Customer requirements, do not want to allow foreign IP to access the server, would have to let the computer room in the upper route to solve, but those people do not bird you!!! ~~~~
In this case, you can only use iptables to solve the ~~~~~~~~~
About the IP library you can go to http://www.ipdeny.com/ipblocks/download, there are various countries ~ ~ ~
Copy Code code as follows:
#下载ip库
#wget Http://rfyiamcool.googlecode.com/files/allip.txt
wget Http://www.ipdeny.com/ipblocks/data/countries/cn.zone
#把分号去掉
Sed-i ' s/;$//' allip.txt
#把ip端调出来
For i in ' Cat Cn.zone '
Todo
echo "Iptables-a input-s $i-j ACCEPT" >>iptables.sh
Done
Cat iptables.sh
To optimize this script, add the following command to the iptables.sh front!
Copy Code code as follows:
#!/bin/bash
Ziji= "222.173.13.5"
Iptables-f
Iptables-x
Iptables-z
Iptables-t nat-f
Iptables-t mangle-f
Modprobe Iptable_nat
Modprobe ip_nat_ftp
Modprobe Ip_nat_irc
Modprobe Ip_conntrack
Modprobe ip_conntrack_ftp
Modprobe Ip_conntrack_irc
Modprobe Ipt_limit
Modprobe ipt_recent ip_list_tot=16384
Modprobe Ip_conntrack hashsize=16384
echo "1024 63000" >/proc/sys/net/ipv4/ip_local_port_range
echo "1" >/proc/sys/net/ipv4/tcp_tw_recycle
echo "1" >/proc/sys/net/ipv4/tcp_tw_reuse
echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" >/proc/sys/net/ipv4/conf/all/log_martians
echo "1" >/proc/sys/net/ipv4/tcp_syncookies
echo "2" >/proc/sys/net/ipv4/tcp_synack_retries
echo "5000" >/proc/sys/net/ipv4/tcp_max_syn_backlog
echo "3" >/proc/sys/net/ipv4/tcp_syn_retries
echo "1" >/proc/sys/net/ipv4/tcp_tw_reuse
echo "1" >/proc/sys/net/ipv4/tcp_tw_recycle
echo ">/proc/sys/net/ipv4/tcp_fin_timeout"
echo "1800" >/proc/sys/net/ipv4/tcp_keepalive_time
echo "1" >/proc/sys/net/ipv4/ip_forward
Iptables-p INPUT DROP
Iptables-p FORWARD ACCEPT
Iptables-p OUTPUT ACCEPT
/sbin/iptables-t nat-p prerouting ACCEPT
/sbin/iptables-t nat-p postrouting ACCEPT
Iptables-a input-s $ziji-j ACCEPT
Iptables-a input-i lo-j ACCEPT
Iptables-a input-m State--state established,related-j ACCEPT
Iptables-a input-p TCP! --syn-m State--state New-j DROP
Below is the effect figure ~~~~~~~~~~~~~~~~ (just the main body machine, we are not ping O (∩_∩) o~)
