iptables1.sh的样例

#!/bin/sh
IPTABLES=/sbin/iptables
MODPROBE=/sbin/modprobe
INT_NET=10.9.160.0/24

### flush existing rules and set chain policy setting to DROP
echo "[+] Flushing existing iptables rules..."
iptables -F
iptables -X
iptables -F -t nat

# default policy
iptables -P INPUT   DROP
iptables -P OUTPUT  DROP
iptables -P FORWARD DROP

### load connection-tracking modules
$MODPROBE ip_conntrack
$MODPROBE iptable_nat
$MODPROBE ip_conntrack_ftp
$MODPROBE ip_nat_ftp

## from 10.9.160.86  to 10.9.160.108's ssh server
iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT   -p tcp -s 10.9.160.86  --dport 22   -j ACCEPT
iptables -A OUTPUT  -p tcp -d 10.9.160.86  --sport 22   -j ACCEPT
 
###  INPUT chain ###
echo "[+] Setting up INPUT chain..."
###  state tracking rules
iptables -A INPUT -m state --state INVALID -j LOG --log-prefix "DROP INVALID"  --log-ip-options  --log-tcp-options --log-tcp-sequence
iptables -A INPUT -m state --state INVALID -j DROP
#iptables -A INPUT -m state --state --ESTABLISHED,RELATED -j ACCEPT

### anti-spoofing rules
iptables -A INPUT -i eth0 -s ! $INT_NET -j LOG --log-prefix "SPOOFED PKT"
iptables -A INPUT -i eth0 -s ! $INT_NET -j DROP

### icmp rules
iptables -A INPUT  -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT

### default INPUT LOG rule
iptables -A INPUT -i ! lo -j LOG --log-prefix "DROP" --log-ip-options --log-tcp-options

###############################################################################
### OUTPUT chain ###
echo "[+] Setting up OUTPUT chain... "
### state tracking rules:
iptables -A OUTPUT -m state --state INVALID -j LOG --log-prefix "DROP INVALID " --log-ip-options  --log-tcp-options
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

### ACCEPT rules for allowing connections out
iptables -A OUTPUT -p tcp --dport 21 --syn -j ACCEPT
iptables -A OUTPUT -p tcp --dport 25 --syn -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80  -j ACCEPT
iptables -A OUTPUT -p tcp --dport 4321 --syn -j ACCEPT

### default OUTPUT LOG rule
iptables -A OUTPUT -o ! lo -j LOG --log-prefix "DROP" --log-ip-options  --log-tcp-options

##up FTP
iptables -A INPUT -p tcp --sport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT