linux防火墙脚本

#!/bin/bash

#difine all wariance or partmeter


WAN_INT="eth0"
WIN_INT_IP="222.222.101,,1"


LAN_INT="eth1"
LAN_INT_IP="192.168.222.102"


ALLOW_ACCESS_CLIENT="192.168.222.1 192.168.222.2 192.168.222.3 192.168.222.1 192.168.222.4 192.168.222.5 192.168.222.6"


WAN_WIN2003_SRV="222.222.101.2"


PORT="20,21,25,80,110,143,554,1755,7070,"


IPT="/sbin/iptables"




########################################################################################################


start(){
echo ""


echo -e "\033[1;032m Flush all chains......................... [ok] \033[m"


# flush all rules at first


    $IPT -t filter -F
    $IPT -t nat -F
    $IPT -t manager -F
 
# default policy is drop
    
    $IPT -t filter -P INPUT DROP
    $IPT -t filter -P OUTPUT DROP
    $IPT -t filter -P FORWARD DROP


#oepn ssh service
    
   $IPT -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
   $IPT -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT


#SNAT


etho 1 > /proc/sys/net/ipv4/ip_forward
$IPT -t nat -A POSTROUING -s 192.168.222.0/24 -o $WAN_INT -j SNAT --to--source $WAN_INT_IP


################################accept erp access


if ["$ALLOW_ACCESS _CLIENT" !=""] ;then
   for LAN in ${ALLOW_ACCESS_CLIENT} ;do
   $IPT -t filter -A FORWARD -p tcp -m multiport -s ${LAN} -o $WAN_INT --dport $PORT -j ACCEPT
   $IPT -t filter -A FORWARD -p udp -m multiport -s ${LAN} -o $WAN_INT --dport $PORT -j ACCEPT
   $IPT -t filter -A FORWARD -p tcp -m multiport -i $ $WAN_INT --sport $port -j ACCEPT
   $IPT -t filter -A FORWARD -p udp -m multiport -i $ $WAN_INT --sport $port -j ACCEPT


   etho ""
   etho ${LAN} Access to Externel .........ACCEPT  acess Win2003     [ok]
   done
fi
}




##################################################################################################




stop(){
############################# Flush everything
$IPT -F
$IPT -X
$IPT -Z
$IPT -F -t nat
$IPT -X -t nat
$IPT -Z -t nat
$IPT -P INPUT  ACCEPT
$IPT -P OUTPUT  ACCEPT
$IPT -P FORWARD  ACCEPT
echo  "###############################################################"
echo  "#     #"
echo  "#      Stop firewall server Access rule Successful     #"
echo  "#     #"
echo  "###############################################################"


}
###############################################################################################


case "$1" in
  start)
  start
  ;;
stop)
  stop
    ;;
restart)
  stop
  start
  ;;
*)
       echo $"Usage:$) {start|stop|restart|}"
       exit 1
esac
exit $?