iptables 防火墙脚本

iptables 防火墙脚本

 

 

 

echo "1" > /proc/sys/net/ipv4/ip_dynaddr
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/iptables -F -t filter
/sbin/iptables -F -t nat
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD DROP
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
/sbin/iptables -A OUTPUT -j ACCEPT
/sbin/iptables -A FORWARD -j ACCEPT

# ALLOW ALL in PRIVATE NET
/sbin/iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -i eth2 -j ACCEPT

#traffic to different mark
#iptables -t mangle -A PREROUTING -s 192.168.0.0/255.255.255.1 -j MARK --set-mark 0x1
#iptables -t mangle -A PREROUTING -s 192.168.0.1/255.255.255.1 -j MARK --set-mark 0x2

 

# NAT
#/sbin/iptables -t nat -A POSTROUTING -o ppp0 -s 192.168.0.0/24 -j MASQUERADE
/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE
#/sbin/iptables -t nat -A POSTROUTING -o ppp1 -j MASQUERADE
#/sbin/iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

 

# SQUID
/sbin/iptables -A PREROUTING -t nat -p tcp -s 192.168.0.0/24 --dport 80 -j DNAT --to 192.168.0.254:3128

#iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

# External -->Internal
/sbin/iptables -A FORWARD -p tcp --dport 443 -j ACCEPT
/sbin/iptables -A FORWARD -p icmp -j ACCEPT

#=============Services(external-->internal)===============

#Port

/sbin/iptables -A INPUT -p tcp --dport 55556 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 55555 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 3128 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 55580 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT

#iptables -t nat -A PREROUTING  -d x.x.x.x -j DNAT --to-destination 192.168.0.249
#iptables -t nat -A PREROUTING -d x.x.x.x -p tcp --dport 80 -j DNAT --to-destination 192.168.0.249

#iptables -t nat -A PREROUTING -p tcp -m tcp -d x.x.x.x --dport 8018 -j DNAT --to-destination 192.168.20.123:8018

#=========================================================

#Dos
iptables -t filter -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 6/minute --limit-burst 2 -j ACCEPT
iptables -t filter -A INPUT -p icmp -m icmp --icmp-type 8 -j REJECT --reject-with icmp-port-unreachable
#syn-flood protection
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
#furtibe port scanner protection
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

#======================Deny others=========================
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -s 0/0 -j DROP

# allow the third handshake
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# exchange the other packets'' "SOURCE" and "TARGET", and SEND it !!!
/sbin/iptables -A INPUT -j MIRROR
#===========================================================