The hands of several VPS configuration iptables too cumbersome to see the Zhu Go lnmp script has an automatic configuration iptables firewall script, borrowed to change a bit, to the needs of the people;
Only provide common port settings, if you have special needs only to add or reduce the corresponding port;
How to use:
Copy Code code as follows:
chmod +x iptables.sh
./iptables.sh
Set Iptables to boot automatically:
Copy Code code as follows:
Chkconfig--level 345 iptables on
Full Shell:
Copy Code code as follows:
#!/bin/bash
Path=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin
Export PATH
function Support_distro () {
If [-Z "' Egrep-i" CentOS "/etc/issue '"];then
echo "Sorry,iptables script only support CentOS system now."
Exit 1
Fi
}
Support_distro
echo "============================iptables configure============================================"
# only Support CentOS system
# Get SSH Port
If grep "^port"/etc/ssh/sshd_config>/dev/null;then
sshdport= ' grep ' ^port '/etc/ssh/sshd_config | Sed "s/port\s//g" '
Else
Sshdport=22
Fi
# Get DNS server IP
if [-s/etc/resolv.conf];then
Nameserver1= ' cat/etc/resolv.conf |grep nameserver |awk ' nr==1{print $} '
Nameserver2= ' cat/etc/resolv.conf |grep nameserver |awk ' nr==2{print $} '
Fi
ipt= "/sbin/iptables"
# Delete existing rules
$IPT--delete-chain
$IPT--flush
# No Enter, allow out, allow loopback network card
$IPT-P INPUT DROP
$IPT-P FORWARD DROP
$IPT-P OUTPUT ACCEPT
$IPT-A input-i lo-j ACCEPT
# Allow access to established or associated connections
$IPT-A input-m State--state related,established-j ACCEPT
$IPT-A output-m State--state related,established-j ACCEPT
# Limit the maximum number of connections for 80-port single IP to 10
$IPT-I input-p TCP--dport 80-m connlimit--connlimit-above 10-j DROP
# Connections to allow (HTTP)/873 (RSYNC)/443 (HTTPS)/20,21 (FTP)/25 (SMTP) ports
$IPT-A input-p tcp-m TCP--dport 80-j ACCEPT
$IPT-A input-p tcp-m TCP--dport 873-j ACCEPT
$IPT-A input-p tcp-m TCP--dport 443-j ACCEPT
$IPT-A input-p tcp-m TCP--dport 20-j ACCEPT
$IPT-A input-p tcp-m TCP--dport 21-j ACCEPT
$IPT-A input-p tcp-m TCP--dport 25-j ACCEPT
# allow the SSH port connection, the script automatically detects the current SSH port, otherwise the default is 22 ports
$IPT-A input-p tcp-m tcp--dport $sshdport-j ACCEPT
# Allow Ping
$IPT-A input-p icmp-m ICMP--icmp-type 8-j ACCEPT
$IPT-A input-p icmp-m ICMP--icmp-type 11-j ACCEPT
# Allow DNS
[!-Z "$nameserver 1"] && $IPT-A output-p udp-m udp-d $nameserver 1--dport 53-j ACCEPT
[!-Z "$nameserver 2"] && $IPT-A output-p udp-m udp-d $nameserver 2--dport 53-j ACCEPT
# Save rule and restart Iptables
Service Iptables Save
Service Iptables Restart
echo "============================iptables Configure completed============================================"
