firewall记录

1 windows:

rem 只针对win2003以上系统

rem 关闭135、445端口：
sc config srv start= disabled   
sc config netbt start= disabled
 
net start mpssvc
sc config mpssvc start= auto
netsh advfirewall set allprofile state on
netsh advfirewall firewall add rule name=TCP135 dir=in action=block protocol=TCP localport=135
netsh advfirewall firewall add rule name=UDP135 dir=in action=block protocol=UDP localport=135
netsh advfirewall firewall add rule name=TCP137 dir=in action=block protocol=TCP localport=137
netsh advfirewall firewall add rule name=UDP137 dir=in action=block protocol=UDP localport=137
netsh advfirewall firewall add rule name=TCP139 dir=in action=block protocol=TCP localport=139
netsh advfirewall firewall add rule name=UDP139 dir=in action=block protocol=UDP localport=139
netsh advfirewall firewall add rule name=TCP445 dir=in action=block protocol=TCP localport=445
netsh advfirewall firewall add rule name=UDP445 dir=in action=block protocol=UDP localport=445

 

2008：

netsh advfirewall set allprofile state on
netsh advfirewall reset
netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
netsh advfirewall firewall add rule name="135,445" dir=in action=block protocol=TCP localport=135,445
netsh advfirewall firewall add rule name="dahua" dir=in action=allow remoteip=192.168.0.0/24,172.16.0.0/16 protocol=TCP localport=21,80,8081,8090,9000,9001,9100,9115,9200,9320,9400,9500,9600,9700,9800,12366
netsh advfirewall firewall add rule name="oracle" dir=in action=allow remoteip=192.168.1.0/255.255.255.0 protocol=TCP localport=1521
netsh advfirewall firewall add rule name="dahuaAPP" dir=in action=allow  remoteip=192.168.0.0/24,172.16.0.0/16 program="C:\MyApp\MyApp.exe" enable=yes

rem netsh advfirewall firewall add rule name="dahuaAPP" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16 LocalSubnet profile=private

rem action=allow action=block
rem netsh firewall add port tcp 139 netbios-ssn enable custom 192.168.0.0/255.255.0.0,10.0.0.0/255.0.0.0

rem =========参考信息==========================

rem启用桌面防火墙
netsh advfirewall set allprofiles state on
rem 在所有配置文件中设置默认阻挡入站并允许出站通信：如果设置为拒绝使用blockinbound,blockoutbound
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
rem show命令将让你可以查看所有不同的配置文件中的设置和全局属性。
netsh advfirewall show
rem 关闭tcp协议的139端口
netsh advfirewall firewall add rule name="deny tcp 139" dir=in protocol=tcp localport=139 action=block
rem 关闭udp协议的139端口
netsh advfirewall firewall add rule name="deny udp 139" dir=in protocol=udp localport=139 action=block
rem 关闭tcp协议的445端口
netsh advfirewall firewall add rule name="deny tcp 445" dir=in protocol=tcp localport=445 action=block
rem 关闭udp协议的445端口
netsh advfirewall firewall add rule name="deny udp 445" dir=in protocol=udp localport=445 action=block
rem 使用相同的方法，依次关闭TCP协议的21、22、23、137、138、3389、5800、5900端口。
rem 恢复初始防火墙设置
netsh advfirewall reset
rem 关闭防火墙
netsh advfirewall set allprofiles state off
rem 允许别人访问本机TCP80端口
netsh advfirewall firewall add rule name="HTTP TCP Port 80" dir=in action=allow protocol=TCP localport=80
 
rem 允许192.168.0.0/16,10.0.0.0/8远程windows系统；（保存为BAT文件运行即可）
netsh advfirewall firewall set rule name="Remote Desktop (TCP-In)" new RemoteIP="192.168.0.0/16,10.0.0.0/8"     
netsh advfirewall firewall set rule name="Remote Desktop - RemoteFX (TCP-In)" new RemoteIP="192.168.0.0/16,10.0.0.0/8"
netsh advfirewall firewall set rule group="remote desktop " new enable=Yes profile=domain
netsh advfirewall firewall set rule group="remote desktop " new enable=Yes profile=private
rem 启用一个程序
netsh advfirewall firewall add rule name=”My Application” dir=in action=allow program=”C:\MyApp\MyApp.exe” enable=yes
netsh advfirewall firewall add rule name=”My Application” dir=in action=allow program=”C:\MyApp\MyApp.exe” enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
netsh advfirewall firewall add rule name=”My Application” dir=in action=allow program=”C:\MyApp\MyApp.exe” enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=private
rem 删除已启用的程序或端口
netsh advfirewall firewall delete rule name=rule nameprogram=”C:\MyApp\MyApp.exe”
netsh advfirewall firewall delete rule name=rule nameprotocol=udp localport=500
rem ICMP配置
netsh advfirewall firewall add rule name=”ICMP Allow incoming V4 echo request” protocol=icmpv4:8,any dir=in action=allow
netsh advfirewall firewall add rule name=”All ICMP V4” protocol=icmpv4:any,any dir=in action=allow
rem 设置日志
netsh advfirewall set currentprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log
netsh advfirewall set currentprofile logging maxfilesize 4096
netsh advfirewall set currentprofile logging droppedconnections enable
netsh advfirewall set currentprofile logging allowedconnections enable
rem 启动防火墙
Netsh advfirewall set currentprofile state on
netsh advfirewall set currentprofile firewallpolicy blockinboundalways,allowoutbound
Netsh advfirewall set domainprofile state on
netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound
netsh advfirewall set domainprofile state on
netsh advfirewall set privateprofile state on
rem 恢复默认防火墙策略
netsh advfirewall reset
rem 启用特定的服务
netsh advfirewall firewall set rule group=”File and Printer Sharing” new enable=Yes
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
netsh advfirewall firewall set rule group="remote desktop " new enable=Yes profile=domain
netsh advfirewall firewall set rule group="remote desktop " new enable=Yes profile=private
rem 导出防火墙当前的所有配置到一个文件中
netsh advfirewall export  "c:\rule20170727.fw"
rem 从一个文件中导入防火墙的配置
netsh advfirewall import  "c:\rule20170727.fw"
rem 查看防火墙当前的所有配置
netsh adfirewall show


 
 参考：

www.cnblogs.com/soloate/p/5600731.html

www.cnblogs.com/zhen656/p/4275270.html

2  linux :

test@vostro-2421:~$ cat IpGo
##!/bin/bash
iptables -F
iptables -X
iptables -Z
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i wlan0 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
#
iptables -A OUTPUT -o wlan0 -p TCP --sport 1024:65535 -m multiport --dports 8201,7001,7502,12000,9800,9810,8000,68,53,21,22,23,123 -j ACCEPT
iptables -A OUTPUT -o wlan0 -p UDP --sport 1024:65535 -m multiport --dports 68,53,123 -j ACCEPT
iptables -A OUTPUT -o wlan0 -p TCP --sport 1024:65535 -m multiport --dports 25,110,3690 -j ACCEPT
iptables -A OUTPUT -o wlan0 -p TCP --sport 1024:65535 -m multiport --dports 80,443,88,2013 -j ACCEPT
#
iptables -A OUTPUT -o wlan0 -p TCP --sport 1024:65535 -m multiport --dports 8088,8081,81,33899,7000 -j ACCEPT
iptables -A OUTPUT -o wlan0 -p TCP --sport 1024:65535 -m multiport --dports 40533,40577,826,2015,9080 -j ACCEPT
#
iptables -A OUTPUT -o wlan0 -p TCP --sport 1024:65535 -m multiport --dports 43389 -j ACCEPT
#
iptables -A OUTPUT -o wlan0 -p TCP --sport 1024:65535 -m multiport --dports 2433,4981 -j ACCEPT
iptables -A OUTPUT -o wlan0 -p UDP --sport 1024:65535 -m multiport --dports 40577,16823 -j ACCEPT
#iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
#iptables -A INPUT -p icmp -j REJECT
#wm
#iptables -D INPUT -p icmp -j REJECT
#iptables -A INPUT -i vmnet1 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
#iptables -A INPUT -i vmnet8 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A OUTPUT -o vmnet+ -p TCP --sport 1024:65535 -m multiport --dports 8087,82,20,21  -j ACCEPT
#
iptables -A INPUT -i eth+ -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A INPUT -i virbr+ -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A INPUT -i vmnet+ -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A INPUT -i vnet+ -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
#
iptables -A INPUT -i eth+ -p tcp -m multiport --dports 135:139,445 -j ACCEPT
iptables -A INPUT -i virbr+ -p tcp -m multiport --dports 135:139,445 -j ACCEPT
iptables -A INPUT -i vmnet+ -p tcp -m multiport --dports 135:139,445 -j ACCEPT
iptables -A INPUT -i vnet+ -p tcp -m multiport --dports 135:139,445 -j ACCEPT
iptables -A INPUT -i eth+ -p udp -m multiport --dports 135:139,445 -j ACCEPT
iptables -A INPUT -i virbr+ -p udp -m multiport --dports 135:139,445 -j ACCEPT
iptables -A INPUT -i vnet+ -p udp -m multiport --dports 135:139,445 -j ACCEPT
iptables -A INPUT -i vmnet+ -p udp -m multiport --dports 135:139,445 -j ACCEPT
#
iptables -A INPUT -i wlan0 -p tcp -m multiport --dports 135:139,445 -j DROP
iptables -A INPUT -i wlan0 -p udp -m multiport --dports 135:139,445 -j DROP
#
iptables -A OUTPUT -o eth+ -p tcp -m multiport --dports 139,445,23,80,20,21,123 -j ACCEPT
iptables -A OUTPUT -o eth+ -p udp -m multiport --dports 137,138 -j ACCEPT
#
iptables -A INPUT -i eth+ -p tcp -m multiport --dports 170,515 -j ACCEPT
iptables -A INPUT -i wlan0 -p tcp -m multiport --dports 170,515,139,445,23,80,20,21,123 -j ACCEPT
iptables -A OUTPUT -o wlan0 -p tcp -m multiport --dports 139,445 -j ACCEPT
#
iptables -A INPUT -i vnet+ -j ACCEPT
iptables -A OUTPUT -o vnet+ -j ACCEPT
#iptables -A INPUT -i vnet1 -j ACCEPT
#iptables -A OUTPUT -o vnet1 -j ACCEPT
#iptables -A INPUT -i vnet2 -j ACCEPT
#iptables -A OUTPUT -o vnet2 -j ACCEPT
#iptables -A INPUT -i vnet3 -j ACCEPT
#iptables -A OUTPUT -o vnet3 -j ACCEPT
iptables -A INPUT -i virbr+ -j ACCEPT
#iptables -A INPUT -i virbr1 -j ACCEPT
#iptables -A INPUT -i virbr2 -j ACCEPT
iptables -A OUTPUT -o virbr+ -j ACCEPT
#iptables -A OUTPUT -o virbr1 -j ACCEPT
#iptables -A OUTPUT -o virbr2 -j ACCEPT
iptables -A FORWARD -i wlan0 -o virbr0 -j ACCEPT
iptables -A FORWARD -i virbr0 -o wlan0 -j ACCEPT
#vmware
iptables -A INPUT -i vmnet+ -j ACCEPT
iptables -A OUTPUT -o vmnet+ -j ACCEPT
#iptables -A INPUT -i vmnet8 -j ACCEPT
#iptables -A OUTPUT -o vmnet8 -j ACCEPT
iptables -A FORWARD -i vmnet8 -o vmnet1 -j ACCEPT
iptables -A FORWARD -i vmnet1 -o vmnet8 -j ACCEPT

#iptables -A OUTPUT -o virbr0  -p udp  -m multiport --dports 161,162 -j ACCEPT
#iptables -A INPUT -i virbr0  -p udp -m multiport --dports 161,162 -j ACCEPT
#ntpdate
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT

#emule
#iptables -A INPUT -p tcp --dport 4662 -j ACCEPT  
#iptables -A INPUT -p udp --dport 4672 -j ACCEPT

# iptables -I INPUT -s 1.2.3.4 -j DROP 

test@vostro-2421:~$  iptables  -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -s 192.168.1.0/24 -j ACCEPT 
-A INPUT -s 127.0.0.0/8 -j ACCEPT  
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT  
-A INPUT -p tcp -m multiport --dports 111,222,333,444,555 -j ACCEPT 
-A FORWARD -d 192.168.1.0/24 -j ACCEPT 
-A FORWARD -d 127.0.0.0/8 -j ACCEPT 
-A OUTPUT -d 192.168.1.0/24 -j ACCEPT 
-A OUTPUT -d 127.0.0.0/8 -j ACCEPT 
-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT  
-A OUTPUT -p tcp -m multiport --sports 111,222,333,444,555 -j ACCEPT 

保存供自己参考