root@sysadmin:~# service firewall start
Starting firewall...
Firewall: Purging and allowing all traffic...success
Firewall: Setting default policies to DROP...success
Firewall: Allowing access to HN
port 53...success
port 80...success
port 443...success
port 8080...success
DMZ 12.34.56.78...success
DMZ $ExtIp...success
DMZ 127.0.0.1...success
DMZ localhost...success

root@sysadmin:~# service firewall status
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 127.0.0.1 0.0.0.0/0
ACCEPT all -- 127.0.0.1 0.0.0.0/0
ACCEPT all -- $ExtIp 0.0.0.0/0
ACCEPT all -- 12.34.56.78 0.0.0.0/0
ACCEPT udp -- 192.168.0.0/24 $ExtIp udp dpt:8080
ACCEPT tcp -- 192.168.0.0/24 $ExtIp tcp dpt:8080
ACCEPT udp -- 192.168.0.0/24 $ExtIp udp dpt:443
ACCEPT tcp -- 192.168.0.0/24 $ExtIp tcp dpt:443
ACCEPT udp -- 192.168.0.0/24 $ExtIp udp dpt:80
ACCEPT tcp -- 192.168.0.0/24 $ExtIp tcp dpt:80
ACCEPT udp -- 192.168.0.0/24 $ExtIp udp dpt:53
ACCEPT tcp -- 192.168.0.0/24 $ExtIp tcp dpt:53
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- 127.0.0.1 0.0.0.0/0
ACCEPT all -- 127.0.0.1 0.0.0.0/0
ACCEPT all -- $ExtIp 0.0.0.0/0
ACCEPT all -- 12.34.56.78 0.0.0.0/0
ACCEPT all -- 192.168.0.0/24 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

#
# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additional system variables.
# See sysctl.conf (5) for information.
#

#kernel.domainname = example.com

# Uncomment the following to stop low-level messages on console
#kernel.printk = 4 4 1 7

##############################################################3
# Functions previously found in netbase
#

# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
#net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1

# Uncomment the next line to enable TCP/IP SYN cookies
#net.ipv4.tcp_syncookies=1

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

# Uncomment the next line to enable packet forwarding for IPv6
#net.ipv6.conf.all.forwarding=1


###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Ignore ICMP broadcasts
#net.ipv4.icmp_echo_ignore_broadcasts = 1
#
# Ignore bogus ICMP errors
#net.ipv4.icmp_ignore_bogus_error_responses = 1
#
# Do not accept ICMP redirects (prevent MITM attacks)
#net.ipv4.conf.all.accept_redirects = 0
#net.ipv6.conf.all.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
# net.ipv4.conf.all.secure_redirects = 1
#
# Do not send ICMP redirects (we are not a router)
net.ipv4.conf.all.send_redirects = 0
#
# Do not accept IP source route packets (we are not a router)
#net.ipv4.conf.all.accept_source_route = 0
#net.ipv6.conf.all.accept_source_route = 0
#
# Log Martian Packets
#net.ipv4.conf.all.log_martians = 1

#####################################
### Hetzner Online AG installimage
# sysctl config

net.ipv4.conf.default.forwarding=1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.all.forwarding=1

# Enables source route verification
net.ipv4.conf.all.rp_filter = 1

# Enables the magic-sysrq key
kernel.sysrq = 1

# TCP Explict Congestion Notification
#net.ipv4.tcp_ecn = 0

# we do not want all our interfaces to send redirects
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0
########################################

vm.swappiness = 20
vm.dirty_writeback_centisecs = 15000
########################################