Gnu/Linux 防止暴力扫描及其它

RedHat7 手工脚本：
# iptables iptables -A INPUT -i eno16777728 -p tcp -m multiport --destination-port 135,136,137,138,139,445,4899,1900 -j LOG
iptables -A INPUT -p tcp -m multiport --destination-port 135,136,137,138,139,445,4899,1900,3389 -j DROP
# iptables iptables -A INPUT -i eno16777728 -p udp -m multiport --destination-port 135,136,137,138,139,445,4899,1900 -j LOG
iptables -A INPUT -p udp -m multiport --destination-port 135,136,137,138,139,445,4899,1900,3389 -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
####60秒内单IP超过20次连接进行阻断####
iptables -A INPUT  -p tcp -m multiport --destination-port 80,443 -m state --state NEW -m recent --update --seconds 60 --hitcount 20 --name test --rsource -j DROP
iptables -A INPUT  -p tcp -m multiport --destination-port 80,443 -m state --state NEW -m recent --set --name test --rsource
iptables -A INPUT  -p tcp -m multiport --destination-port 80,443 -m connlimit --connlimit-above 20 -j REJEC
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 80 -j ACCEPT
##########
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 7001 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 7003 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 7005 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 7007 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 3371 -j ACCEPT
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 69 -j ACCEPT
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 123 -j ACCEPT
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 30244 -j ACCEPT
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 20 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 20 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 21 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 21 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 5801:5809 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 5801:5809 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 5901:5909 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 5901:5909 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 6001:6009 -j DROP
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 6001:6009 -j DROP
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

RedHat6系统：
修改/etc/sysconfig/iptables配置文件，添加如下内容，系统即可只放行定义中的应用端口，其它端口系统将对数据包进行丢弃处理，规则如下：
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
#:INPUT ACCEPT [0:0]
:INPUT DROP [0:0]
#:FORWARD ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m state --state NEW -m multiport --destination-port 135,136,137,138,139,445,3389 -j DROP
-A INPUT -p udp -m state --state NEW -m multiport --destination-port 135,136,137,138,139,445,3389 -j DROP
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT  -p tcp -m multiport --destination-port 80,443 -m state --state NEW -m recent --update --seconds 60 --hitcount 20 --name test --rsource -j DROP
-A INPUT  -p tcp -m multiport --destination-port 80,443 -m state --state NEW -m recent --set --name test --rsource
-A INPUT  -p tcp -m multiport --destination-port 80,443 -m connlimit --connlimit-above 20 -j REJEC
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 177 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 177 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 20 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 20 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 5801:5809 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 5801:5809 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 5901:5909 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 5901:5909 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 6001:6009 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m udp -p udp --dport 6001:6009 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

转载于:https://my.oschina.net/Birdofprey/blog/3062744