iptables防火墙脚本应用

本脚本修改自鸟哥的经典iptables防火墙脚本，做了简化适用于单机服务器环境

1、将防火墙规则文件放置在相应的目录内

（1）防火墙规则

iptables.rule 如下：

#!/bin/bash
#########################################################################
EXTIF=”em1″
INIF=”em2″
INNET=””
export EXTIF INIF INNET
##########################################################################
echo “1” /proc/sys/net/ipv4/tcp_syncookies
echo “1” /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
for i in /proc/sys/net/ipv4/conf/*/{rp_filter,log_martians};do
    echo “1” > $i
done
for i in /proc/sys/net/ipv4/conf/*/{accept_source_route,accept_redirects,\
send_redirects};do
    echo “0” > $i
done
###########################################################################
PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin; export PATH
iptables -F
iptables -X
iptables -Z
iptables -P INPUT  DROP
iptables -P OUTPUT  ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
############################################################################
if [ -f /usr/local/virus/iptables/iptables.deny ]; then
    sh /usr/local/virus/iptables/iptables.deny
fi
if [ -f /usr/local/virus/iptables/iptables.allow ]; then
    sh /usr/local/virus/iptables/iptables.allow
fi
if [ -f /usr/local/virus/iptables/iptables.http ]; then
    sh /usr/local/virus/iptables/iptables.http
fi
#############################################################################
AICMP=”0 3 3/4 4 11 12 14 16 18″
for tyicmp in $AICMP
do
  iptables -A INPUT -i $EXTIF -p icmp –icmp-type $tyicmp -j ACCEPT
done
iptables -A INPUT -s 172.16.0.1 -p icmp –icmp-type 8 -j ACCEPT #Cacti Request
#############################################################################
#iptables -A INPUT -p TCP -i $EXTIF –dport 21 –sport 1024:65534 -j ACCEPT #FTP
iptables -A INPUT -p TCP -i $EXTIF –dport 1230:1234 –sport 1024:65534 -j ACCEPT #Game_Server
iptables -A INPUT -p TCP -i $EXTIF –dport 22 –sport 1024:65534 -j ACCEPT #SSH
#iptables -A INPUT -p TCP -i $EXTIF –dport 25 –sport 1024:65534 -j ACCEPT #SMTP
#iptables -A INPUT -p UDP -i $EXTIF –dport 53 –sport 1024:65534 -j ACCEPT #DNS
#iptables -A INPUT -p TCP -i $EXTIF –dport 53 –sport 1024:65534 -j ACCEPT #DNS
iptables -A INPUT -p TCP -i $EXTIF –dport 80 –sport 1024:65534 -j ACCEPT #WWW
iptables -A INPUT -p TCP -i $EXTIF –dport 3306 –sport 1024:65534 -j ACCEPT #MySQL
iptables -A INPUT -p UDP -i $EXTIF –dport 161 –sport 1024:65534 -j ACCEPT #SNMP
#iptables -A INPUT -p TCP -i $EXTIF –dport 110 –sport 1024:65534 -j ACCEPT #POP3
#iptables -A INPUT -p TCP -i $EXTIF –dport 443 –sport 1024:65534 -j ACCEPT #HTTPS
##############################################################################
/etc/init.d/iptables save

推荐阅读：

Linux防火墙iptables详细教程 http://www.linuxidc.com/Linux/2013-07/87045.htm

iptables+L7+Squid实现完善的软件防火墙 http://www.linuxidc.com/Linux/2013-05/84802.htm

iptables的备份、恢复及防火墙脚本的基本使用 http://www.linuxidc.com/Linux/2013-08/88535.htm

Linux下防火墙iptables用法规则详解 http://www.linuxidc.com/Linux/2012-08/67952.htm

iptables.allow 如下：
#! /bin/bash
iptables -A INPUT -i $EXTIF -s 172.16.0.1 -p tcp –dport 22 -j ACCEPT

iptables.deny 如下：
#! /bin/bash
iptables -A INPUT -i $EXTIF -s 172.16.0.2 -j DROP

（2）放置目录：
# mkdir -p /usr/local/virus/iptables
# cp /tools/iptables.* /usr/local/virus/iptables/

2、授予权限
# cd /usr/local/virus/iptables/
# chmod 700 iptables.*

3、加入开启自启动
# vim /etc/rc.d/rc.local

#YX Firewall
/usr/local/virus/iptables/iptables.rule

相关阅读：

Linux iptables 配置详解 http://www.linuxidc.com/Linux/2012-12/77074.htm

RHEL5.4 iptables配置详解 http://www.linuxidc.com/Linux/2010-04/25368.htm

Linux下主机充当防火墙的巧妙应用之iptables http://www.linuxidc.com/Linux/2012-09/70935.htm

Linux防火墙Iptables详细教程 http://www.linuxidc.com/Linux/2013-07/87045.htm