0/0            0.0.0.0/0            policy match dir in pol none

Chain xenbrE_in (1 references)
 pkts bytes target     prot opt in     out     source               destination         
16323 5680K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW
17224 6547K ext2fw     all  --  *      *       0.0.0.0/0            0.0.0.0/0            policy match dir in pol none
 2459  176K vpn2fw     all  --  *      *       192.168.178.0/24     0.0.0.0/0            policy match dir in pol ipsec
16308 5679K vpn2fw     all  --  *      *       91.119.56.143        0.0.0.0/0            policy match dir in pol ipsec

Chain xenbrE_out (1 references)
 pkts bytes target     prot opt in     out     source               destination         
17444 5942K fw2ext     all  --  *      *       0.0.0.0/0            0.0.0.0/0            policy match dir out pol none
 1841  458K fw2vpn     all  --  *      *       0.0.0.0/0            192.168.178.0/24     policy match dir out pol ipsec
    0     0 fw2vpn     all  --  *      *       0.0.0.0/0            91.119.56.143        policy match dir out pol ipsec

Chain xenbrI_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 4915  252K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW
17830 4559K int_frwd   all  --  *      *       192.168.2.0/24       0.0.0.0/0            policy match dir in pol none

Chain xenbrI_in (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   10   320 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW
    5   160 int2fw     all  --  *      *       192.168.2.0/24       0.0.0.0/0            policy match dir in pol none

Chain xenbrI_out (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 2924  117K fw2int     all  --  *      *       0.0.0.0/0            192.168.2.0/24       policy match dir out pol none
    0     0 fw2int     all  --  *      *       0.0.0.0/0            255.255.255.255      policy match dir out pol none
    5   160 fw2int     all  --  *      *       0.0.0.0/0            224.0.0.0/4          policy match dir out pol none

Log (/var/log/messages)

Sep  8 21:25:06 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17049 DF PROTO=TCP SPT=29154 DPT=3268 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:06 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17050 DF PROTO=TCP SPT=29153 DPT=389 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:07 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=17054 DF PROTO=TCP SPT=29154 DPT=3268 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:07 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=17055 DF PROTO=TCP SPT=29153 DPT=389 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:07 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17061 DF PROTO=TCP SPT=29161 DPT=389 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:07 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17062 DF PROTO=TCP SPT=29162 DPT=3268 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:07 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17083 DF PROTO=TCP SPT=29161 DPT=389 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:07 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17084 DF PROTO=TCP SPT=29162 DPT=3268 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:08 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=17088 DF PROTO=TCP SPT=29161 DPT=389 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:08 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=17089 DF PROTO=TCP SPT=29162 DPT=3268 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:08 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17095 DF PROTO=TCP SPT=29167 DPT=389 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:08 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17096 DF PROTO=TCP SPT=29168 DPT=3268 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:09 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17117 DF PROTO=TCP SPT=29167 DPT=389 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:09 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17118 DF PROTO=TCP SPT=29168 DPT=3268 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:09 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=17122 DF PROTO=TCP SPT=29167 DPT=389 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:09 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=17123 DF PROTO=TCP SPT=29168 DPT=3268 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:10 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17129 DF PROTO=TCP SPT=29174 DPT=389 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:10 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17132 DF PROTO=TCP SPT=29176 DPT=3268 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:10 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17152 DF PROTO=TCP SPT=29174 DPT=389 WINDOW=8192 RES=0x00 SYN URGP=0 
Sep  8 21:25:10 FORWARD:REJECT:IN=xenbrI OUT=xenbrI PHYSIN=vif4.0-emu PHYSOUT=vif3.0-emu SRC=192.168.2.70 DST=192.168.2.40 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=17153 DF PROTO=TCP SPT=29176 DPT=3268 WINDOW=8192 RES=0x00 SYN URGP=0 

NAT Table

Chain PREROUTING (policy ACCEPT 5321 packets, 275K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 5359  277K dnat       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain INPUT (policy ACCEPT 4 packets, 360 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 5124 packets, 233K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2001  105K xenbrE_masq  all  --  *      xenbrE  0.0.0.0/0            0.0.0.0/0           

Chain dnat (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  242 12740 ext_dnat   all  --  xenbrE *       0.0.0.0/0            0.0.0.0/0            policy match dir in pol none
  155  9660 vpn_dnat   all  --  xenbrE *       192.168.178.0/24     0.0.0.0/0            policy match dir in pol ipsec
    0     0 vpn_dnat   all  --  xenbrE *       91.119.56.143        0.0.0.0/0            policy match dir in pol ipsec

Chain ext_dnat (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   13   732 DNAT       tcp  --  *      *       0.0.0.0/0            178.63.18.4          tcp dpt:80 to:192.168.1.100
   13   676 DNAT       tcp  --  *      *       0.0.0.0/0            178.63.18.4          tcp dpt:443 to:192.168.1.100
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            178.63.18.4          tcp dpt:31337 to:192.168.1.66
    3   192 DNAT       tcp  --  *      *       0.0.0.0/0            178.63.18.40         tcp dpt:80 to:192.168.1.100:81
    3   192 DNAT       tcp  --  *      *       0.0.0.0/0            178.63.18.40         tcp dpt:443 to:192.168.1.100:444
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            178.63.18.4          tcp dpt:3389 to:192.168.2.40:3389
    2   120 DNAT       tcp  --  *      *       0.0.0.0/0            178.63.18.40         tcp dpt:25 to:192.168.2.70:25
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            178.63.18.40         tcp dpt:587 to:192.168.2.70:587
    0     0 DNAT       icmp --  *      *       0.0.0.0/0            178.63.18.40         icmptype 8 to:192.168.2.70

Chain vpn_dnat (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2201 to:192.168.1.100:22
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2202 to:192.168.1.66:22
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2203 to:192.168.1.50:22
    4   240 DNAT       tcp  --  *      *       192.168.178.58       0.0.0.0/0            tcp dpt:5667 to:192.168.1.66:5666

Chain xenbrE_masq (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   13   844 MASQUERADE  all  --  *      *       192.168.1.0/24       0.0.0.0/0            policy match dir out pol none
    0     0 MASQUERADE  all  --  *      *       192.168.2.0/24       0.0.0.0/0            policy match dir out pol none

Mangle Table

Chain PREROUTING (policy ACCEPT 69144 packets, 22M bytes)
 pkts bytes target     prot opt in     out     source               destination         
69144   22M tcpre      all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain INPUT (policy ACCEPT 36014 packets, 12M bytes)
 pkts bytes target     prot opt in     out     source               destination         
36014   12M tcin       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 32850 packets, 10M bytes)
 pkts bytes target     prot opt in     out     source               destination         
32850   10M MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            MARK and 0xffffff00
32850   10M tcfor      all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 22241 packets, 6518K bytes)
 pkts bytes target     prot opt in     out     source               destination         
22241 6518K tcout      all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain POSTROUTING (policy ACCEPT 52155 packets, 16M bytes)
 pkts bytes target     prot opt in     out     source               destination         
52155   16M tcpost     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain tcfor (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain tcin (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain tcout (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain tcpost (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain tcpre (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Raw Table

Chain PREROUTING (policy ACCEPT 69144 packets, 22M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 22241 packets, 6518K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Conntrack Table (72 out of 65536)

tcp      6 4 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29152 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29152 [ASSURED] mark=0 use=2
tcp      6 430684 ESTABLISHED src=192.168.178.40 dst=192.168.2.1 sport=18063 dport=22 src=192.168.2.1 dst=192.168.178.40 sport=22 dport=18063 [ASSURED] mark=0 use=2
tcp      6 1 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29138 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29138 [ASSURED] mark=0 use=2
unknown  2 528 src=192.168.2.1 dst=224.0.0.251 [UNREPLIED] src=224.0.0.251 dst=192.168.2.1 mark=0 use=2
tcp      6 431999 ESTABLISHED src=192.168.178.40 dst=192.168.2.1 sport=17650 dport=22 src=192.168.2.1 dst=192.168.178.40 sport=22 dport=17650 [ASSURED] mark=0 use=2
tcp      6 431919 ESTABLISHED src=192.168.1.66 dst=178.33.33.123 sport=43077 dport=6667 src=178.33.33.123 dst=178.63.18.4 sport=6667 dport=43077 [ASSURED] mark=0 use=2
tcp      6 32 TIME_WAIT src=192.168.178.40 dst=192.168.2.70 sport=18934 dport=443 src=192.168.2.70 dst=192.168.178.40 sport=443 dport=18934 [ASSURED] mark=0 use=2
tcp      6 7 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29165 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29165 [ASSURED] mark=0 use=2
tcp      6 60 TIME_WAIT src=192.168.178.58 dst=192.168.2.40 sport=60997 dport=12489 src=192.168.2.40 dst=192.168.178.58 sport=12489 dport=60997 [ASSURED] mark=0 use=2
udp      17 7 src=192.168.1.100 dst=119.81.38.68 sport=123 dport=123 src=119.81.38.68 dst=178.63.18.4 sport=123 dport=123 mark=0 use=2
tcp      6 5 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29156 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29156 [ASSURED] mark=0 use=2
tcp      6 431914 ESTABLISHED src=192.168.178.40 dst=192.168.2.70 sport=19075 dport=443 src=192.168.2.70 dst=192.168.178.40 sport=443 dport=19075 [ASSURED] mark=0 use=2
tcp      6 8 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29169 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29169 [ASSURED] mark=0 use=2
tcp      6 5 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29158 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29158 [ASSURED] mark=0 use=2
tcp      6 430229 ESTABLISHED src=91.119.56.143 dst=178.63.18.4 sport=17698 dport=22 src=178.63.18.4 dst=91.119.56.143 sport=22 dport=17698 [ASSURED] mark=0 use=2
tcp      6 431948 ESTABLISHED src=192.168.178.40 dst=192.168.2.70 sport=17693 dport=3389 src=192.168.2.70 dst=192.168.178.40 sport=3389 dport=17693 [ASSURED] mark=0 use=2
tcp      6 8 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29171 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29171 [ASSURED] mark=0 use=2
udp      17 120 src=178.63.18.4 dst=129.70.132.34 sport=123 dport=123 src=129.70.132.34 dst=178.63.18.4 sport=123 dport=123 [ASSURED] mark=0 use=2
tcp      6 4 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29150 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29150 [ASSURED] mark=0 use=2
udp      17 63 src=178.63.18.4 dst=178.63.101.8 sport=123 dport=123 src=178.63.101.8 dst=178.63.18.4 sport=123 dport=123 [ASSURED] mark=0 use=2
tcp      6 9 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29173 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29173 [ASSURED] mark=0 use=2
tcp      6 8 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29170 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29170 [ASSURED] mark=0 use=2
tcp      6 5 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29157 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29157 [ASSURED] mark=0 use=2
udp      17 23 src=192.168.2.70 dst=192.168.178.2 sport=56057 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=56057 mark=0 use=2
tcp      6 1 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29135 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29135 [ASSURED] mark=0 use=2
tcp      6 431990 ESTABLISHED src=192.168.178.40 dst=192.168.2.40 sport=17937 dport=3389 src=192.168.2.40 dst=192.168.178.40 sport=3389 dport=17937 [ASSURED] mark=0 use=2
tcp      6 3 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29145 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29145 [ASSURED] mark=0 use=2
tcp      6 8 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29172 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29172 [ASSURED] mark=0 use=2
tcp      6 84 TIME_WAIT src=192.168.178.58 dst=192.168.2.70 sport=50858 dport=12489 src=192.168.2.70 dst=192.168.178.58 sport=12489 dport=50858 [ASSURED] mark=0 use=2
tcp      6 431980 ESTABLISHED src=192.168.2.40 dst=192.168.178.2 sport=53979 dport=49157 src=192.168.178.2 dst=192.168.2.40 sport=49157 dport=53979 [ASSURED] mark=0 use=2
tcp      6 431770 ESTABLISHED src=192.168.178.40 dst=192.168.2.1 sport=17719 dport=2201 src=192.168.1.100 dst=192.168.178.40 sport=22 dport=17719 [ASSURED] mark=0 use=2
tcp      6 3 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29146 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29146 [ASSURED] mark=0 use=2
tcp      6 1 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29136 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29136 [ASSURED] mark=0 use=2
udp      17 110 src=192.168.2.40 dst=64.4.10.33 sport=123 dport=123 src=64.4.10.33 dst=178.63.18.4 sport=123 dport=123 [ASSURED] mark=0 use=2
tcp      6 2 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29143 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29143 [ASSURED] mark=0 use=2
tcp      6 9 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29178 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29178 [ASSURED] mark=0 use=2
tcp      6 0 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29130 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29130 [ASSURED] mark=0 use=2
udp      17 115 src=178.63.18.4 dst=213.239.239.164 sport=123 dport=123 src=213.239.239.164 dst=178.63.18.4 sport=123 dport=123 [ASSURED] mark=0 use=2
tcp      6 431967 ESTABLISHED src=192.168.2.40 dst=192.168.178.2 sport=53803 dport=49201 src=192.168.178.2 dst=192.168.2.40 sport=49201 dport=53803 [ASSURED] mark=0 use=2
tcp      6 64 TIME_WAIT src=192.168.178.58 dst=192.168.2.40 sport=60998 dport=12489 src=192.168.2.40 dst=192.168.178.58 sport=12489 dport=60998 [ASSURED] mark=0 use=2
tcp      6 9 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29177 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29177 [ASSURED] mark=0 use=2
tcp      6 5 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29155 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29155 [ASSURED] mark=0 use=2
tcp      6 23 TIME_WAIT src=192.168.178.40 dst=192.168.2.70 sport=19056 dport=443 src=192.168.2.70 dst=192.168.178.40 sport=443 dport=19056 [ASSURED] mark=0 use=2
udp      17 130 src=178.63.18.4 dst=213.239.239.166 sport=123 dport=123 src=213.239.239.166 dst=178.63.18.4 sport=123 dport=123 [ASSURED] mark=0 use=2
unknown  50 598 src=91.119.56.143 dst=178.63.18.4 src=178.63.18.4 dst=91.119.56.143 mark=0 use=2
tcp      6 51 TIME_WAIT src=192.168.2.40 dst=192.168.178.2 sport=53965 dport=49157 src=192.168.178.2 dst=192.168.2.40 sport=49157 dport=53965 [ASSURED] mark=0 use=2
tcp      6 37 TIME_WAIT src=192.168.178.58 dst=192.168.2.70 sport=50830 dport=12489 src=192.168.2.70 dst=192.168.178.58 sport=12489 dport=50830 [ASSURED] mark=0 use=2
tcp      6 7 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29166 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29166 [ASSURED] mark=0 use=2
tcp      6 431981 ESTABLISHED src=192.168.178.2 dst=192.168.2.40 sport=61257 dport=49155 src=192.168.2.40 dst=192.168.178.2 sport=49155 dport=61257 [ASSURED] mark=0 use=2
tcp      6 6 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29164 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29164 [ASSURED] mark=0 use=2
tcp      6 2 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29144 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29144 [ASSURED] mark=0 use=2
tcp      6 2 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29137 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29137 [ASSURED] mark=0 use=2
tcp      6 9 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29175 dport=3268 src=192.168.178.2 dst=192.168.2.70 sport=3268 dport=29175 [ASSURED] mark=0 use=2
tcp      6 89 TIME_WAIT src=192.168.2.70 dst=192.168.178.2 sport=28753 dport=49157 src=192.168.178.2 dst=192.168.2.70 sport=49157 dport=28753 [ASSURED] mark=0 use=2
tcp      6 4 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29149 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29149 [ASSURED] mark=0 use=2
tcp      6 6 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29163 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29163 [ASSURED] mark=0 use=2
tcp      6 32 TIME_WAIT src=192.168.178.40 dst=192.168.2.70 sport=18937 dport=443 src=192.168.2.70 dst=192.168.178.40 sport=443 dport=18937 [ASSURED] mark=0 use=2
tcp      6 431978 ESTABLISHED src=192.168.1.66 dst=178.33.33.123 sport=43076 dport=6667 src=178.33.33.123 dst=178.63.18.4 sport=6667 dport=43076 [ASSURED] mark=0 use=2
unknown  4 599 src=91.119.56.143 dst=178.63.18.4 [UNREPLIED] src=178.63.18.4 dst=91.119.56.143 mark=0 use=2
tcp      6 0 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29129 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29129 [ASSURED] mark=0 use=2
tcp      6 431914 ESTABLISHED src=192.168.178.40 dst=192.168.2.70 sport=19079 dport=443 src=192.168.2.70 dst=192.168.178.40 sport=443 dport=19079 [ASSURED] mark=0 use=2
tcp      6 15 TIME_WAIT src=192.168.2.40 dst=192.168.178.2 sport=53973 dport=49201 src=192.168.178.2 dst=192.168.2.40 sport=49201 dport=53973 [ASSURED] mark=0 use=2
unknown  2 524 src=192.168.1.1 dst=224.0.0.251 [UNREPLIED] src=224.0.0.251 dst=192.168.1.1 mark=0 use=2
udp      17 134 src=178.63.18.4 dst=213.239.239.165 sport=123 dport=123 src=213.239.239.165 dst=178.63.18.4 sport=123 dport=123 [ASSURED] mark=0 use=2
tcp      6 16 TIME_WAIT src=192.168.178.58 dst=192.168.2.70 sport=50824 dport=12489 src=192.168.2.70 dst=192.168.178.58 sport=12489 dport=50824 [ASSURED] mark=0 use=2
tcp      6 431990 ESTABLISHED src=192.168.1.66 dst=178.33.33.123 sport=34736 dport=6667 src=178.33.33.123 dst=178.63.18.4 sport=6667 dport=34736 [ASSURED] mark=0 use=2
tcp      6 106 TIME_WAIT src=192.168.178.2 dst=192.168.2.40 sport=61249 dport=49155 src=192.168.2.40 dst=192.168.178.2 sport=49155 dport=61249 [ASSURED] mark=0 use=2
tcp      6 4 CLOSE src=192.168.2.70 dst=192.168.178.2 sport=29151 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=29151 [ASSURED] mark=0 use=2
tcp      6 30 TIME_WAIT src=91.119.56.143 dst=178.63.18.4 sport=19067 dport=80 src=192.168.1.100 dst=91.119.56.143 sport=80 dport=19067 [ASSURED] mark=0 use=2
icmp     1 29 src=91.119.56.143 dst=178.63.18.4 type=8 code=0 id=2 src=178.63.18.4 dst=91.119.56.143 type=0 code=0 id=2 mark=0 use=2
tcp      6 431999 ESTABLISHED src=192.168.2.70 dst=192.168.178.2 sport=21707 dport=389 src=192.168.178.2 dst=192.168.2.70 sport=389 dport=21707 [ASSURED] mark=0 use=2
unknown  2 522 src=0.0.0.0 dst=224.0.0.1 [UNREPLIED] src=224.0.0.1 dst=0.0.0.0 mark=0 use=2

IP Configuration

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    inet 127.0.0.1/8 scope host lo
3: xenbrE: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    inet 178.63.18.4/26 brd 178.63.18.63 scope global xenbrE
4: xenbrD: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    inet 192.168.1.1/24 brd 192.168.1.255 scope global xenbrD
5: xenbrI: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    inet 192.168.2.1/24 brd 192.168.2.255 scope global xenbrI

IP Stats

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN mode DEFAULT 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    RX: bytes  packets  errors  dropped overrun mcast   
    0          0        0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    0          0        0       0       0       0      
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master xenbrE state UP mode DEFAULT qlen 1000
    link/ether c8:60:00:be:45:7a brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    18358007   49309    0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    17728798   49834    0       0       0       0      
3: xenbrE: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT 
    link/ether c8:60:00:be:45:7a brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    17612115   48391    0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    17731645   49860    0       0       0       0      
4: xenbrD: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT 
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    1044467    1953     0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    407118     2295     0       0       0       0      
5: xenbrI: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT 
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    11944108   40900    0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    14944560   46939    0       0       0       0      
6: vif-dmz-db: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master xenbrD state UP mode DEFAULT qlen 32
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    862370     5412     0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    888497     6014     0       0       0       0      
7: vif-dmz-irc: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master xenbrD state UP mode DEFAULT qlen 32
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    53279      612      0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    152463     958      0       0       0       0      
8: vif-int-win_dc: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast master xenbrI state UNKNOWN mode DEFAULT qlen 32
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    0          0        0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    0          0        0       0       0       0      
9: vif3.0-emu: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master xenbrI state UNKNOWN mode DEFAULT qlen 500
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    497147     2110     0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    849969     2891     0       0       0       0      
10: vif-int-win_ex: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast master xenbrI state UNKNOWN mode DEFAULT qlen 32
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    0          0        0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    0          0        0       0       0       0      
11: vif4.0-emu: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master xenbrI state UNKNOWN mode DEFAULT qlen 500
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    12636071   46574    0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    14142087   44578    0       0       0       0      
12: vif-dmz-www: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master xenbrD state UP mode DEFAULT qlen 32
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    1767623    7022     0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    1231595    7128     0       0       0       0      

Bridges

bridge name	bridge id		STP enabled	interfaces
xenbrD		8000.feffffffffff	no		vif-dmz-db
							vif-dmz-irc
							vif-dmz-www
xenbrE		8000.c86000be457a	no		eth0
xenbrI		8000.feffffffffff	no		vif-int-win_dc
							vif-int-win_ex
							vif3.0-emu
							vif4.0-emu

Per-IP Counters

   iptaccount is not installed

PFKEY SPD

192.168.2.0/24[any] 192.168.178.0/24[any] 255
	out prio high + 1073739965 ipsec
	ipcomp/tunnel/178.63.18.4-91.119.56.143/unique#16384
	esp/transport//unique#16384
	created: Sep  8 20:54:13 2013  lastused: Sep  8 21:25:10 2013
	lifetime: 0(s) validtime: 0(s)
	spid=193 seq=1 pid=6887
	refcnt=227
192.168.178.0/24[any] 192.168.2.0/24[any] 255
	fwd prio high + 1073739965 ipsec
	ipcomp/tunnel/91.119.56.143-178.63.18.4/use#16384
	esp/transport//unique#16384
	created: Sep  8 20:54:13 2013  lastused: Sep  8 21:25:10 2013
	lifetime: 0(s) validtime: 0(s)
	spid=186 seq=2 pid=6887
	refcnt=234
192.168.178.0/24[any] 192.168.2.0/24[any] 255
	in prio high + 1073739965 ipsec
	ipcomp/tunnel/91.119.56.143-178.63.18.4/use#16384
	esp/transport//unique#16384
	created: Sep  8 20:54:13 2013  lastused: Sep  8 21:25:10 2013
	lifetime: 0(s) validtime: 0(s)
	spid=176 seq=3 pid=6887
	refcnt=2
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=172 seq=4 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=163 seq=5 pid=6887
	refcnt=1
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=156 seq=6 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=147 seq=7 pid=6887
	refcnt=1
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused: Sep  8 20:54:12 2013
	lifetime: 0(s) validtime: 0(s)
	spid=140 seq=8 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused: Sep  8 20:54:13 2013
	lifetime: 0(s) validtime: 0(s)
	spid=131 seq=9 pid=6887
	refcnt=1
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=124 seq=10 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=115 seq=11 pid=6887
	refcnt=1
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=108 seq=12 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=99 seq=13 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=91 seq=14 pid=6887
	refcnt=1
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=84 seq=15 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=75 seq=16 pid=6887
	refcnt=1
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=68 seq=17 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused: Sep  8 21:08:16 2013
	lifetime: 0(s) validtime: 0(s)
	spid=59 seq=18 pid=6887
	refcnt=1
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=52 seq=19 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=43 seq=20 pid=6887
	refcnt=1
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=36 seq=21 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=27 seq=22 pid=6887
	refcnt=1
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=20 seq=23 pid=6887
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Sep  8 20:54:11 2013  lastused: Sep  8 21:24:25 2013
	lifetime: 0(s) validtime: 0(s)
	spid=11 seq=24 pid=6887
	refcnt=1
(per-socket policy) 
	out(socket) none
	created: Sep  8 20:54:11 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=4 seq=0 pid=6887
	refcnt=1

PFKEY SAD

178.63.18.4 91.119.56.143 
	esp mode=transport spi=3397411215(0xca80618f) reqid=16384(0x00004000)
	seq=0x00000000 replay=32 flags=0x00000000 state=mature 
	created: Sep  8 20:54:13 2013	current: Sep  8 21:25:10 2013
	diff: 1857(s)	hard: 0(s)	soft: 0(s)
	last: Sep  8 20:54:13 2013	hard: 0(s)	soft: 0(s)
	current: 12923676(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 45263	hard: 0	soft: 0
	sadb_seq=1 pid=6888 refcnt=0
178.63.18.4 91.119.56.143 
	ipcomp mode=tunnel spi=14280(0x000037c8) reqid=16384(0x00004000)
	C: deflate 	seq=0x00000000 replay=0 flags=0x00000000 state=mature 
	created: Sep  8 20:54:13 2013	current: Sep  8 21:25:10 2013
	diff: 1857(s)	hard: 0(s)	soft: 0(s)
	last: Sep  8 20:54:13 2013	hard: 0(s)	soft: 0(s)
	current: 12982069(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 45263	hard: 0	soft: 0
	sadb_seq=2 pid=6888 refcnt=0
91.119.56.143 178.63.18.4 
	esp mode=transport spi=3413347375(0xcb738c2f) reqid=16384(0x00004000)
	seq=0x00000000 replay=32 flags=0x00000000 state=mature 
	created: Sep  8 20:54:12 2013	current: Sep  8 21:25:10 2013
	diff: 1858(s)	hard: 0(s)	soft: 0(s)
	last: Sep  8 20:54:13 2013	hard: 0(s)	soft: 0(s)
	current: 14301382(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 44466	hard: 0	soft: 0
	sadb_seq=3 pid=6888 refcnt=0
91.119.56.143 178.63.18.4 
	ipcomp mode=tunnel spi=12779(0x000031eb) reqid=16384(0x00004000)
	C: deflate 	seq=0x00000000 replay=0 flags=0x00000000 state=mature 
	created: Sep  8 20:54:12 2013	current: Sep  8 21:25:10 2013
	diff: 1858(s)	hard: 0(s)	soft: 0(s)
	last: Sep  8 20:54:13 2013	hard: 0(s)	soft: 0(s)
	current: 309080(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 626	hard: 0	soft: 0
	sadb_seq=0 pid=6888 refcnt=0

/proc

   /proc/version = Linux version 3.2.0-4-amd64 (debian-kernel@lists.debian.org) (gcc version 4.6.3 (Debian 4.6.3-14) ) #1 SMP Debian 3.2.46-1+deb7u1
   /proc/sys/net/ipv4/ip_forward = 1
   /proc/sys/net/ipv4/icmp_echo_ignore_all = 0
   /proc/sys/net/ipv4/conf/all/proxy_arp = 0
   /proc/sys/net/ipv4/conf/all/arp_filter = 0
   /proc/sys/net/ipv4/conf/all/arp_ignore = 0
   /proc/sys/net/ipv4/conf/all/rp_filter = 1
   /proc/sys/net/ipv4/conf/all/log_martians = 0
   /proc/sys/net/ipv4/conf/default/proxy_arp = 1
   /proc/sys/net/ipv4/conf/default/arp_filter = 0
   /proc/sys/net/ipv4/conf/default/arp_ignore = 0
   /proc/sys/net/ipv4/conf/default/rp_filter = 1
   /proc/sys/net/ipv4/conf/default/log_martians = 1
   /proc/sys/net/ipv4/conf/eth0/proxy_arp = 1
   /proc/sys/net/ipv4/conf/eth0/arp_filter = 0
   /proc/sys/net/ipv4/conf/eth0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/eth0/rp_filter = 1
   /proc/sys/net/ipv4/conf/eth0/log_martians = 1
   /proc/sys/net/ipv4/conf/lo/proxy_arp = 1
   /proc/sys/net/ipv4/conf/lo/arp_filter = 0
   /proc/sys/net/ipv4/conf/lo/arp_ignore = 0
   /proc/sys/net/ipv4/conf/lo/rp_filter = 1
   /proc/sys/net/ipv4/conf/lo/log_martians = 1
   /proc/sys/net/ipv4/conf/vif-dmz-db/proxy_arp = 1
   /proc/sys/net/ipv4/conf/vif-dmz-db/arp_filter = 0
   /proc/sys/net/ipv4/conf/vif-dmz-db/arp_ignore = 0
   /proc/sys/net/ipv4/conf/vif-dmz-db/rp_filter = 1
   /proc/sys/net/ipv4/conf/vif-dmz-db/log_martians = 1
   /proc/sys/net/ipv4/conf/vif-dmz-irc/proxy_arp = 1
   /proc/sys/net/ipv4/conf/vif-dmz-irc/arp_filter = 0
   /proc/sys/net/ipv4/conf/vif-dmz-irc/arp_ignore = 0
   /proc/sys/net/ipv4/conf/vif-dmz-irc/rp_filter = 1
   /proc/sys/net/ipv4/conf/vif-dmz-irc/log_martians = 1
   /proc/sys/net/ipv4/conf/vif-dmz-www/proxy_arp = 1
   /proc/sys/net/ipv4/conf/vif-dmz-www/arp_filter = 0
   /proc/sys/net/ipv4/conf/vif-dmz-www/arp_ignore = 0
   /proc/sys/net/ipv4/conf/vif-dmz-www/rp_filter = 1
   /proc/sys/net/ipv4/conf/vif-dmz-www/log_martians = 1
   /proc/sys/net/ipv4/conf/vif-int-win_dc/proxy_arp = 1
   /proc/sys/net/ipv4/conf/vif-int-win_dc/arp_filter = 0
   /proc/sys/net/ipv4/conf/vif-int-win_dc/arp_ignore = 0
   /proc/sys/net/ipv4/conf/vif-int-win_dc/rp_filter = 1
   /proc/sys/net/ipv4/conf/vif-int-win_dc/log_martians = 1
   /proc/sys/net/ipv4/conf/vif-int-win_ex/proxy_arp = 1
   /proc/sys/net/ipv4/conf/vif-int-win_ex/arp_filter = 0
   /proc/sys/net/ipv4/conf/vif-int-win_ex/arp_ignore = 0
   /proc/sys/net/ipv4/conf/vif-int-win_ex/rp_filter = 1
   /proc/sys/net/ipv4/conf/vif-int-win_ex/log_martians = 1
   /proc/sys/net/ipv4/conf/vif3.0-emu/proxy_arp = 1
   /proc/sys/net/ipv4/conf/vif3.0-emu/arp_filter = 0
   /proc/sys/net/ipv4/conf/vif3.0-emu/arp_ignore = 0
   /proc/sys/net/ipv4/conf/vif3.0-emu/rp_filter = 1
   /proc/sys/net/ipv4/conf/vif3.0-emu/log_martians = 1
   /proc/sys/net/ipv4/conf/vif4.0-emu/proxy_arp = 1
   /proc/sys/net/ipv4/conf/vif4.0-emu/arp_filter = 0
   /proc/sys/net/ipv4/conf/vif4.0-emu/arp_ignore = 0
   /proc/sys/net/ipv4/conf/vif4.0-emu/rp_filter = 1
   /proc/sys/net/ipv4/conf/vif4.0-emu/log_martians = 1
   /proc/sys/net/ipv4/conf/xenbrD/proxy_arp = 1
   /proc/sys/net/ipv4/conf/xenbrD/arp_filter = 0
   /proc/sys/net/ipv4/conf/xenbrD/arp_ignore = 0
   /proc/sys/net/ipv4/conf/xenbrD/rp_filter = 1
   /proc/sys/net/ipv4/conf/xenbrD/log_martians = 1
   /proc/sys/net/ipv4/conf/xenbrE/proxy_arp = 1
   /proc/sys/net/ipv4/conf/xenbrE/arp_filter = 0
   /proc/sys/net/ipv4/conf/xenbrE/arp_ignore = 0
   /proc/sys/net/ipv4/conf/xenbrE/rp_filter = 1
   /proc/sys/net/ipv4/conf/xenbrE/log_martians = 1
   /proc/sys/net/ipv4/conf/xenbrI/proxy_arp = 1
   /proc/sys/net/ipv4/conf/xenbrI/arp_filter = 0
   /proc/sys/net/ipv4/conf/xenbrI/arp_ignore = 0
   /proc/sys/net/ipv4/conf/xenbrI/rp_filter = 1
   /proc/sys/net/ipv4/conf/xenbrI/log_martians = 1

Routing Rules

0:	from all lookup local 
220:	from all lookup 220 
220:	from all lookup 220 
32766:	from all lookup main 
32767:	from all lookup default 

Table 220:


Table default:


Table local:

local 192.168.2.1 dev xenbrI proto kernel scope host src 192.168.2.1
local 192.168.1.1 dev xenbrD proto kernel scope host src 192.168.1.1
local 178.63.18.4 dev xenbrE proto kernel scope host src 178.63.18.4
local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1
local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1
broadcast 192.168.2.255 dev xenbrI proto kernel scope link src 192.168.2.1
broadcast 192.168.2.0 dev xenbrI proto kernel scope link src 192.168.2.1
broadcast 192.168.1.255 dev xenbrD proto kernel scope link src 192.168.1.1
broadcast 192.168.1.0 dev xenbrD proto kernel scope link src 192.168.1.1
broadcast 178.63.18.63 dev xenbrE proto kernel scope link src 178.63.18.4
broadcast 178.63.18.0 dev xenbrE proto kernel scope link src 178.63.18.4
broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1
broadcast 127.0.0.0 dev lo proto kernel scope link src 127.0.0.1

Table main:

178.63.18.40 via 178.63.18.40 dev xenbrE
178.63.18.0/26 dev xenbrE proto kernel scope link src 178.63.18.4
192.168.2.0/24 dev xenbrI proto kernel scope link src 192.168.2.1
192.168.1.0/24 dev xenbrD proto kernel scope link src 192.168.1.1
default via 178.63.18.1 dev xenbrE

ARP

? (192.168.1.66) at 00:16:3e:9a:8c:3a [ether] on xenbrD
? (192.168.2.70) at 00:16:3e:27:93:02 [ether] on xenbrI
? (178.63.18.1) at 00:26:88:76:30:9e [ether] on xenbrE
? (192.168.2.40) at 00:16:3e:31:d9:e5 [ether] on xenbrI
? (192.168.1.100) at 00:16:3e:3f:cd:0b [ether] on xenbrD

Modules

ip_set                 26649  1 xt_set
iptable_filter         12536  1 
iptable_mangle         12536  1 
iptable_nat            12928  1 
iptable_raw            12524  0 
ip_tables              22042  4 iptable_filter,iptable_mangle,iptable_nat,iptable_raw
ipt_ah                 12453  0 
ipt_CLUSTERIP          13045  0 
ipt_ecn                12456  0 
ipt_ECN                12456  0 
ipt_LOG                12605  9 
ipt_MASQUERADE         12594  2 
ipt_NETMAP             12465  0 
ipt_REDIRECT           12471  0 
ipt_REJECT             12502  4 
ipt_ULOG               16833  0 
nf_conntrack           52720  34 nf_conntrack_ipv4,nf_nat,iptable_nat,xt_state,xt_connmark,xt_conntrack,xt_helper,nf_conntrack_ftp,nf_conntrack_h323,nf_conntrack_irc,nf_conntrack_broadcast,nf_conntrack_netbios_ns,nf_conntrack_netlink,nf_conntrack_proto_gre,nf_conntrack_pptp,nf_conntrack_proto_sctp,nf_conntrack_proto_udplite,nf_conntrack_sip,nf_conntrack_tftp,nf_conntrack_sane,nf_conntrack_amanda,nf_nat_amanda,nf_nat_ftp,nf_nat_h323,nf_nat_irc,nf_nat_pptp,nf_nat_sip,nf_conntrack_snmp,nf_nat_snmp_basic,nf_nat_tftp,ipt_CLUSTERIP,ipt_MASQUERADE,xt_connlimit,xt_CT
nf_conntrack_amanda    12437  1 nf_nat_amanda
nf_conntrack_broadcast    12365  2 nf_conntrack_netbios_ns,nf_conntrack_snmp
nf_conntrack_ftp       12605  1 nf_nat_ftp
nf_conntrack_h323      42413  1 nf_nat_h323
nf_conntrack_ipv4      14078  52 nf_nat,iptable_nat
nf_conntrack_irc       12427  1 nf_nat_irc
nf_conntrack_netbios_ns    12445  0 
nf_conntrack_netlink    23101  0 
nf_conntrack_pptp      12769  1 nf_nat_pptp
nf_conntrack_proto_gre    12974  1 nf_conntrack_pptp
nf_conntrack_proto_sctp    12941  0 
nf_conntrack_proto_udplite    12655  0 
nf_conntrack_sane      12428  0 
nf_conntrack_sip       26054  1 nf_nat_sip
nf_conntrack_snmp      12443  1 nf_nat_snmp_basic
nf_conntrack_tftp      12433  1 nf_nat_tftp
nf_defrag_ipv4         12483  2 nf_conntrack_ipv4,xt_TPROXY
nf_defrag_ipv6         12832  1 xt_TPROXY
nf_nat                 18242  12 iptable_nat,nf_nat_amanda,nf_nat_ftp,nf_nat_h323,nf_nat_irc,nf_nat_proto_gre,nf_nat_pptp,nf_nat_sip,nf_nat_tftp,ipt_MASQUERADE,ipt_NETMAP,ipt_REDIRECT
nf_nat_amanda          12424  0 
nf_nat_ftp             12460  0 
nf_nat_h323            12918  0 
nf_nat_irc             12454  0 
nf_nat_pptp            12603  0 
nf_nat_proto_gre       12517  1 nf_nat_pptp
nf_nat_sip             12923  0 
nf_nat_snmp_basic      16995  0 
nf_nat_tftp            12422  0 
nf_tproxy_core         12404  1 xt_TPROXY
xt_addrtype            12557  4 
xt_AUDIT               12646  0 
xt_CLASSIFY            12429  0 
xt_comment             12427  18 
xt_connlimit           12622  0 
xt_connmark            12698  0 
xt_conntrack           12681  49 
xt_CT                  12507  0 
xt_dccp                12498  0 
xt_dscp                12523  0 
xt_DSCP                12643  0 
xt_hashlimit           13172  0 
xt_helper              12507  0 
xt_iprange             12504  0 
xt_length              12460  0 
xt_limit               12638  0 
xt_mac                 12419  0 
xt_mark                12453  1 
xt_multiport           12548  4 
xt_NFLOG               12462  0 
xt_NFQUEUE             12544  0 
xt_owner               12423  0 
xt_physdev             12468  0 
xt_pkttype             12427  0 
xt_policy              12506  45 
xt_realm               12423  0 
xt_recent              13188  0 
xt_set                 12989  0 
xt_state               12503  0 
xt_statistic           12519  0 
xt_tcpmss              12425  0 
xt_tcpudp              12570  39 
xt_time                12459  0 
xt_TPROXY              12907  0 

Shorewall has detected the following iptables/netfilter capabilities:
   NAT (NAT_ENABLED): Available
   Packet Mangling (MANGLE_ENABLED): Available
   Multi-port Match (MULTIPORT): Available
   Extended Multi-port Match (XMULIPORT): Available
   Connection Tracking Match (CONNTRACK_MATCH): Available
   Extended Connection Tracking Match Support (NEW_CONNTRACK_MATCH): Available
   Packet Type Match (USEPKTTYPE): Available
   Policy Match (POLICY_MATCH): Available
   Physdev Match (PHYSDEV_MATCH): Available
   Physdev-is-bridged Support (PHYSDEV_BRIDGE): Available
   Packet length Match (LENGTH_MATCH): Available
   IP range Match(IPRANGE_MATCH): Available
   Recent Match (RECENT_MATCH): Available
   Owner Match (OWNER_MATCH): Available
   Owner Name Match (OWNER_NAME_MATCH): Available
   CONNMARK Target (CONNMARK): Available
   Extended CONNMARK Target (XCONNMARK): Available
   Connmark Match (CONNMARK_MATCH): Available
   Extended Connmark Match (XCONNMARK_MATCH): Available
   Raw Table (RAW_TABLE): Available
   Rawpost Table (RAWPOST_TABLE): Not available
   IPP2P Match (IPP2P_MATCH): Not available
   CLASSIFY Target (CLASSIFY_TARGET): Available
   Extended REJECT (ENHANCED_REJECT): Available
   Repeat match (KLUDGEFREE): Available
   MARK Target (MARK): Available
   Extended MARK Target (XMARK): Available
   Extended MARK Target 2 (EXMARK): Available
   Mangle FORWARD Chain (MANGLE_FORWARD): Available
   Comments (COMMENTS): Available
   Address Type Match (ADDRTYPE): Available
   TCPMSS Match (TCPMSS_MATCH): Available
   Hashlimit Match (HASHLIMIT_MATCH): Available
   NFQUEUE Target (NFQUEUE_TARGET): Available
   Realm Match (REALM_MATCH): Available
   Helper Match (HELPER_MATCH): Available
   Connlimit Match (CONNLIMIT_MATCH): Available
   Time Match (TIME_MATCH): Available
   Goto Support (GOTO_TARGET): Available
   LOGMARK Target (LOGMARK_TARGET): Not available
   IPMARK Target (IPMARK_TARGET): Not available
   LOG Target (LOG_TARGET): Available
   ULOG Target (ULOG_TARGET): Available
   NFLOG Target (NFLOG_TARGET): Available
   Persistent SNAT (PERSISTENT_SNAT): Available
   TPROXY Target (TPROXY_TARGET): Available
   FLOW Classifier (FLOW_FILTER): Available
   fwmark route mask (FWMARK_RT_MASK): Available
   Mark in any table (MARK_ANYWHERE): Available
   Header Match (HEADER_MATCH): Not available
   ACCOUNT Target (ACCOUNT_TARGET): Not available
   AUDIT Target (AUDIT_TARGET): Available
   ipset V5 (IPSET_V5): Not available
   Condition Match (CONDITION_MATCH): Not available
   Statistic Match (STATISTIC_MATCH): Available
   IMQ Target (IMQ_TARGET): Not available
   DSCP Match (DSCP_MATCH): Available
   DSCP Target (DSCP_TARGET): Available
   Geo IP match: Not available
   iptables -S (IPTABLES_S): Available
   Basic Filter (BASIC_FILTER): Available
   CT Target (CT_TARGET): Available

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:5900          0.0.0.0:*               LISTEN      4643/qemu-dm    
tcp        0      0 127.0.0.1:5902          0.0.0.0:*               LISTEN      5298/qemu-dm    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      3477/sshd       
tcp        0      0 192.168.2.1:22          192.168.178.40:18063    ESTABLISHED 5798/sshd: philipp 
tcp        0      0 178.63.18.4:22          91.119.56.143:17698     ESTABLISHED 5296/sshd: philipp 
tcp        0      0 192.168.2.1:22          192.168.178.40:17650    ESTABLISHED 3730/sshd: philipp 
udp        0      0 0.0.0.0:4500            0.0.0.0:*                           3423/charon     
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           3503/avahi-daemon: 
udp        0      0 0.0.0.0:68              0.0.0.0:*                           3423/charon     
udp        0      0 192.168.2.1:123         0.0.0.0:*                           4044/ntpd       
udp        0      0 192.168.1.1:123         0.0.0.0:*                           4044/ntpd       
udp        0      0 178.63.18.4:123         0.0.0.0:*                           4044/ntpd       
udp        0      0 127.0.0.1:123           0.0.0.0:*                           4044/ntpd       
udp        0      0 0.0.0.0:123             0.0.0.0:*                           4044/ntpd       
udp        0      0 127.0.0.1:500           0.0.0.0:*                           3341/pluto      
udp        0      0 178.63.18.4:500         0.0.0.0:*                           3341/pluto      
udp        0      0 192.168.1.1:500         0.0.0.0:*                           3341/pluto      
udp        0      0 192.168.2.1:500         0.0.0.0:*                           3341/pluto      
udp        0      0 0.0.0.0:500             0.0.0.0:*                           3423/charon     
udp        0      0 0.0.0.0:34249           0.0.0.0:*                           3503/avahi-daemon: 

Traffic Control

Device eth0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 17780159 bytes 49980 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device vif-dmz-db:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 889692 bytes 6026 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device vif-dmz-irc:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 153851 bytes 971 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device vif-int-win_dc:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device vif3.0-emu:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 852041 bytes 2909 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device vif-int-win_ex:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device vif4.0-emu:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 14186778 bytes 44730 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device vif-dmz-www:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 1232790 bytes 7139 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 



TC Filters

Device eth0:

Device vif-dmz-db:

Device vif-dmz-irc:

Device vif-int-win_dc:

Device vif3.0-emu:

Device vif-int-win_ex:

Device vif4.0-emu:

Device vif-dmz-www:

