• 公告栏使用li标签,同时你可以使用FontAwesome以及其他HTML语法
  • FontAwesome示例
  • 人所处的绝境, 在很多情况下, 都不是生存的绝境, 而是精神的绝境!

Linux Iptables Firewall Shell Script For Standalone Server

菜鸟Linux笔记 shaobo 55次浏览 4027字 0个评论

#!/bin/bash

# A Linux Shell Script with common rules for IPTABLES Firewall.

# By default this script only open port 80, 22, 53 (input)

# All outgoing traffic is allowed (default - output)

# -------------------------------------------------------------------------

# Copyright (c) 2004 nixCraft project <http://cyberciti.biz/fb/>

# This script is licensed under GNU GPL version 2.0 or above

# -------------------------------------------------------------------------

# This script is part of nixCraft shell script collection (NSSC)

# Visit http://bash.cyberciti.biz/ for more information.

# -------------------------------------------------------------------------

 

IPT="/sbin/iptables"

SPAMLIST="blockedip"

SPAMDROPMSG="BLOCKED IP DROP"

 

echo "Starting IPv4 Wall..."

$IPT -F

$IPT -X

$IPT -t nat -F

$IPT -t nat -X

$IPT -t mangle -F

$IPT -t mangle -X

modprobe ip_conntrack

 

[ -f /root/scripts/blocked.ips.txt ] && BADIPS=$(egrep -v -E "^#|^$" /root/scripts/blocked.ips.txt)

 

PUB_IF="eth0"

 

#unlimited

$IPT -A INPUT -i lo -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT

 

# DROP all incomming traffic

$IPT -P INPUT DROP

$IPT -P OUTPUT DROP

$IPT -P FORWARD DROP

 

if [ -f /root/scripts/blocked.ips.txt ];

then

# create a new iptables list

$IPT -N $SPAMLIST

 

for ipblock in $BADIPS

do

$IPT -A $SPAMLIST -s $ipblock -j LOG --log-prefix "$SPAMDROPMSG"

$IPT -A $SPAMLIST -s $ipblock -j DROP

done

 

$IPT -I INPUT -j $SPAMLIST

$IPT -I OUTPUT -j $SPAMLIST

$IPT -I FORWARD -j $SPAMLIST

fi

 

# Block sync

$IPT -A INPUT -i ${PUB_IF} -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Drop Sync"

$IPT -A INPUT -i ${PUB_IF} -p tcp ! --syn -m state --state NEW -j DROP

 

# Block Fragments

$IPT -A INPUT -i ${PUB_IF} -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fragments Packets"

$IPT -A INPUT -i ${PUB_IF} -f -j DROP

 

# Block bad stuff

$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL ALL -j DROP

 

$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "NULL Packets"

$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -j DROP # NULL packets

 

$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

 

$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "XMAS Packets"

$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS

 

$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fin Packets Scan"

$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans

 

$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

 

# Allow full outgoing connection but no incomming stuff

$IPT -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A OUTPUT -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

 

# Allow ssh

$IPT -A INPUT -p tcp --destination-port 22 -j ACCEPT

 

# allow incomming ICMP ping pong stuff

$IPT -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A OUTPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACCEPT

 

# Allow port 53 tcp/udp (DNS Server)

$IPT -A INPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A OUTPUT -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT

 

$IPT -A INPUT -p tcp --destination-port 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A OUTPUT -p tcp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT

 

# Open port 80

$IPT -A INPUT -p tcp --destination-port 80 -j ACCEPT

##### Add your rules below ######

 

##### END your rules ############

 

# Do not log smb/windows sharing packets - too much logging

$IPT -A INPUT -p tcp -i eth0 --dport 137:139 -j REJECT

$IPT -A INPUT -p udp -i eth0 --dport 137:139 -j REJECT

 

# log everything else and drop

$IPT -A INPUT -j LOG

$IPT -A FORWARD -j LOG

$IPT -A INPUT -j DROP

exit 0

---------------------------------------------------------

How do I install and use this script?

Type the following command as root server:

# mkdir /root/scripts

# cd /root/scripts

# wget http://bash.cyberciti.biz/dl/381.sh.zip

# wget http://bash.cyberciti.biz/dl/151.sh.zip

# unzip 381.sh.zip

# unzip 151.sh.zip

# mv 381.sh start.fw

# mv 151.sh stop.fw

# chmod +x *.fw

Now edit firewall as per your requirements:
# vi /root/scripts/start.fw
Install firewall:
# echo '/root/scripts/start.fw' >> /etc/rc.local

How do I start firewall from a shell prompt?

# /root/scripts/start.fw

How do I stop firewall from a shell prompt?

# /root/scripts/stop.fw


喜欢 (0)

您必须 登录 才能发表评论!