linux常见防火墙

#! /bin/bash
 
# ------------------------------------------
# File: /usr/local/sbin/firewall
#       root:root, 700
# Created by Statemood, 2013.08.29
# Updated by Statemood, 2013.08.29
#
# ------------------------------------------
 
PORT_SSH='7168'
CORP_IP1='210.13.116.210'
CORP_IP2='122.192.65.148'
 
IPTABLES='/sbin/iptables'
MODPROBE='/sbin/modprobe'
 
KERN_MOD='ip_conntrack'
 
# Load Kernel modules
 
for mod in $KERN_MOD
do
    $MODPROBE $KERN_MOD
done
 
# init iptables
$IPTABLES -F
$IPTABLES -X
$IPTABLES -P INPUT DROP
 
$IPTABLES -N LGDRP
 
 
# ACCEPT rules
# --------------------------------
 
# Default rules
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate INVALID                -j LGDRP
$IPTABLES -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED    -j ACCEPT
 
$IPTABLES -A LGDRP -m limit --limit 10/m --limit-burst 5 -j LOG --log-prefix "INVALID DROP " --log-ip-option --log-tcp-option
$IPTABLES -A LGDRP -j DROP
 
# SSH 
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp -s $CORP_IP1         --dport $PORT_SSH -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp -s $CORP_IP2         --dport $PORT_SSH -j ACCEPT
 
 
# Accept Ping from $CORP_IP1
$IPTABLES -A INPUT -p icmp  --icmp-type echo-request -s $CORP_IP1                       -j ACCEPT
$IPTABLES -A INPUT -p icmp  --icmp-type echo-request -s $CORP_IP2                       -j ACCEPT
 
# Coustom rules
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp          --dport 80    -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp                      --dport 8080    -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp                      --dport 8800    -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp                      --dport 18088    -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp                      --dport 28088    -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp                      --dport 38088    -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp                      --dport 18080    -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp                      --dport 28080    -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp                      --dport 38080    -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate NEW -p tcp                      --dport 111   -j DROP
 
 
# Unmatched rules
$IPTABLES -A INPUT -j DROP
 
# Save rules
/sbin/service iptables save
 
printf "`date +'%F %T'` \033[1;33mAll rules loaded\n\033[0m"
将上面另存为firewall文件
放到 /usr/local/sbin/, 执行 chown root:root /usr/local/sbin/firewall, chmod 700 /usr/local/sbin/firewall
然后执行 firewall 即可
猜你喜欢
