iptables防火墙脚本

最新推荐文章于 2022-07-23 22:55:44 发布

LUES

最新推荐文章于 2022-07-23 22:55:44 发布

阅读量1.5k

点赞数

分类专栏：安全文章标签：防火墙 input tcp output table filter

本文链接：https://blog.csdn.net/LUES/article/details/279750

版权

安全专栏收录该内容

7 篇文章 0 订阅

订阅专栏

[root@hkweb root]# cat /etc/xxx
#!/bin/bash
echo "1" > /proc/sys/net/ipv4/ip_forward
INET_IFACE="eth0"
INET_IP="202.96.155.37"
LAN_IFACE="eth1"
LAN_IP="10.0.0.252"
LAN_IP_RANGE="10.0.0.0/8"
IPT="/sbin/iptables"
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_LOG
for TABLE in filter nat mangle ; do
$IPT -t $TABLE -F
$IPT -t $TABLE -X
done
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -o eth1 -j ACCEPT
#iptables -A INPUT -i eth0 -j ACCEPT
iptables -A OUTPUT -o eth0 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p udp -s 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p icmp -s 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -s 0/0 -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 203.86.67.18 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 202.96.155.38 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 211.96.97.20 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 211.96.97.22 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.33 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.34 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.35 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.36 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.37 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.38 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 61.144.222.111 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 1521 -j ACCEPT
#iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 8000 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 8080 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 8083 -j ACCEPT
#iptables -A INPUT -i eth0 -p tcp -s ! 210.75.18.33 --dport 8083 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 8888 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 8880 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 9999 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 10000 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 23 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 5368 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 202.96.155.38 --dport 138 -j ACCEPT
iptables -A INPUT -i eth0 -p udp -s 202.96.155.38 --dport 138 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 202.96.155.38 --dport 139 -j ACCEPT
iptables -A INPUT -i eth0 -p udp -s 202.96.155.38 --dport 139 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 202.96.155.38 --dport 1984 -j ACCEPT
iptables -A INPUT -p icmp -i eth0 -s 0/0 -m limit --limit 1/s --limit-burst 10 -j ACCEPT
iptables -A INPUT -f -i eth0 -m limit --limit 100/s --limit-burst 100 -j ACCEPT
[root@hkweb root]#