linux iptables shell scripts
刚来乍到,希望能一起研究技术,刚开始，没什么好东西送大家的，就送一个scripts给大家把！前天自己研究出来的,不好的地方希望大家一起修改，谢谢！----------------------------------------
# mkdir -p /usr/local/virus/iptables
# cd /usr/local/virus/iptables
# vi iptables.rule
#!/bin/bash
set -x
EXTIF="eth0"
INIF=""
INNET=""
export EXTIF INIF INNET
#STATION ONE
#part one
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
for i in /proc/sys/net/ipv4/conf/*/rp_filter;do
echo "1" > $i
done
for i in /proc/sys/net/ipv4/conf/*/log_martians;do
echo "1" > $i
done
for i in /proc/sys/net/ipv4/conf/*/accept_source_route;do
echo "0" > $i
done
for i in /proc/sys/net/ipv4/conf/*/accept_redirects;do
echo "0" > $i
done
for i in /proc/sys/net/ipv4/conf/*/send_redirects;do
echo "0" > $i
done
#part two
PATH=/sbin:/usr/sbin:/bin:/usr/bin; export PATH
iptables -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P OUNTPUT ACCEPT
iptables -P FORWWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED -j ACCEPT
#part three
if [ -f /usr/local/virus/iptables/iptables.deny ]; then
sh /usr/local/virus/iptables/iptables.deny
fi
if [ -f /usr/local/virus/iptables/iptables.allow ]; then
sh /usr/local/virus/iptables/iptables.allow
fi
if [ -f /usr/local/virus/httpd-err/iptables.http ]; then
sh /usr/local/virus/httpd-err/iptables.http
fi
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
#part four
AICMP="0 3 3/4 4 11 12 14 16 18"
for tyicmp in $AICMP
do
iptables -A INPUT -i $EXTIF -p icmp --icmp-type $tyicmp -j ACCEPT
done
#part five
iptables -A INPUT -p TCP -i $EXTIF --dport 22 -j ACCEPT
#STATION TWO
#part one
modules="ip_tables iptable_nat ip_nat_ftp ip_nat_irc ip_conntrack ip_conntrack_ftp ip_conntrack_irc"
for mod in $modules
do
testmod=` lsmod | grep "${mod} "`
if [ "$testmod" == "" ]; then
modprobe $mod
fi
done
#part two
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
#part three
if [ "$INIF" != "" ]; then
iptables -A INPUT -i $INIF -j ACCEPT
echo "1" > /proc/sys/net/ipv4/ip_forward
if [ "$INNET" != "" ]; then
for innet in $INNET
do
iptables -t nat -A POSTROUTING -s $innet -o $EXTIF -j MASUQERADE
done
fi
fi
#iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
#part four
#iptables -t nat -A PREROUTING -p tcp -i $EXTIF --dport 80 -j DNAT --to 192.168..200.1
# vi iptables.allow
#!/bin/bash
iptables -A INPUT -i $EXTIF -s 192.168.1.0/24 -j ACCEPT
# vi iptables.deny
#!/bin/bash
iptables -A INPUT -i $EXTIF -s 192.168.1.11 -j DROP
# chmod 700 iptables.*
----------------------------------------------------------------------
干什么用的。
页:
[1]