iptables.rule为firewall总规则;


iptables.allow为充许进入的主机;


iptables.deny为不许放的主机；


 


iptables.allow代码如下：


#!/bin/bash


# This is an esay firewall.


# the inside interface. if you don't have this one


# and you must let this be black ex> INIF=""


INIF="eth0"


INNET="192.168.160.0/20"


# 2.0 load the right module


PATH=/sbin:/bin:/usr/sbin:/usr/bin


export PATH EXTIF INIF INNET


modprobe ip_tables > /dev/null 2>&1


modprobe iptable_nat > /dev/null 2>&1


modprobe ip_nat_ftp > /dev/null 2>&1


modprobe ip_nat_irc > /dev/null 2>&1


modprobe ip_conntrack > /dev/null 2>&1


modprobe ip_conntrack_ftp > /dev/null 2>&1


modprobe ip_conntrack_irc > /dev/null 2>&1


# 3.0 clear iptables rule


/sbin/iptables -F


/sbin/iptables -X


/sbin/iptables -Z


/sbin/iptables -F -t nat


/sbin/iptables -X -t nat


/sbin/iptables -Z -t nat


/sbin/iptables -P INPUT DROP


/sbin/iptables -P OUTPUT ACCEPT


/sbin/iptables -P FORWARD ACCEPT


/sbin/iptables -t nat -P PREROUTING ACCEPT


/sbin/iptables -t nat -P POSTROUTING ACCEPT


/sbin/iptables -t nat -P OUTPUT ACCEPT


# 4.0 start loading trusted and denied file.


if [ -f /usr/local/virus/iptables/iptables.allow ]; then


sh /usr/local/virus/iptables/iptables.allow


fi


if [ -f /usr/local/virus/iptables/iptables.deny ]; then


sh /usr/local/virus/iptables/iptables.deny


fi


# 5.0 if the following file exist ,please executed


if [ -f /usr/local/virus/httpd-err/iptables.http ];then


sh /usr/local/virus/httpd-err/iptables.http


fi


# 6.0 allow icmp data packet and the establishd data


/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


AICMP="0 3 3/4 4 11 12 14 16 18"


for tyicmp in $AICMP


do


/sbin/iptables -A INPUT -i $EXTIF="eth0" -p icmp --icmp-type $tyicmp -j ACCEPT


done


# 7.0 open the other service ports


/sbin/iptables -A INPUT -p TCP -i $EXTIF="eth0" --dport 25 -j ACCEPT # SMTP


/sbin/iptables -A INPUT -p TCP -i $EXTIF="eth0" --dport 53 -j ACCEPT # DNS


/sbin/iptables -A INPUT -p TCP -i $EXTIF="eth0" --dport 80 -j ACCEPT # WWW


/sbin/iptables -A INPUT -p TCP -i $EXTIF="eth0" --dport 110 -j ACCEPT # POP3


/sbin/iptables -A INPUT -p TCP -i $EXTIF="eth0" --dport 113 -j ACCEPT #AUTH


/sbin/iptables -A INPUT -p TCP -i $EXTIF="eth0" --dport 22222 -j ACCEPT #SSH


/sbin/iptables -A INPUT -p UDP -i $EXTIF="eth0" --dport 138 -j ACCEPT #138


/sbin/iptables -A INPUT -p TCP -i $EXTIF="eth0" --dport 139 -j ACCEPT #139


/sbin/iptables -A INPUT -p UDP -i $EXTIF="eth0" --dport 137 -j ACCEPT #137


/sbin/iptables -A INPUT -p TCP -i $EXTIF="eth0" --dport 445 -j ACCEPT #445


 


iptables.allow代码如下


#!/bin/bash


# this program is used to allow some IP or hosts to access your server


/sbin/iptables -A INPUT -i $EXTIF="eth0" -s 192.168.161.242 -j ACCEPT


/sbin/iptables -A INPUT -i $EXTIF="eth0" -s 192.168.160.178 -j ACCEPT


/sbin/iptables -A INPUT -i $EXTIF="eth0" -s 192.168.160.218 -j ACCEPT


iptables.deny代码如下


#! /bin/bash


# This script will deny some IPs that I don't want in IN


/sbin/iptables -A INPUT -i $EXTIF="eth0" -s 192.168.160.242 -j DROP


 


以上的三个文件都放在/usr/local/virus/iptables目录下，最在修改此文件/etc/rc.d/rc.local成如下代码。


 


#!/bin/sh


#


# This script will be executed *after* all the other init scripts.


# You can put your own initialization stuff in here if you don't


# want to do the full Sys V style init stuff.


touch /var/lock/subsys/local


# Starting firewall settings


/usr/local/virus/iptables/iptables.rule


 


以上就是linux下firewall简易设置啦。


（责任编辑：A6）




本站文章仅代表作者观点,本站仅传递信息,并不表示赞同或反对.转载本站点内容时请注明来自-Linux伊甸园。如不注明，将根据《互联网著作权行政保护办法》追究其相应法律责任。
--------------------next---------------------