One-click configuration script for CentOSiptables firewall

It is too cumbersome to configure iptables for several VPS. I saw a script for automatically configuring the iptables firewall in Zhu Ge's LNMP script. I borrowed it and changed it for the people who needed it; only common port settings are provided. if you have special requirements, you only need to add or reduce the corresponding Port. usage: wget-chttp: // ph4ntasy.googlecode.com/f several VPS configurations IptablesThis is too cumbersome. we can see that there is an automatic configuration in Zhu Ge's LNMP script. IptablesThe firewall script has been borrowed and modified for users who need it;
Only common port settings are provided. if you have special requirements, you only need to add or reduce the corresponding port;
Usage:
Http://ph4ntasy.googlecode.com/files/iptables.sh wget-c
Chmod + x iptables. sh
./Iptables. sh
Set iptables to automatically start upon startup:
Chkconfig -- level 345 iptables on
Complete Shell:

#! /Bin/bashPATH =/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin :~ /Binexport PATHfunction support_distro () {if [-z "'egrep-I" centos system now. "exit 1fi} support_distroecho" ========================== iptablesconfigure ==== ===================================================" # Created by Centos. bz Modified by ph4ntasy.com # Only support CentOS system # obtain the SSH Port if grep "^ Port"/etc/ssh/sshd_config>/dev/null; thensshdport = 'grep "^ Port"/etc/ssh/sshd_config | sed "s/Port \ s // g" 'Els Esshdport = 22fi # obtain the DNS server IPif [-s/etc/resolv. conf]; thennameserver1 = 'cat/etc/resolv. conf | grep nameserver | awk 'NR = 1 {print $2} ''nameserver2 = 'cat/etc/resolv. conf | grep nameserver | awk 'NR = 2 {print $2} ''fiIPT ="/sbin/iptables "# delete an existing rule $ ERT -- delete-chain $ ip-- flush # forbidden, allow, allow the back-to-ring network adapter $ ipt-p input drop $ ipt-p forward drop $ ipt-p output accept $ ipt-a INPUT-I lo-j ACCEPT # Allow established or related connections $ ipt-a INPU T-m state -- state RELATED, ESTABLISHED-j ACCEPT $ EPT-a output-m state -- state RELATED, ESTABLISHED-j ACCEPT # limit the maximum number of connections to a single IP address on port 80 to 10 $ ipt-i INPUT-p tcp -- dport 80-m connlimit -- connlimit-abve 10-j DROP # Allow 80 (HTTP) /873 (RSYNC)/443 (HTTPS)/20, 21 (FTP)/25 (SMTP) port connection $ ipt-a INPUT-p tcp-m tcp -- dport 80-j ACCEPT $ ipt-a INPUT-p tcp-m tcp -- dport 873-j ACCEPT $ ipt- a input-p tcp-m tcp -- dport 443-j ACCEPT $ EPT-a input-p tcp-m tcp -- dport 20-j ACCEPT $ EPT-a input-p tcp-m tcp -- dport 21-j ACCEPT $ EPT-A INPUT -p tcp-m tcp -- dport 25-j ACCEPT # Allow SSH port connection, the script automatically detects the current SSH port, otherwise, port 22 is used by default. $ ipt-a INPUT-p tcp-m tcp -- dport $ sshdport-j ACCEPT # ping $ ipt-a INPUT-p icmp-m icmp -- icmp- type 8-j ACCEPT $ EPT-a input-p icmp-m icmp -- icmp-type 11-j ACCEPT # Allow DNS [! -Z "$ nameserver1"] & $ EPT-a output-p udp-m udp-d $ nameserver1 -- dport 53-j ACCEPT [! -Z "$ nameserver2"] & $ EPT-a output-p udp-m udp-d $ nameserver2 -- dport 53-j ACCEPT # save the rule and restart IPTABLESservice iptables saveservice iptables restartecho "========================== iptables configurecompleted ========== ========================================"