iptables脚本

#!/bin/bash
echo '1' >/proc/sys/net/ipv4/ip_forward
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT  ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -j ACCEPT
/sbin/iptables -A INPUT -i tun0 -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 -j ACCEPT
/sbin/iptables -A INPUT -m state --state RELATED -j ACCEPT
/sbin/iptables -F -t nat
/sbin/iptables -X -t nat
/sbin/iptables -Z -t nat
/sbin/iptables -t nat -P PREROUTING  ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT      ACCEPT
/sbin/iptables -A INPUT -p TCP -i eth0 --dport  22  -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i eth1 --dport  22  -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i ppp0 --dport  22  -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i ppp1 --dport  22  -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i tun0 --dport  22  -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i eth0 --dport  25  -j ACCEPT
/sbin/iptables -A INPUT -p UDP -i eth0 --dport  53  -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i eth0 --dport  53  -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i eth0 --dport  80  -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i eth0 --dport 110  -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i eth0 --dport 443  -j ACCEPT
#/sbin/iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -o eth0 -j MASQUERADE
/sbin/iptables -A FORWARD -s 0/0 -p tcp --dport 8080 -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -p tcp -d 192.168.10.1 --dport 8080 -j DNAT --to 10.101.158.1:8080
/sbin/iptables -t nat -A POSTROUTING -d 10.101.158.1 -p tcp --dport 8080 -j SNAT --to 10.101.158.66
/sbin/iptables -A FORWARD -o eth1 -d 10.101.158.1 -p tcp --dport 8080 -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -s 10.101.158.1 -p tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -s 0/0 -p tcp --dport 1521 -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -p tcp -d 192.168.10.1 --dport 1521 -j DNAT --to 10.101.158.1:1521
/sbin/iptables -t nat -A POSTROUTING -d 10.101.158.1 -p tcp --dport 1521 -j SNAT --to 10.101.158.66
/sbin/iptables -A FORWARD -o eth1 -d 10.101.158.1 -p tcp --dport 1521 -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -s 10.101.158.1 -p tcp --sport 1521 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -s 0/0 -p tcp --dport 21 -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -p tcp -d 192.168.10.1 --dport 21 -j DNAT --to 10.101.158.1:21
/sbin/iptables -t nat -A POSTROUTING -d 10.101.158.1 -p tcp --dport 21 -j SNAT --to 10.101.158.66
/sbin/iptables -A FORWARD -o eth1 -d 10.101.158.1 -p tcp --dport 21 -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -s 10.101.158.1 -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -s 0/0 -p tcp --dport 9000 -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -p tcp -d 192.168.10.1 --dport 9000 -j DNAT --to 10.101.158.1:1521
/sbin/iptables -t nat -A POSTROUTING -d 10.101.158.1 -p tcp --dport 9000 -j SNAT --to 10.101.158.66
/sbin/iptables -A FORWARD -o eth1 -d 10.101.158.1 -p tcp --dport 9000 -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -s 10.101.158.1 -p tcp --sport 9000 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -s 0/0 -p tcp --dport 23 -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -p tcp -d 192.168.10.1 --dport 23 -j DNAT --to 10.101.158.1:23
/sbin/iptables -t nat -A POSTROUTING -d 10.101.158.1 -p tcp --dport 23 -j SNAT --to 10.101.158.66
/sbin/iptables -A FORWARD -o eth1 -d 10.101.158.1 -p tcp --dport 23 -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -s 10.101.158.1 -p tcp --sport 23 -m state --state ESTABLISHED -j ACCEPT
sleep 10
/sbin/iptables-save >/etc/sysconfig/iptables




另外一个例子

#!/bin/bash
#echo '1' >/proc/sys/net/ipv4/ip_forward
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -P OUTPUT  ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -j ACCEPT
/sbin/iptables -F -t nat
/sbin/iptables -X -t nat
/sbin/iptables -Z -t nat
/sbin/iptables -t nat -P PREROUTING  ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT      ACCEPT
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i eth0 --dport  22  -j ACCEPT
/sbin/iptables -A INPUT -p TCP -i eth0 --dport  80  -j ACCEPT
/sbin/iptables -A OUTPUT -p udp -j DROP
/sbin/iptables -P INPUT DROP

sleep 10
/sbin/iptables-save >/etc/sysconfig/iptables

echo "end"