常用iptables脚本

Linux自带的防火墙iptables可以说非常强大，可以做到严格的访问控制，分享一个常用的iptables规则：

脚本：vi fws.sh

#!/bin/bash
#Set the variable
IPT=/sbin/iptables
WAN="eth0"
#IPADDR=61.134.1.4
LOOPBACK_INTERFACE="lo"
#Remove any existing rules
$IPT -F
$IPT -X
#setting default firewall policy
$IPT --policy OUTPUT ACCEPT
$IPT --policy FORWARD DROP
$IPT -P INPUT DROP
#setting for loopback interface
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
#Stealth Scans and TCP State Flags
#All of the bits are cleared
$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
#SYN and FIN are both set
$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
#SYN and RST are both set
$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
#FIN and RST are both set
$IPT -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
#FIN is the only bit set, without the expected accompanying ACK
$IPT -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
#PSH is the only bit set, without the expected accompanying ACK
$IPT -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
#URG is the only bit set, without the expected accompanying ACK
$IPT -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
#$IPT -A INPUT  -i $WAN -s $IPADDR -j DROP
###################################################################
##setting wan access rules##
#wan enable dns connect out
$IPT -A INPUT  -i $WAN -p udp --sport 53 -j ACCEPT
#wan enable http connect out and in
$IPT -A INPUT  -i $WAN -p tcp --sport 80 -j ACCEPT
$IPT -A INPUT  -i $WAN -p tcp --dport 80 -j ACCEPT
#enable ftp connect out and in
$IPT -A INPUT  -i $WAN -p tcp --dport 20 -s 1.1.1.1 -j ACCEPT
$IPT -A INPUT  -i $WAN -p tcp --dport 21 -s 1.1.1.1 -j ACCEPT
$IPT -A INPUT  -i $WAN -p tcp --sport 20 -j ACCEPT
$IPT -A INPUT  -i $WAN -p tcp --sport 21 -j ACCEPT
#wan enable icmp connect
$IPT -A INPUT -p icmp  -j ACCEPT
$IPT -A OUTPUT -p icmp  -j ACCEPT
#wan enable ntp connect out
$IPT -A INPUT  -i $WAN -p udp --sport 123 -j ACCEPT
#enable ssh connect out and in
$IPT -A INPUT -i $WAN -p tcp --dport 22 -j ACCEPT
$IPT -A INPUT -i $WAN -p tcp --sport 22 -j ACCEPT

wq保存退出

 

chmod +x fws.sh
./fws.sh

注意根据自己需求适当修改一下