/etc/mason.baserules is in mason 1.0.0-12.3.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 | ##!/bin/sh
##=============================================================================
## Example of a mason firewall script
##=============================================================================
#
## ---------------------------------------------------------------------
## Allow all local connections
## ---------------------------------------------------------------------
#/sbin/iptables -A INPUT -i lo -j ACCEPT
#/sbin/iptables -A OUTPUT -o lo -j ACCEPT
#
## ---------------------------------------------------------------------
## Allow ESTABLISHED and RELATED packets globally, to drastically reduce
## the number of reported rules in learning mode
## ---------------------------------------------------------------------
## Hint: "There is a certain feature in iptables that is not so well
## documented and may therefore be overlooked by a lot of people [...]
## If you use state NEW, packets with the SYN bit unset will get through
## your firewall." Cited from:
## http://iptables-tutorial.frozentux.net/iptables-tutorial.html#NEWNOTSYN
## ---------------------------------------------------------------------
#/sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
#/sbin/iptables -A INPUT -m state --state RELATED -j ACCEPT
#/sbin/iptables -A INPUT -m state --state INVALID -j DROP
#
#/sbin/iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
#/sbin/iptables -A OUTPUT -m state --state RELATED -j ACCEPT
#/sbin/iptables -A OUTPUT -m state --state INVALID -j DROP
#
## ---------------------------------------------------------------------
## Drop all new new tcp-connections without a sys-flag
## ---------------------------------------------------------------------
## Info: "There is a certain feature in iptables that is not so well
## documented and may therefore be overlooked by a lot of people [...]
## If you use state NEW, packets with the SYN bit unset will get through
## your firewall." Cited from:
## http://iptables-tutorial.frozentux.net/iptables-tutorial.html#NEWNOTSYN
## ---------------------------------------------------------------------
#/sbin/iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
#/sbin/iptables -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
#
## ---------------------------------------------------------------------
## Allowed connections
## ---------------------------------------------------------------------
#
|