*filter
:SCHOOL -

# Povolime set pojitek
-A SCHOOL -m set --match-set school-link dst -j RETURN
-A SCHOOL -m set --match-set school-kg-link dst -j RETURN

# Povolime serverovnu
#-A SCHOOL -p tcp --dport 80 -j REJECT
-A SCHOOL -p tcp -d 172.25.17.2 --dport 80 -j REJECT
-A SCHOOL -s 10.102.222.0/23 -j RETURN
-A SCHOOL -s 10.102.28.4/32 -j RETURN
-A SCHOOL -s 10.102.0.248/29 -j RETURN

# Povolime vlastni skolni sit
-A SCHOOL -s 172.24.0.0/15 -j RETURN

# A cele 10/8 pujde k certu
-A SCHOOL -s 10.0.0.0/8 -j DROP

# Navazani na forward chain
-A FORWARD -d 172.24.0.0/15 -j SCHOOL

-I CONNLIMIT-ABUSE 1 -s 172.24.0.0/15 -j RETURN

COMMIT

