iptables脚本收集

#-------------------------------------------------------------------------

#!/bin/bash
/sbin/modprobe ip_tables
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp

/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -X
/sbin/iptables -Z

IP="124.124.39.246"
UPLINK="eth0"
ROUTER="yes"
INTERFACES="lo eth0 eth1"
SERVICES="ssh rsync"
DROP="192.168.0.0/16 10.0.0.0/8 172.16.0.0/12"
PORT="4899 80 21 7000 7100 7200 7300 7400"
UPORT="50001 50002 50003"
LAN_IP="192.168.0.100"

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i ! ${UPLINK} -j ACCEPT
iptables -A INPUT -p tcp --destination-port ssh -j ACCEPT
for x in ${SERVICES}
do
iptables -A INPUT -p tcp --dport ${x} -m state --state NEW -j ACCEPT
done
iptables -A INPUT -p tcp -i ${UPLINK} -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -i ${UPLINK} -j REJECT --reject-with icmp-port-unreachable
if [ -e /proc/sys/net/ipv4/tcp_ecn ]
then
echo 0 > /proc/sys/net/ipv4/tcp_ecn
fi
for x in ${INTERFACES}
do
echo 1 > /proc/sys/net/ipv4/conf/${x}/rp_filter
done
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
iptables -A INPUT -f -m limit --limit 10/s --limit-burst 10 -j ACCEPT
iptables -A FORWARD -p TCP ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
iptables -A FORWARD -p TCP ! --syn -m state --state NEW -j DROP
iptables -A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
iptables -A FORWARD -p udp -d 192.168.0.254 -i eth0 -j ACCEPT

echo "4096" > /proc/sys/net/ipv4/ip_conntrack_max
echo -e "32768 61000" > /proc/sys/net/ipv4/ip_local_port_range
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 0 >/proc/sys/net/ipv4/tcp_ecn
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
iptables -A OUTPUT -m state -p icmp --state INVALID -j DROP
iptables -t nat -A POSTROUTING -o ${UPLINK} -j MASQUERADE

for d in ${DROP}
do
iptables -t nat -A PREROUTING -i eth0 -s ${d} -j DROP
done

for n in ${PORT}
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport ${n} -j DNAT --to ${LAN_IP}:${n}
iptables -t nat -A POSTROUTING -d ${LAN_IP} -p tcp -m tcp --dport ${n} -j SNAT --to-source ${IP}
$iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport ${n} -j DNAT --to-destination ${LAN_IP}:${n}
done

for u in ${UPORT}
iptables -t nat -A PREROUTING -p udp -d ${IP} --dport ${u} -j DNAT --to ${LAN_IP}:${u}
done

#----------------------------------------------------------------