iptables 网关配置模版（二）
#!/bin/bash IPT=/sbin/iptables LAN_GW_IP=192.168.204.128 WAN_GW_IP=192.168.204.130 LAN_SERVER=192.168.0.14 echo 1 > /proc/sys/net/ipv4/ip_forward modprobe ip_tables modprobe iptable_filter modprobe iptable_nat modprobe ip_conntrack modprobe ip_conntrack_ftp modprobe ip_nat_ftp modprobe ipt_state #Remove any existing rules $IPT -F $IPT -X #setting default firewall policy $IPT --policy OUTPUT ACCEPT $IPT --policy FORWARD ACCEPT $IPT -P INPUT DROP #setting for loopback interface $IPT -A INPUT -i lo -j ACCEPT $IPT -A OUTPUT -o lo -j ACCEPT $IPT -A INPUT -m state --state INVALID -j DROP $IPT -A OUTPUT -m state --state INVALID -j DROP # Source Address Spoofing and Other Bad Addresses $IPT -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP $IPT -A INPUT -i eth0 -s 0.0.0.0/8 -j DROP $IPT -A INPUT -i eth0 -s 169.254.0.0/16 -j DROP $IPT -A INPUT -i eth0 -s 192.0.2.0/24 -j DROP # prevent all Stealth Scans and TCP State Flags $IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP # All of the bits are cleared $IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP $IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP #SYN and RST are both set $IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP # SYN and FIN are both set $IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP # FIN and RST are both set $IPT -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP # FIN is the only bit set, without the expected accompanying ACK $IPT -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP # PSH is the only bit set, without the expected accompanying ACK $IPT -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP # URG is the only bit set, without the expected accompanying ACK $IPT -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP #setting access rules #one,ip access rules,allow all the ips of hudong.com $IPT -A INPUT -s 202.81.17.0/24 -p all -j ACCEPT $IPT -A INPUT -s 202.81.18.0/24 -p all -j ACCEPT $IPT -A INPUT -s 124.43.62.96/27 -p all -j ACCEPT $IPT -A INPUT -s 192.168.1.0/24 -p all -j ACCEPT $IPT -A INPUT -s 10.0.0.0/24 -p all -j ACCEPT #second,port access rules #nagios $IPT -A INPUT -s 192.168.1.0/24 -p tcp --dport 5666 -j ACCEPT $IPT -A INPUT -s 202.81.17.0/24 -p tcp --dport 5666 -j ACCEPT $IPT -A INPUT -s 202.81.18.0/24 -p tcp --dport 5666 -j ACCEPT #db $IPT -A INPUT -s 192.168.1.0/24 -p tcp --dport 3306 -j ACCEPT $IPT -A INPUT -s 192.168.1.0/24 -p tcp --dport 3307 -j ACCEPT $IPT -A INPUT -s 192.168.1.0/24 -p tcp --dport 3308 -j ACCEPT $IPT -A INPUT -s 192.168.1.0/24 -p tcp --dport 1521 -j ACCEPT #ssh difference from other servers here.........................................................>> $IPT -A INPUT -s 202.81.17.0/24 -p tcp --dport 50718 -j ACCEPT $IPT -A INPUT -s 202.81.18.0/24 -p tcp --dport 50718 -j ACCEPT $IPT -A INPUT -s 124.43.62.96/27 -p tcp --dport 50718 -j ACCEPT $IPT -A INPUT -s 192.168.1.0/24 -p tcp --dport 50718 -j ACCEPT $IPT -A INPUT -p tcp --dport 22 -j ACCEPT #ftp #$IPT -A INPUT -p tcp --dport 21 -j ACCEPT #http $IPT -A INPUT -p tcp --dport 80 -j ACCEPT $IPT -A INPUT -s 192.168.1.0/24 -p tcp -m multiport --dport 8080,8081,8082,8888,8010,8020,8030,8150 -j ACCEPT $IPT -A INPUT -s 202.81.17.0/24 -p tcp -m multiport --dport 8080,8081,8082,8888,8010,8020,8030,8150 -j ACCEPT $IPT -A INPUT -s 124.43.62.96/27 -p tcp -m multiport --dport 8080,8081,8082,8888,8010,8020,8030,8150 -j ACCEPT #snmp $IPT -A INPUT -s 192.168.1.0/24 -p UDP --dport 161 -j ACCEPT $IPT -A INPUT -s 202.81.17.0/24 -p UDP --dport 161 -j ACCEPT $IPT -A INPUT -s 202.81.18.0/24 -p UDP --dport 161 -j ACCEPT #rsync $IPT -A INPUT -s 192.168.1.0/24 -p tcp -m tcp --dport 873 -j ACCEPT $IPT -A INPUT -s 202.81.17.0/24 -p tcp -m tcp --dport 873 -j ACCEPT $IPT -A INPUT -s 202.81.18.0/24 -p tcp -m tcp --dport 873 -j ACCEPT $IPT -A INPUT -s 124.43.62.96/27 -p tcp -m tcp --dport 873 -j ACCEPT #nfs 2049,portmap 111 $IPT -A INPUT -s 192.168.1.0/24 -p udp -m multiport --dport 111,892,2049 -j ACCEPT $IPT -A INPUT -s 192.168.1.0/24 -p tcp -m multiport --dport 111,892,2049 -j ACCEPT #others RELATED #$IPT -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT $IPT -A INPUT -s 124.43.62.96/27 -p icmp -m icmp --icmp-type any -j ACCEPT $IPT -A INPUT -s 192.168.1.0/24 -p icmp -m icmp --icmp-type any -j ACCEPT $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT ###############nat start############################## #nat internet iptables -t nat -A POSTROUTING -s 192.168.0.0/255.255.255.0 -o eth1 -j SNAT --to-source $LAN_GW_IP #www server nat wan to lan iptables -t nat -A PREROUTING -d $WAN_GW_IP -p tcp -m tcp --dport 80 -j DNAT --to-destination $$LAN_SERVER:80 iptables -t nat -A POSTROUTING -d $LAN_SERVER -p tcp --dport 80 -j SNAT --to LAN_GW_I
本文出自 “·`米笵6” 博客，请务必保留此出处http://mifan6.blog.51cto.com/9954601/1713268
原文：http://mifan6.blog.51cto.com/9954601/1713268