Iptables firewall script application

This script is used to modify the classic iptables firewall script of laruence, which simplifies the application to the single-host server environment.

1. Place the firewall rule file in the corresponding directory

(1) Firewall Rules

Iptables. rule is as follows:

 

#!/bin/bash ######################################################################### EXTIF="em1"INIF="em2"INNET=""export EXTIF INIF INNET ########################################################################## echo "1" /proc/sys/net/ipv4/tcp_syncookiesecho "1" /proc/sys/net/ipv4/icmp_echo_ignore_broadcastsfor i in /proc/sys/net/ipv4/conf/*/{rp_filter,log_martians};do    echo "1" > $i donefor i in /proc/sys/net/ipv4/conf/*/{accept_source_route,accept_redirects,\ send_redirects};do    echo "0" > $i done########################################################################### PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin; export PATH iptables -F iptables -X iptables -Z iptables -P INPUT   DROP iptables -P OUTPUT  ACCEPT iptables -P FORWARD ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT ############################################################################ if [ -f /usr/local/virus/iptables/iptables.deny ]; then    sh /usr/local/virus/iptables/iptables.deny fiif [ -f /usr/local/virus/iptables/iptables.allow ]; then    sh /usr/local/virus/iptables/iptables.allow fiif [ -f /usr/local/virus/iptables/iptables.http ]; then    sh /usr/local/virus/iptables/iptables.http fi############################################################################# AICMP="0 3 3/4 4 11 12 14 16 18"for tyicmp in $AICMP do  iptables -A INPUT -i $EXTIF -p icmp --icmp-type $tyicmp -j ACCEPT doneiptables -A INPUT -s 172.16.0.1 -p icmp --icmp-type 8 -j ACCEPT #Cacti Request ############################################################################# #iptables -A INPUT -p TCP -i $EXTIF --dport 21 --sport 1024:65534 -j ACCEPT #FTP iptables -A INPUT -p TCP -i $EXTIF --dport 1230:1234 --sport 1024:65534 -j ACCEPT #Game_Server iptables -A INPUT -p TCP -i $EXTIF --dport 22 --sport 1024:65534 -j ACCEPT #SSH #iptables -A INPUT -p TCP -i $EXTIF --dport 25 --sport 1024:65534 -j ACCEPT #SMTP #iptables -A INPUT -p UDP -i $EXTIF --dport 53 --sport 1024:65534 -j ACCEPT #DNS #iptables -A INPUT -p TCP -i $EXTIF --dport 53 --sport 1024:65534 -j ACCEPT #DNS iptables -A INPUT -p TCP -i $EXTIF --dport 80 --sport 1024:65534 -j ACCEPT #WWW iptables -A INPUT -p TCP -i $EXTIF --dport 3306 --sport 1024:65534 -j ACCEPT #MySQL iptables -A INPUT -p UDP -i $EXTIF --dport 161 --sport 1024:65534 -j ACCEPT #SNMP #iptables -A INPUT -p TCP -i $EXTIF --dport 110 --sport 1024:65534 -j ACCEPT #POP3 #iptables -A INPUT -p TCP -i $EXTIF --dport 443 --sport 1024:65534 -j ACCEPT #HTTPS ############################################################################## /etc/init.d/iptables save

 

 

Iptables. allow:

 

#! /bin/bash iptables -A INPUT -i $EXTIF -s 172.16.0.1 -p tcp --dport 22 -j ACCEPT

 

Iptables. deny is as follows:

 

#! /bin/bash iptables -A INPUT -i $EXTIF -s 172.16.0.2 -j DROP

 

(2) directory:

# mkdir -p /usr/local/virus/iptables# cp /tools/iptables.* /usr/local/virus/iptables/

2. Grant Permissions

# cd /usr/local/virus/iptables/# chmod 700 iptables.*

 

3. Add to enable auto-start

# vim /etc/rc.d/rc.local#YX Firewall /usr/local/virus/iptables/iptables.rule