定制更友好的iptables防火墙
[root@localhost~]# vi /etc/iptables_settings.sh ################################################################# #!/bin/sh -e #---------------------------------------------------------- # iptables settings #---------------------------------------------------------- #Connection IP address SSH_IP1="192.168.1.0/24" SSH_IP2="192.168.2.0/24" SNMP_IP1="10.10.1.1" SNMP_IP2="10.10.2.1" #----------------------Standard part--------------------------- # Stop iptables service first #service iptables stop /sbin/iptables -F /sbin/iptables -X /sbin/iptables -Z # Inital chains default policy /sbin/iptables -F -t filter /sbin/iptables -P INPUT DROP /sbin/iptables -P OUTPUT ACCEPT # Enable Native Network Transfer /sbin/iptables -A INPUT -i lo -j ACCEPT # Accept Established Connections /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # ICMP Control /sbin/iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT # SSH Service /sbin/iptables -A INPUT -s $SSH_IP1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -s $SSH_IP2 -p tcp --dport 22 -j ACCEPT # SNMP Service /sbin/iptables -A INPUT -s $SNMP_IP1 -p udp --dport 161 -j ACCEPT /sbin/iptables -A INPUT -s $SNMP_IP2 -p udp --dport 161 -j ACCEPT #-----------------------Custom part----------------------- # Name Service /sbin/iptables -A INPUT -p tcp --dport 53 -j ACCEPT /sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT 此处增加自定义的内容 #deny all Service /sbin/iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited /sbin/iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited ################################################################# [root@localhost~]# chmod +x /etc/iptables_settings.sh [root@localhost~]# echo "/etc/iptables_settings.sh">>/etc/rc.local [root@localhost~]# chkconfig iptables off [root@localhost~]# service iptables stop [root@localhost~]# /etc/iptables_settings.sh [root@localhost~]# iptables -L by jeady
 
在线客服
Comm100技术提供