iptables 简单脚本（未完成）

 

今天刚刚做的一个简单的iptables 脚本， 应用到自己的小小服务器上，明天完善一下限制功能和LOG记录，小弟浅见，请高手指证错误。

#!/bin/bash
# writen by Nick.ma
# initially version at 10022009

echo "                  THe script name is $0"
###################### SET variable ########################

DATE=`/bin/date -R`
IPT=/sbin/iptables
IPT_SAVE=/sbin/iptables-save
IPT_SAVE_FILE=/etc/sysconfig/my_fw_iptables
IPT_RESTORE=/sbin/iptables-restore

# new chain with INPUT,OUTPUT,FORWRD
NEW_CH_INPUT=
NEW_CH_OUTPUT=
NEW_CH_FORWARD=

# configure interface variable
#localhost
LO=lo

# private network IP with localhost interface
ETH0=eth0

# public network IP with localhost interface
ETH1=eth1

# Private network address range
NETWORK=192.168.1.0/24

# If localhost IP is static
echo "please Type IP with localhost of Ethernet !!"
read LOCAL_IP

echo "please Type IP with localhost of WAN"
read PUBLIC_IP

# WEB server IP address
echo "please Type IP with WEB server "
read WEB_SER

echo " this firewall running at  time of verbose is $DATE "

###################### iptables LOG #######################

FW_LOG=/var/log/fw_log/fw_log

if [ -z "$FW_LOG" ]; then
   echo " no found fw_log file,fisrt please NEW $FW_lOG"
exit 2
fi

# startup FORWARD
echo 1 > /proc/sys/net/ipv4/ip_forward

###################### iptables SET #######################

# Add Required modules with Iptables
MODULE=/sbin/modprobe
$MODULE ip_tables
$MODULE ip_conntrack
$MODULE iptable_filter
$MODULE iptable_mangle
$MODULE iptable_nat
$MODULE ipt_LOG
$MODULE ipt_limit
$MODULE ipt_state

# Add Non-Require modules with Iptables
# for example FTP
#$MODULE ip_nat_ftp
#$MODULE ip_nat_irc

# configure iptables flush
$IPT -F
$IPT -Z
$IPT -X

# Configure Iptables Policy
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

# check localhost logged in USER !!
if [ $((UID)) != 0 ]; then
        echo "logged in is not ROOT !!"
        exit 2
fi

if [ -z $LOCAL_IP  ]; then
        echo "localhost not configure IP !"
exit 2
fi

# check FW_LOG file !!!
check_file () {
        FIlE=fw_log
        FILE_DIR=/var/log/fw_info_log/
        CHECK_FILE=`ls -l $FILE_DIR/$FILE > /dev/null 2>&1`
        RETURNS=`echo $?`
        if [ $RETURNS != 0 ] ; then
                echo "no found $FILE file,this progrom will NEW file !!!"
                mkdir -p $FILE_DIR
        fi
}

check_file
touch "$FILE_DIR/fw_log"

 

###################### iptables INPUT ######################

# configure iptables for localhost to internet

# INPUT chain
$IPT -A INPUT -i $LO -j ACCEPT
$IPT -A INPUT -m state --state EStABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
$IPT -A INPUT -p tcp --dport 53 -j ACCEPT
$IPT -A INPUT -p udp --dport 53 -j ACCEPT
$IPT -A INPUT -p tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p tcp --dport 443 -j ACCEPT
# $IPT -A INPUT -p icmp -m icmp --icmp-type 0  -m limit --limit 10/s -j ACCEPT
$IPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
$IPT -A INPUT -p tcp --dport 25 -j ACCEPT
$IPT -A INPUT -p tcp --dport 110 -j ACCEPT
$IPT -A INPUT -p tcp --dport 143 -j ACCEPT
$IPT -A INPUT -p tcp --dport 993 -j ACCEPT
$IPT -A INPUT -p tcp --dport 995 -j ACCEPT

 

###################### iptables NAT ########################

# NAT
$IPT -t nat -A POSTROUTING -s $NETWORK -o $ETH1 -j MASQUERADE
$IPT -A FORWARD -i $ETH1 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $NETWORK -j ACCEPT

# WEB server access configure
$IPT -t nat -A PREROUTING -d $PUBLIC_IP -p tcp --dport 80 -j DNAT --to $WEB_SER

 

###################### iptables OUTPUT #####################

# OUTPUT chain
$IPT -A OUTPUT -o $LO -j ACCEPT
$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 22 -j ACCEPT
$IPT -A OUTPUT -p tcp  --dport 53 -j ACCEPT
$IPT -A OUTPUT -p udp  --dport 53 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 80 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 443 -j ACCEPT
$IPT -A OUTPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
$IPT -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 25 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 110 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 993 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 995 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 143 -j ACCEPT