iptables做网关的脚本.docVIP

iptables做网关的脚本 iptables做网关的脚本 #!/bin/sh # ############################################################################# # # File: iptables.sh # # Purpose: To build a basic iptables policy with default log and drop rules. # This script was written for the book Linux Firewalls: Attack # Detection and Response published by No Starch Press. # # Copyright (C) 2006-2007 Michael Rash (mbr@) # # License (GNU Public License): # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 # USA # # ############################################################################# # # $Id: index.html 2349 2009-07-09 04:12:24Z mbr $ # IPTABLES=/sbin/iptables MODPROBE=/sbin/modprobe INT_NET=/24 ### flush existing rules and set chain policy setting to DROP echo [+] Flushing existing iptables rules... $IPTABLES -F $IPTABLES -F -t nat $IPTABLES -X $IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP $IPTABLES -P FORWARD DROP ### load connection-tracking modules # $MODPROBE ip_conntrack $MODPROBE iptable_nat $MODPROBE ip_conntrack_ftp $MODPROBE ip_nat_ftp ###### INPUT chain ###### # echo [+] Setting up INPUT chain... ### state tracking rules $IPTABLES -A INPUT -m state --state INVALID -j LOG --log-prefix DROP INVALID --log-ip-options --log-tcp-options $IPTABLES -A INPUT -m state --state INVALID -j DROP $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT ### anti-spoofing rules $IPTABLES -A INPUT -i eth1 -s ! $INT_NET -j LOG --log-prefix SPOOFED PKT $IPTABLES -A INPUT -i eth1 -s ! $INT_NET -j DROP ### ACCEPT rules $IPTABLES -A INPUT -i eth1 -p tcp -s $INT_NET --dport 22 --syn -m state --state NEW -j A