我的Linux服务器iptables防火墙规则Shell脚本

1. #!/bin/bash
3. IPT="/sbin/iptables"
4. SPAMLIST="blockedip"
5. SPAMDROPMSG="BLOCKED IP DROP"
7. echo "Starting IPv4 Wall..."
8. $IPT -F
9. $IPT -X
10. $IPT -t nat -F
11. $IPT -t nat -X
12. $IPT -t mangle -F
13. $IPT -t mangle -X
14. modprobe ip_conntrack
16. [ -f /root/scripts/blocked.ips.txt ] && BADIPS=$(egrep -v -E "^#|^$" /root/scripts/blocked.ips.txt)
18. PUB_IF="eth0"
20. #unlimited
21. $IPT -A INPUT -i lo -j ACCEPT
22. $IPT -A OUTPUT -o lo -j ACCEPT
24. # DROP all incomming traffic
25. $IPT -P INPUT DROP
26. $IPT -P OUTPUT DROP
27. $IPT -P FORWARD DROP
29. if [ -f /root/scripts/blocked.ips.txt ];
30. then
31. # create a new iptables list
32. $IPT -N $SPAMLIST
34. for ipblock in $BADIPS
35. do
36.  $IPT -A $SPAMLIST -s $ipblock -j LOG --log-prefix "$SPAMDROPMSG"
37.  $IPT -A $SPAMLIST -s $ipblock -j DROP
38. done
40. $IPT -I INPUT -j $SPAMLIST
41. $IPT -I OUTPUT -j $SPAMLIST
42. $IPT -I FORWARD -j $SPAMLIST
43. fi
45. # Block sync
46. $IPT -A INPUT -i ${PUB_IF} -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Drop Sync"
47. $IPT -A INPUT -i ${PUB_IF} -p tcp ! --syn -m state --state NEW -j DROP
49. # Block Fragments
50. $IPT -A INPUT -i ${PUB_IF} -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fragments Packets"
51. $IPT -A INPUT -i ${PUB_IF} -f -j DROP
53. # Block bad stuff
54. $IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
55. $IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL ALL -j DROP
57. $IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "NULL Packets"
58. $IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
60. $IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
62. $IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "XMAS Packets"
63. $IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
65. $IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fin Packets Scan"
66. $IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
68. $IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
70. # Allow full outgoing connection but no incomming stuff
71. $IPT -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
72. $IPT -A OUTPUT -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
74. # Allow ssh
75. $IPT -A INPUT -p tcp --destination-port 22 -j ACCEPT
77. # allow incomming ICMP ping pong stuff
78. $IPT -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
79. $IPT -A OUTPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACCEPT
81. # Allow port 53 tcp/udp (DNS Server)
82. $IPT -A INPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
83. $IPT -A OUTPUT -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
85. $IPT -A INPUT -p tcp --destination-port 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
86. $IPT -A OUTPUT -p tcp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
88. # Open port 80
89. $IPT -A INPUT -p tcp --destination-port 80 -j ACCEPT
90. ##### Add your rules below ######
92. ##### END your rules ############
94. # Do not log smb/windows sharing packets - too much logging
95. $IPT -A INPUT -p tcp -i eth0 --dport 137:139 -j REJECT
96. $IPT -A INPUT -p udp -i eth0 --dport 137:139 -j REJECT
98. # log everything else and drop
99. $IPT -A INPUT -j LOG
100. $IPT -A FORWARD -j LOG
101. $IPT -A INPUT -j DROP
103. exit 0