Iptables 瑞士军刀

netfilter/iptables可以配置有状态的防火墙。iptables设置filter过滤表，nat转发表，mangle修改数据包的表。

iptables设置的防火墙规则 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

#! /bin/bash
#1.输入相关参数
EXTIF="eth0"
INIF=""
INNET=""

export EXTIF INIF INNET

#2.设置内核的网络功能
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

#3.清除规则，设置默认策略和开放lo
iptables -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#4.启动额外的防火墙script模块
if [ -f /usr/local/iptables/iptables.deny ] ; then
  sh /usr/local/iptables/iptables.deny
fi

#5.允许其它类型的icmp包进入
AICMP="0 3 3/4 4 11 12 14 16 18"
for typeicmp in $AICMP
do
  iptables -A INPUT -i $EXTIF -p icmp --icmp-type $typeicmp -j ACCEPT
done

#6.允许某些服务进入
iptables -A INPUT -p TCP -i $EXTIF --dport 21 --sport 1024:65535 -j ACCEPT  #FTP
iptables -A INPUT -p TCP -i $EXTIF --dport 22 --sport 1024:65535 -j ACCEPT  #SSH
iptables -A INPUT -p TCP -i $EXTIF --dport 25 --sport 1024:65535 -j ACCEPT  #SMTP
iptables -A INPUT -p UDP -i $EXTIF --dport 53 --sport 1024:65535 -j ACCEPT  #DNS
iptables -A INPUT -p TCP -i $EXTIF --dport 53 --sport 1024:65535 -j ACCEPT  #DNS
iptables -A INPUT -p TCP -i $EXTIF --dport 80 --sport 1024:65535 -j ACCEPT  #WWW
iptables -A INPUT -p TCP -i $EXTIF --dport 110 --sport 1024:65535 -j ACCEPT  #POP3
iptables -A INPUT -p TCP -i $EXTIF --dport 443 --sport 1024:65535 -j ACCEPT  #HTTPS

#7.先加载有用的模块
modules="ip_tables iptable_nat ip_nat_ftp ip_nat_irc ip_conntrack ip_conntrack_ftp ip_conntrack_irc"
for mod in $modules
do
  testmod=`lsmod | grep "^${mod}" | awk '{print $1}'`
  if [ "$testmod" == "" ] ; then
      modprobe $mod
  fi
done

#8.清除nat table的规则
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

#9.若有内部接口的存在（双网卡）开放成为路由器，且为ip分享器
if [ "$INIF" != "" ] ; then
  iptables -A INPUT -i $INIF -j ACCEPT
  echo "1" >     /proc/sys/net/ipv4/ip_forward
  if [ "$INNET" != "" ] ; then
      for innet in $INNET
      do
          iptables -t nat -A POSTROUTING -s $innet -o $EXTIF -j MASQUERADE
      done
  fi
fi

Comments