IPTables常见服务策略配置（续）

案例：企业内网：192.168.0.0/24 ,防火墙，外网接口eth0 202.103.0.14 , 内网接口eth1 192.168.0.1

#!/bin/bash
#
WanIP="202.103.0.14"
WanFace="eth0"

LANIP="192.168.0.1"
LANNetID="192.168.0.0/24"
LANFace="eth1"

LoIP="127.0.0.1"
LoFace="lo"

IPTABLES=/sbin/iptables

$IPTABLES -t filter -F
$IPTABLES -t filter -Z
$IPTABLES -t filter -X

$IPTABLES -t nat -F
$IPTABLES -t nat -Z
$IPTABLES -t nat -X

$IPTABLES -t mangle -F
$IPTABLES -t mangle -Z
$IPTABLES -t mangle -X

/bin/echo "1" > /proc/sys/net/ipv4/ip_forward


#The filter table's default policy set to prevent
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

#Check the tcp packets are not normal
$IPTABLES -N BadTcp

#Check the tcp packet with the SYN flag is a normal request packet
$IPTABLES -N AllowTcp

#Check TCP package
$IPTABLES -N TcpPak

#Check the UDP packet
$IPTABLES -N UdpPak

#Check the ICMP packet
$IPTABLES -N IcmpPak

$IPTABLES -A BadTcp -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A BadTcp -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New package but,not syn:"
$IPTABLES -A BadTcp -p tcp ! --syn -m state --state NEW -j DROP

$IPTABLES -A AllowTcp -p tcp --syn -j ACCEPT
$IPTABLES -A AllowTcp -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A AllowTcp -p tcp -j DROP

$IPTABLES -A TcpPak -p tcp --dport 21 -j AllowTcp
$IPTABLES -A TcpPak -p tcp --dport 22 -j AllowTcp
$IPTABLES -A TcpPak -p tcp --dport 80 -j AllowTcp
$IPTABLES -A TcpPak -p tcp --dport 123 -j AllowTcp
$IPTABLES -A TcpPak -p tcp --dport 53 -j AllowTcp

$IPTABLES -A UdpPak -p UDP -s 0/0 --dport 53 -j ACCEPT
$IPTABLES -A UdpPak -p UDP -s 0/0 --dport 123 -j ACCEPT

$IPTABLES -A IcmpPak -p icmp --icmp-type 8 -j ACCEPT
$IPTABLES -A IcmpPak -p icmp --icmp-type 11 -j ACCEPT

#The establishment of the INPUT chain strategy
$IPTABLES -A INPUT -p tcp -j BadTcp

$IPTABLES -A INPUT -p ALL -i $LANFace -s $LANNetID -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LoFace -s $LoIP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LoFace -s $LANIP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LoFace -s $WanIP -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $LANFace --dport 67 -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $WanIP -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -p TCP -i $WanFace -j TcpPak
$IPTABLES -A INPUT -p UDP -i $WanFace -j UdpPak
$IPTABLES -A INPUT -p ICMP -i $WanFace -j IcmpPak


$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died:"

#Establish forward chain strategy
$IPTABLES -A FORWARD -p tcp -j BadTcp
$IPTABLES -A FORWARD -i $LANFace -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died:"

#Establish output chain strategy
$IPTABLES -A OUTPUT -p tcp -j BadTcp
$IPTABLES -A OUTPUT -p ALL -s $LoIP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LANIP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $WanIP -j ACCEPT
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died:"

#Establish NAT chain strategy
$IPTABLES -t nat -A POSTROUTING -o $WanFace -j SNAT --to-source $WanIP

接前篇文章...