##定义默认链的政策（全部拒绝）采取需要时才开放策略 # Set policies iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP ############################################################################
##允许本机做ping回环测试 # allow ping localhost,ping 192.168.0.1/2 # Allow loopback access iptables -A INPUT -p icmp -i lo -j ACCEPT iptables -A OUTPUT -p icmp -o lo -j ACCEPT
##允许从本机ping局域网内的微机 # Allow ping LAN iptables -A INPUT -p ALL -i $LAN_IF -s $LAN_IP_RANGE -j ACCEPT iptables -A OUTPUT -p ALL -o $LAN_IF -d $LAN_IP_RANGE -j ACCEPT
##定义从ppp0端口出去的包和ppp0进来的并且是响应的包允许通过 # Allow ppp0 iptables -A INPUT -p ALL -i $INET_IF -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -p ALL -o $INET_IF -j ACCEPT
##在bad_tcp_packets 链中定义坏包检测机制 # bad_tcp_packets rules chain iptables -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset iptables -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:" iptables -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
##定义允许通过的包的检测条件 # allowed rules chain iptables -A allo收集整理
wed -p tcp --syn -j ACCEPT iptables -A allowed -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A allowed -p tcp -j DROP
#定义icmp规则包，防止ping死攻击 # ICMP rules chain iptables -A icmp_packets -p icmp -s 0/0 --icmp-type 8 -j ACCEPT iptables -A icmp_packets -p icmp -s 0/0 --icmp-type 11 -j ACCEPT # limited_packets rules chain #iptables -A limited_packets -p tcp ! --syn -m state --state NEW -j DROP #iptables -A INPUT -i $INET_IF -s 192.168.0.0/16 -j DROP #iptables -A INPUT -p udp -i $LAN_IF --dport 67 --sport 68 -j ACCEPT # ###################################################################### ##对input链做bad_tcp_packets过滤 # The first bad_tcp_packets filter of INPUT chain iptables -A INPUT -p tcp -j bad_tcp_packets ##对input链做icmp_packets过滤 # The second icmp_packets filter of INPUT chain iptables -A INPUT -p icmp -i $INET_IF -j icmp_packets # Open trusted ports #echo "Open trusted ports....." #iptables -N services #for PORT in $TRUSTED_TCP_PORT; do #iptables -A tcp_packets -s 0/0 -p tcp --dport $PORT -j allowed #done #for PORT in $TRUSTED_UDP_PORT; do #iptables -A tcp_packets -s 0/0 -p udp --dport $PORT -j allowed #done # The trust port of INPUT chain #iptables -A INPUT -p tcp -i $INET_IF -j tcp_packets ##拒绝欺骗攻击 # deny local cheat iptables -A INPUT -i $INET_IF -s 192.168.0.0/16 -j DROP iptables -A INPUT -i $INET_IF -s 10.0.0.0/8 -j DROP iptables -A INPUT -i $INET_IF -s 172.16.0.0/12 -j DROP iptables -A INPUT -i $INET_IF -s 127.0.0.0/8 -j DROP # allow DHCP_packets from LAN #iptables -A INPUT -p udp -i $LAN_IF --dport 67 --sport 68 -j ACCEPT ##拒绝burst攻击 # deny attack of hack to input chain iptables -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level INFO --log-prefix "IPT INPUT packets died:"
##定义forward链上的规则 # FORWARD chain ##bad_tcp_packets filter检查 # bad_tcp_packets filter iptables -A FORWARD -p tcp -j bad_tcp_packets # address of limited filter #iptables -A FORWARD -p tcp -j limited_packets ##从内网出去的包不做流量外的限制 # allow the packets from LAN to WAN iptables -A FORWARD -o $INET_IF -s $LAN_IP_RANGE -j ACCEPT iptables -A FORWARD -i $LAN_IF -s $LAN_IP_RANGE -j ACCEPT ##定义从ppp0进来的包通过foward链的规则 # allow the packets from wan to lan iptables -A FORWARD -i $INET_IF -d $LAN_IP_RANGE -m state --state ESTABLISHED,RELATED -j ACCEPT ##对forward做burst检测 # deny attack of hack to forward chain iptables -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packets died:" ##对forward链做icmp（ping攻击）检测 # deny ping attack of hack iptables -A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT iptables -A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
