asternic Nicolás,
Definitivamente creo que las reglas no se están aplicando bien porque en /var/log/messages veo intentos de conexión al servidor TFTP que está bloqueado para todos menos mis IPs así como el mismísimo http o https.
EL resultado de correr iptables -vnL en uno de mis Elastix atacados es:
Chain INPUT (policy ACCEPT 148K packets, 107M bytes)
pkts bytes target prot opt in out source destination
18 840 f2b-vsftpd tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 21
11378 885K f2b-ssh tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 45622
26353 2717K f2b-https tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
6060 3205K f2b-asterisk udp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 5060
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 112K packets, 21M bytes)
pkts bytes target prot opt in out source destination
Chain f2b-asterisk (1 references)
pkts bytes target prot opt in out source destination
12 8924 REJECT all -- 146.0.32.94 0.0.0.0/0 reject-with icmp-port-unreachable
1229 786K REJECT all -- 154.16.126.40 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 95.154.217.168 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 95.110.232.224 0.0.0.0/0 reject-with icmp-port-unreachable
28 21757 REJECT all -- 92.114.32.74 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 89.163.146.72 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 89.163.146.243 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 89.163.144.189 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 87.106.16.49 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 82.165.97.126 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 62.210.181.99 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 62.210.181.161 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 62.210.143.74 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 51.15.71.197 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 51.15.146.174 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 5.152.215.58 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 5.104.111.244 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 5.104.105.102 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 45.61.34.247 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 45.243.58.167 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 37.8.37.27 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 35.184.220.231 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 31.6.23.109 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 23.239.70.162 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 23.239.69.227 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 23.239.66.123 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 213.202.233.77 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 213.202.233.200 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 212.83.168.81 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 212.47.247.54 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 212.129.47.132 0.0.0.0/0 reject-with icmp-port-unreachable
29 16511 REJECT all -- 209.126.117.58 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 209.126.116.166 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 195.154.214.162 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 185.111.228.246 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 185.111.228.158 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 163.172.4.70 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 163.172.121.136 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 139.196.15.87 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- 104.143.31.104 0.0.0.0/0 reject-with icmp-port-unreachable
4762 2371K RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain f2b-https (1 references)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- 95.141.35.112 0.0.0.0/0 reject-with icmp-port-unreachable
26353 2717K RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain f2b-ssh (1 references)
pkts bytes target prot opt in out source destination
11378 885K RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain f2b-vsftpd (1 references)
pkts bytes target prot opt in out source destination
18 840 RETURN all -- 0.0.0.0/0 0.0.0.0/0