A classic and practical iptablesshell script

PS: This iptables script is good and practical. You can use it as needed. For your reference. Original Author alias name. The source code is as follows:

First, explain the parameter meanings in iptables:
A: add (Link)
-I: insert
-P: Protocol
-S: source IP address
-D: Target IP Address
-J: Operation Behavior
-T: Add Table
-- To-source: used for SNAT to indicate the SNAT source address.
-- To-destination: used for DNAT to indicate the destination address of the changed DANT.

ACCEPTPass

DROPFailed

 

-S 210.22.23.0/24 indicates that the source IP address is from 210.22.23.0 to 210.22.23.255.

 

The command for sealing IP segments is
Iptables-I INPUT-s 124.115.0.0/16-j DROP
Iptables-I INPUT-s 124.115.3.0/16-j DROP
Iptables-I INPUT-s 124.115.4.0/16-j DROP


#! /Bin/sh
#
Modprobe ipt_MASQUERADE
Modprobe ip_conntrack_ftp
Modprobe ip_nat_ftp
Iptables-F
Iptables-t nat-F
Iptables-X
Iptables-t nat-X
########################### INPUT key ########### ########################


Iptables-P INPUT DROP
Iptables-a input-m state -- state ESTABLISHED, RELATED-j ACCEPT
Iptables-a input-p tcp-m multiport -- dports 110,80, 25-j ACCEPT
Iptables-a input-p tcp-s 192.168.0.0/24 -- dport 139-j ACCEPT
# Allow Intranet samba, smtp, pop3, and connections
Iptables-a input-I eth1-p udp-m multiport -- dports 53-j ACCEPT
# Allow dns connection
Iptables-a input-p tcp -- dport 1723-j ACCEPT
Iptables-a input-p gre-j ACCEPT
# Allow Internet vpn connection
Iptables-a input-s 192.186.0.0/24-p tcp-m state -- state ESTABLISHED, RELATED-j ACCEPT
Iptables-a input-I ppp0-p tcp -- syn-m connlimit -- connlimit-above 15-j DROP
# To prevent too many DOS connections, a maximum of 15 Initial connections can be allowed, exceeding the discarding limit.
Iptables-a input-s 192.186.0.0/24-p tcp -- syn-m connlimit -- connlimit-above 15-j DROP
# To prevent too many DOS connections, a maximum of 15 Initial connections can be allowed, exceeding the discarding limit.
Iptables-a input-p icmp-m limit -- limit 3/s-j LOG -- log-level INFO -- log-prefix "ICMP packet IN :"
Iptables-a input-p icmp-j DROP
# Prohibit icmp communication-ping failure
Iptables-t nat-a postrouting-o ppp0-s 192.168.0.0/24-j MASQUERADE
# Intranet forwarding
Iptables-N syn-flood
Iptables-a input-p tcp -- syn-j syn-flood
Iptables-I syn-flood-p tcp-m limit -- limit 3/s -- limit-burst 6-j RETURN
Iptables-A syn-flood-j REJECT
# Lightweight anti-SYN Attack
####################### FORWARD chain ############### ############
Iptables-P FORWARD DROP
Iptables-a forward-p tcp-s 192.168.0.0/24-m multiport -- dports 80,110, 225, 1723-j ACCEPT
Iptables-a forward-p udp-s 192.168.0.0/24 -- dport 53-j ACCEPT
Iptables-a forward-p gre-s 192.168.0.0/24-j ACCEPT
Iptables-a forward-p icmp-s 192.168.0.0/24-j ACCEPT
# Allow vpn customers to connect to the Internet through the vpn Network
Iptables-a forward-m state -- state ESTABLISHED, RELATED-j ACCEPT
Iptables-I FORWARD-p udp -- dport 53-m string -- string "tencent"-m time -- timestart -- timestop -- days Mon, Tue, Wed, Thu, Fri, sat-j DROP
# Prohibit qq communication from-from Monday to Saturday
Iptables-I FORWARD-p udp -- dport 53-m string -- string "TENCENT"-m time -- timestart -- timestop -- days Mon, Tue, Wed, Thu, Fri, sat-j DROP
# Prohibit qq communication from-from Monday to Saturday
Iptables-I FORWARD-p udp -- dport 53-m string -- string "tencent"-m time -- timestart 13:30 -- timestop 20:30 -- days Mon, Tue, Wed, Thu, Fri, sat-j DROP
Iptables-I FORWARD-p udp -- dport 53-m string -- string "TENCENT"-m time -- timestart 13:30 -- timestop 20:30 -- days Mon, Tue, Wed, Thu, Fri, sat-j DROP
# Prohibit QQ communication from-from Monday to Saturday
Iptables-I FORWARD-s 192.168.0.0/24-m string -- string "qq.com"-m time -- timestart -- timestop -- days Mon, Tue, Wed, Thu, Fri, sat-j DROP
# Prohibit qq webpage from-from Monday to Saturday
Iptables-I FORWARD-s 192.168.0.0/24-m string -- string "qq.com"-m time -- timestart 13:00 -- timestop 20:30 -- days Mon, Tue, Wed, Thu, Fri, sat-j DROP
# Prohibit QQ webpage at-from Monday to Saturday
Iptables-I FORWARD-s 192.168.0.0/24-m string -- string "ay2000.net"-j DROP
Iptables-I FORWARD-d 192.168.0.0/24-m string -- string "Broadband cinema"-j DROP
Iptables-I FORWARD-s 192.168.0.0/24-m string -- string "porn"-j DROP
Iptables-I FORWARD-p tcp -- sport 80-m string -- string "ad"-j DROP
# Disable access to ay2000.net, broadband cinema, porn, and advertisement webpages! However, Chinese characters are not ideal.
Iptables-a forward-m ipp2p -- edk -- kazaa -- bit-j DROP
Iptables-a forward-p tcp-m ipp2p -- ares-j DROP
Iptables-a forward-p udp-m ipp2p -- kazaa-j DROP
# Disable BT connection
Iptables-a forward-p tcp -- syn -- dport 80-m connlimit -- connlimit-abve 15 -- connlimit-mask 24
######################################## ###############################
Sysctl-w net. ipv4.ip _ forward = 1 &>/dev/null
# Enable forwarding
######################################## ###############################
Sysctl-w net. ipv4.tcp _ syncookies = 1 &>/dev/null
# Enable syncookie (lightweight DOS attack Prevention)
Sysctl-w net. ipv4.netfilter. ip_conntrack_tcp_timeout_established = 3800 &>/dev/null
# Set the default TCP connection dementia duration to 3800 seconds (this option can greatly reduce the number of connections)
Sysctl-w net. ipv4.ip _ conntrack_max = 300000 &>/dev/null
# The maximum number of connection trees supported by the settings is 30 W (based on your memory and iptables version, each connection requires more than 300 bytes)
######################################## ###############################
Iptables-I INPUT-s 192.168.0.50-j ACCEPT
Iptables-I FORWARD-s 192.168.0.50-j ACCEPT
#192.168.0.50 is my sub-account. All are allowed!
########### ##############################