Collection of common configuration rules of iptables firewall

Only send and receive messages, other close iptables-IFilter-mmac -- mac-source00: 0F: EA: 25: 51: 37-jDROPiptables-IFilter-mmac -- mac-source00: 0F: EA: 25: 51: 37-pudp -- dport53-jACCEPTiptables-IFilter-mma Only emails can be sent and received. All other emails are disabled.
Iptables-I Filter-m mac -- mac-source 00: 0F: EA: 25: 51: 37-jDROP
Iptables-I Filter-m mac -- mac-source 00: 0F: EA: 25: 51: 37-p udp -- dport 53-j ACCEPT
Iptables-I Filter-m mac -- mac-source 00: 0F: EA: 25: 51: 37-p tcp -- dport 25-j ACCEPT
Iptables-I Filter-m mac -- mac-source 00: 0F: EA: 25: 51: 37-p tcp -- dport 110-j ACCEPT

Ipsec nat policy
Iptables-I PFWanPriv-d 192.168.100.2-j ACCEPT
Iptables-t nat-a prerouting-p tcp -- dport 80-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.2: 80
Iptables-t nat-a prerouting-p tcp -- dport 1723-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.2: 1723
Iptables-t nat-a prerouting-p udp -- dport 1723-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.2: 1723
Iptables-t nat-a prerouting-p udp -- dport 500-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.2: 500
Iptables-t nat-a prerouting-p udp -- dport 4500-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.2: 4500

NAT of the FTP server
Iptables-I PFWanPriv-p tcp -- dport 21-d 192.168.100.200-jACCEPT
Iptables-t nat-a prerouting-p tcp -- dport 21-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.200: 21

Only access to the specified URL is allowed
Iptables-A Filter-p udp -- dport 53-jACCEPT
Iptables-A Filter-p tcp -- dport 53-j ACCEPT
Iptables-A Filter-d www.server110.com-j ACCEPT
Iptables-A Filter-d www.baidu.com-j ACCEPT
Iptables-A Filter-j DROP

Open some ports of an IP address, and other ports are closed
Iptables-A Filter-p tcp -- dport 80-s 192.168.100.200-d www.server110.com-j ACCEPT
Iptables-A Filter-p tcp -- dport 25-s 192.168.100.200-jACCEPT
Iptables-A Filter-p tcp -- dport 109-s 192.168.100.200-jACCEPT
Iptables-A Filter-p tcp -- dport 110-s 192.168.100.200-jACCEPT
Iptables-A Filter-p tcp -- dport 53-j ACCEPT
Iptables-A Filter-p udp -- dport 53-j ACCEPT
Iptables-A Filter-j DROP

Multiple ports
Iptables-A Filter-p tcp-m multiport -- destination-port 22,53, 80,110-s 192.168.20.3-j REJECT

Continuous Port
Iptables-A Filter-p tcp-m multiport -- source-port 22,53, 80,110-s 192.168.20.3-j REJECT iptables-A Filter-p tcp -- source-port2: 80-s 192.168.20.3-j REJECT

Internet access at specified time
Iptables-A Filter-s 10.10.10.253-m time -- timestart 6:00 -- timestop 11:00 -- days Mon, Tue, Wed, Thu, Fri, Sat, Sun-j DROP
Iptables-A Filter-m time -- timestart 12:00 -- timestop 13:00 -- days Mon, Tue, Wed, Thu, Fri, Sat, Sun-j ACCEPT
Iptables-A Filter-m time -- timestart 17:30 -- timestop 8:30 -- daysMon, Tue, Wed, Thu, Fri, Sat, Sun-j ACCEPT

Disable multiple port services
Iptables-A Filter-m multiport-p tcp -- dport 21,23, 80-jACCEPT

Nat wan port to PC
Iptables-t nat-a prerouting-I $ INTERNET_IF-d $ INTERNET_ADDR-j DNAT -- to-destination192.168.0.1

NAT port 8000 of the WAN port to port 192. 168. 100. Port 80 of 200
Iptables-t nat-APREROUTING-p tcp -- dport 8000-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.200: 80

Port to be transferred by the MAIL server
Iptables-t nat-a prerouting-p tcp -- dport 110-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.200: 110
Iptables-t nat-a prerouting-p tcp -- dport 25-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.200: 25

Only PING 202 is allowed. 96. 134. 133. All other services are prohibited.
Iptables-A Filter-p icmp-s 192.168.100.200-d 202.96.134.small-jACCEPT
Iptables-A Filter-j DROP

Disable BT configuration
Iptables CA Filter Cp tcp Cdport 6000: 20000 CjDROP

Disable QQ firewall configuration
Iptables-A Filter-p udp -- dport! 53-jDROP
Iptables-A Filter-d 218.17.209.0/24-j DROP
Iptables-A Filter-d 218.18.95.0/24-j DROP
Iptables-A Filter-d 219.133.40.177-j DROP

Only emails can be sent and received based on MAC, and other emails are rejected.
Iptables-I Filter-m mac -- mac-source00: 0A: EB: 97: 79: A1-j DROP
Iptables-I Filter-m mac -- mac-source 00: 0A: EB: 97: 79: A1-p tcp -- dport 25-j ACCEPT
Iptables-I Filter-m mac -- mac-source 00: 0A: EB: 97: 79: A1-p tcp -- dport 110-j ACCEPT

Disable MSN configuration
Iptables-A Filter-p udp -- dport 9-j DROP
Iptables-A Filter-p tcp -- dport 1863-j DROP
Iptables-A Filter-p tcp -- dport 80-d 207.68.178.238-j DROP
Iptables-A Filter-p tcp -- dport 80-d 207.46.110.0/24-j DROP

Only PING 202 is allowed. 96. 134. 133 other public IP addresses cannot be pinged.
Iptables-A Filter-p icmp-s 192.168.100.200-d 202.96.134.small-j ACCEPT
Iptables-A Filter-p icmp-j DROP

Prohibit a MAC address from accessing the internet:
Iptables-I Filter-m mac -- mac-source 00: 20: 18: 8F: 72: F8-jDROP

Disable PING from an IP address:
Iptables CA Filter Cp icmp Cs 192.168.0.1Cj DROP

Disable an IP address service:
Iptables CA Filter-p tcp-s 192.168.0.1 -- dport 80-j DROP
Iptables CA Filter-p udp-s 192.168.0.1 -- dport 53-j DROP

Only some services are allowed, and others are rejected (2 rules)
Iptables-A Filter-p tcp-s192.168.0.1 -- dport 1000-j ACCEPT
Iptables-A Filter-j DROP

Disable a port service of an IP address
Iptables-A Filter-p tcp-s10.10.10.253 -- dport 80-j ACCEPT
Iptables-A Filter-p tcp-s 10.10.10.253 -- dport 80-j DROP

Disable a port service of a MAC address
Iptables-I Filter-p tcp-m mac -- mac-source 00: 20: 18: 8F: 72: F8 -- dport 80-j DROP

Prohibit a MAC address from accessing the internet:
Iptables-I Filter-m mac -- mac-source 00: 11: 22: 33: 44: 55-jDROP

Disable PING from an IP address:
Iptables CA Filter Cp icmp Cs 192.168.0.1 Cj DROP