Use iptables to set some security protection functions (2)

Article Title: Use iptables to set some security protection functions (2 ). Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
Author: kenduest (xiaozhou)
Below are some simple rules for setting iptables. For more information, see. (It has nothing to do with NAT)
　　
# Mount related modules
Modprobe ip_tables
Modprobe ip_conntrack
Modprobe ip_conntrack_ftp
Modprobe ip_conntrack_irc
　　
# Resetting
Iptables-F
Iptables-X
Iptables-F-t nat
Iptables-X-t mangle
　　
# Disable FORWARD
Iptables-P FORWARD DROP
　　
# This is to enable your domain to be easily linked, that is, this domain is not protected
　　
Iptables-a input-p all-s ip_net/netmask-j ACCEPT
　　
# Allow related link services
　　
Iptables-a input-I eth0-p tcp -- dport 20-j ACCEPT
Iptables-a input-I eth0-p tcp -- dport 21-j ACCEPT
Iptables-a input-I eth0-p tcp -- dport 22-j ACCEPT
Iptables-a input-I eth0-p tcp -- dport 23-j ACCEPT
Iptables-a input-I eth0-p tcp -- dport 25-j ACCEPT
Iptables-a input-I eth0-p tcp -- dport 53-j ACCEPT
Iptables-a input-I eth0-p udp -- dport 53-j ACCEPT
Iptables-a input-I eth0-p tcp -- dport 110-j ACCEPT
Iptables-a input-I eth0-p tcp -- dport 113-j ACCEPT
　　
Iptables-a input-I eth0-m state -- state RELATED, ESTABLISHED-j ACCEPT
Iptables-a input-I eth0-m state -- state NEW, INVALID-j DROP
　　
The preceding section enables services such as port 20, 21, 22, 23, 25, 53, 110, and 113.
Connected by external users.
　　
Port 20 and port 21: used by ftp.
Port 22: ssh online
Port 23: telnet. It is easy to use, but it is not open and secure.
Port 25: use sendmail. Send emails.
Port 53: used by dns. Dns needs to enable udp.
Port 110: pop3
Port 113: auth authentication. I open some hosts that use the 113 Authentication
It will not be stuck for a long time during Reverse lookup.
　　
The last line is rejected for active or invalid connections.
　　
This script content is suitable for only allow external links to specific port services, and the rest
Port rejects external connections. For example, if you use Modem to dial, you only want
Normally going online, external services cannot come in. (Ps: the modem uses ppp0
And so on, the above eth0 should be changed to ppp0)