转---iptables

-------------------------------------------------------------------------------------

这个文件的路径是：/etc/rc.d/rc.local

#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local
/etc/rc.d/iptables.fw

=====================================================================================

路径是：/etc/rc.d/iptables

#!/bin/sh
/sbin/modprobe ip_tables
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp
/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/sbin/iptables -A FORWARD -s 0/0 -j ACCEPT
/sbin/iptables -A FORWARD -d 0/0 -j ACCEPT
echo "1" > /proc/sys/net/ipv4/ip_forward
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 445 -j DROP
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 135 -j DROP
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 139 -j DROP

#IGMP

#iptables -A INPUT -p ICMP -d 219.144.132.186 -m limit --limit 1/s --limit-burst 10 -j ACCEPT
iptables -A INPUT -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT

#NMAP FIN/URG/PSH

iptables -A INPUT -i eth0 -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

#Xmas Tree
iptables -A INPUT -i eth0 -p tcp --tcp-flags ALL ALL -j DROP

#Another Xmas Tree
iptables -A INPUT -i eth0 -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

#Null Scan(possibly)
iptables -A INPUT -i eth0 -p tcp --tcp-flags ALL NONE -j DROP

#SYN/RST
iptables -A INPUT -i eth0 -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

#SYN/FIN -- Scan(possibly)
iptables -A INPUT -i eth0 -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
#synfoold

iptables -N synfoold
iptables -A synfoold -p tcp --syn -m limit --limit 1/s -j RETURN
iptables -A synfoold -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp -m state --state NEW -j synfoold

echo 1  > /proc/sys/net/ipv4/icmp_echo_ignore_all
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -N syn-flood
iptables -A INPUT -p tcp --syn -j syn-flood
iptables -I syn-flood -p tcp -m limit --limit 3/s --limit-burst 6 -j RETURN
iptables -A syn-flood -j REJECT
sysctl -w net.ipv4.icmp_echo_ignore_all=0
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
iptables -t nat -A PREROUTING -p udp -d 192.168.1.254 --dport 53 -j DNAT --to 218.30.19.40:53
iptables -t nat -A PREROUTING -d 222.90.71.172 -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.1.242:29710
#iptables -t nat -A PREROUTING -d 222.90.71.172 -p tcp -m tcp --dport 2101 -j DNAT --to-destination 192.168.1.242:21