请大家一起帮忙改进优化iptables脚本

battosai

1. #!/bin/sh
   
2. #
   
3. 
   
4. ###############################################################################
   
5. #
   
6. # Local Settings
   
7. #
   
8. 
   
9. # IPTables Location - adjust if needed
   
10. 
    
11. IPT="/sbin/iptables"
    
12. 
    
13. # Internet Interface
    
14. INET_IFACE="ppp0"
    
15. 
    
16. # Local Interface Information
    
17. LOCAL_IFACE="eth0"
    
18. LOCAL_IP="172.18.123.5"
    
19. LOCAL_NET="172.16.0.0/12"
    
20. LOCAL_BCAST="172.18.123.255"
    
21. 
    
22. # Localhost Interface
    
23. 
    
24. LO_IFACE="lo"
    
25. LO_IP="127.0.0.1"
    
26. 
    
27. 
    
28. ###############################################################################
    
29. #
    
30. # Load Modules
    
31. #
    
32. 
    
33. echo "Loading kernel modules ..."
    
34. 
    
35. /sbin/depmod -a
    
36. 
    
37. /sbin/modprobe ip_tables
    
38. /sbin/modprobe ip_conntrack
    
39. /sbin/modprobe iptable_filter
    
40. /sbin/modprobe iptable_nat
    
41. /sbin/modprobe ipt_LOG
    
42. /sbin/modprobe ipt_limit
    
43. /sbin/modprobe ipt_MASQUERADE
    
44. /sbin/modprobe ipt_REJECT
    
45. /sbin/modprobe multiport
    
46. /sbin/modprobe ipt_state
    
47. /sbin/modprobe ip_nat_ftp
    
48. /sbin/modprobe ip_conntrack_ftp
    
49. 
    
50. ###############################################################################
    
51. #
    
52. # Kernel Parameter Configuration
    
53. #
    
54. 
    
55. echo "1" > /proc/sys/net/ipv4/ip_forward
    
56. 
    
57. ###############################################################################
    
58. #
    
59. # Flush Any Existing Rules or Chains
    
60. #
    
61. 
    
62. echo "Flushing Tables ..."
    
63. 
    
64. # Reset Default Policies
    
65. $IPT -P INPUT ACCEPT
    
66. $IPT -P FORWARD ACCEPT
    
67. $IPT -P OUTPUT ACCEPT
    
68. $IPT -t nat -P PREROUTING ACCEPT
    
69. $IPT -t nat -P POSTROUTING ACCEPT
    
70. $IPT -t nat -P OUTPUT ACCEPT
    
71. $IPT -t mangle -P PREROUTING ACCEPT
    
72. $IPT -t mangle -P OUTPUT ACCEPT
    
73. 
    
74. # Flush all rules
    
75. $IPT -F
    
76. $IPT -t nat -F
    
77. $IPT -t mangle -F
    
78. 
    
79. # Erase all non-default chains
    
80. $IPT -X
    
81. $IPT -t nat -X
    
82. $IPT -t mangle -X
    
83. 
    
84. ###############################################################################
    
85. #
    
86. # Rules Configuration
    
87. #
    
88. 
    
89. ###############################################################################
    
90. #
    
91. # Filter Table
    
92. #
    
93. ###############################################################################
    
94. 
    
95. # Set Policies
    
96. 
    
97. $IPT -P INPUT DROP
    
98. $IPT -P OUTPUT DROP
    
99. $IPT -P FORWARD DROP
    
100. 
     
101. ###############################################################################
     
102. #
     
103. # INPUT Chain
     
104. #
     
105. 
     
106. echo "Process INPUT chain ..."
     
107. 
     
108. # Drop bad packets
     
109. $IPT -A INPUT -p ALL -m state --state INVALID -j DROP
     
110. $IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
     
111. 
     
112. #------------------------------------------------------------------------------#
     
113. # Syn-flood INPUT protection
     
114. $IPT -A INPUT -i ppp0 -p tcp --syn -m limit --limit 10/h \
     
115.       -j LOG --log-prefix 'Syn-flood INP attack??? '
     
116. $IPT -A INPUT -i ppp0 -p tcp --syn -m limit --limit 1/s -j ACCEPT
     
117. 
     
118. # Port Scanner INPUT protection
     
119. $IPT -A INPUT -i ppp0 -p tcp --tcp-flags SYN,ACK,FIN,RST RST \
     
120.    -m limit --limit 10/h -j LOG --log-prefix 'Port Scanner INP attack??? '
     
121. $IPT -A INPUT -i ppp0 -p tcp --tcp-flags SYN,ACK,FIN,RST RST \
     
122.    -m limit --limit 1/s -j ACCEPT
     
123. 
     
124. # Pingu of Death INPUT protection
     
125. $IPT -A INPUT -i ppp0 -p icmp --icmp-type echo-request \
     
126.    -m limit --limit 10/h -j LOG --log-prefix 'Ping of Death INP attack??? '
     
127. $IPT -A INPUT -i ppp0 -p icmp --icmp-type echo-request \
     
128.    -m limit --limit 1/s -j ACCEPT
     
129. #------------------------------------------------------------------------------#
     
130. 
     
131. # Allow all on localhost interface
     
132. $IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
     
133. 
     
134. # Rules for the private network (accessing gateway system itself)
     
135. $IPT -A INPUT -p ALL -i $LOCAL_IFACE -s $LOCAL_NET -j ACCEPT
     
136. $IPT -A INPUT -p ALL -i $LOCAL_IFACE -d $LOCAL_BCAST -j ACCEPT
     
137. $IPT -A INPUT -p TCP -i $LOCAL_IFACE -m multiport --dport 135,136,137,138,445 -j DROP
     
138. 
     
139. # Inbound Internet Packet Rules
     
140. 
     
141. # Accept Established Connections
     
142. $IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
     
143.      -j ACCEPT
     
144. $IPT -A INPUT -p TCP -i $INET_IFACE -m multiport --destination-port 80,25,110 -j ACCEPT
     
145. $IPT -A INPUT -p TCP -i $INET_IFACE -j DROP
     
146. $IPT -A INPUT -p UDP -i $INET_IFACE --destination-port 53 -j ACCEPT
     
147. $IPT -A INPUT -p UDP -i $INET_IFACE -j DROP
     
148. $IPT -A INPUT -p ICMP -s $LOCAL_NET --icmp-type 8 -j ACCEPT
     
149. $IPT -A INPUT -p ICMP -s 0/0 -j DROP
     
150. 
     
151. $IPT -A INPUT -p ALL -d 255.255.255.255 -j DROP
     
152. 
     
153. # Log packets that still don't match
     
154. $IPT -A INPUT -j LOG --log-prefix "fp=INPUT:99 a=DROP "
     
155. 
     
156. ###############################################################################
     
157. #
     
158. # FORWARD Chain
     
159. #
     
160. 
     
161. echo "Process FORWARD chain ..."
     
162. 
     
163. # Used if forwarding for a private network
     
164. 
     
165. # Drop bad packets
     
166. $IPT -A FORWARD -p ALL -m state --state INVALID -j DROP
     
167. $IPT -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
     
168. 
     
169. #------------------------------------------------------------------------------#
     
170. # Syn-flood FORWARDing protection
     
171. $IPT -A FORWARD -p tcp --syn -m limit --limit 10/h \
     
172.    -j LOG --log-prefix 'Syn-flood FWD attack??? '
     
173. $IPT -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
     
174. 
     
175. # Port Scanner FORWARDing protection
     
176. $IPT -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST \
     
177.    -m limit --limit 10/h -j LOG --log-prefix 'Port Scanner FWD attack??? '
     
178. $IPT -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST \
     
179.    -m limit --limit 1/s -j ACCEPT
     
180. 
     
181. # Ping of Death FORWARDing protection
     
182. $IPT -A FORWARD -p icmp --icmp-type echo-request \
     
183.    -m limit --limit 10/h -j LOG --log-prefix 'Ping of Death FWD attack??? '
     
184. $IPT -A FORWARD -p icmp --icmp-type echo-request \
     
185.    -m limit --limit 1/s -j ACCEPT
     
186. #------------------------------------------------------------------------------#
     
187. 
     
188. # If not blocked, accept any other packets from the internal interface
     
189. $IPT -A FORWARD -p ALL -i $LOCAL_IFACE -j ACCEPT
     
190. 
     
191. # Deal with responses from the internet
     
192. $IPT -A FORWARD -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
     
193.      -j ACCEPT
     
194. $IPT -A FORWARD -i $INET_IFACE -p tcp -m multiport --dport 20,21,22,23,69,135,136,137,138,139,445,593,4444 -j DROP
     
195. $IPT -A FORWARD -i $INET_IFACE -p udp -m multiport --dport 20,21,22,23,69,135,136,137,138,139,445,593,4444 -j DROP
     
196. $IPT -A FORWARD -p tcp -m multiport --dport 69,135,136,137,138,445,593,4444 -j DROP
     
197. $IPT -A FORWARD -p udp -m multiport --dport 69,135,136,137,138,445,593,4444 -j DROP
     
198. 
     
199. # Log packets that still don't match
     
200. $IPT -A FORWARD -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
     
201. 
     
202. ###############################################################################
     
203. #
     
204. # OUTPUT Chain
     
205. #
     
206. 
     
207. echo "Process OUTPUT chain ..."
     
208. 
     
209. # Generally trust the firewall on output
     
210. 
     
211. # However, invalid icmp packets need to be dropped
     
212. # to prevent a possible exploit.
     
213. $IPT -A OUTPUT -m state -p ALL --state INVALID -j DROP
     
214. 
     
215. # Localhost
     
216. $IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
     
217. $IPT -A OUTPUT -p ALL -o $LO_IFACE -j ACCEPT
     
218. 
     
219. # To internal network
     
220. $IPT -A OUTPUT -p ALL -s $LOCAL_IP -j ACCEPT
     
221. $IPT -A OUTPUT -p ALL -o $LOCAL_IFACE -j ACCEPT
     
222. $IPT -A OUTPUT -p tcp -o $LOCAL_IFACE -m multiport --dport 135,136,137,138,445 -j DROP
     
223. $IPT -A OUTPUT -p udp -o $LOCAL_IFACE -m multiport --dport 135,136,137,138,445 -j DROP
     
224. 
     
225. # To internet
     
226. $IPT -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT
     
227. 
     
228. 
     
229. # Log packets that still don't match
     
230. $IPT -A OUTPUT -j LOG --log-prefix "fp=OUTPUT:99 a=DROP "
     
231. 
     
232. ###############################################################################
     
233. #
     
234. # nat table
     
235. #
     
236. ###############################################################################
     
237. 
     
238. echo "Load rules for nat table ..."
     
239. 
     
240. ###############################################################################
     
241. #
     
242. # PREROUTING chain
     
243. #
     
244. #
     
245. 
     
246. 
     
247. $IPT -t nat -A PREROUTING -i $INET_IFACE -s 192.168.0.0/16 -j DROP
     
248. $IPT -t nat -A PREROUTING -i $INET_IFACE -s 10.0.0.0/8 -j DROP
     
249. $IPT -t nat -A PREROUTING -i $INET_IFACE -s 172.16.0.0/12 -j DROP
     
250. #allow internet
     
251. $IPT -t nat -A PREROUTING -s 172.18.123.177 -d ! $LOCAL_NET -j ACCEPT
     
252. 
     
253. $IPT -t nat -A PREROUTING -s $LOCAL_NET -d ! $LOCAL_NET -DROP
     
254. 
     
255. $IPT -t nat -A POSTROUTING -s $LOCAL_NET -d ! $LOCAL_NET -j MASQUERADE
     
256. 
     
257. 
     
258. ###############################################################################
     
259. #
     
260. # mangle table
     
261. #
     
262. ###############################################################################

复制代码

看看哪些地方多余了，哪些地方少了？

我自己想实现的功能就是只允许内部网浏览网页和收邮件，访问内部samba，ping,允许自己的IP（172.18.123.177）所有权限，阻止外面的任何有攻击企图的包和链接
谢谢了，m(_ _)m

faint

只能自己修改啦。有问题就提问，估计很少人会完全看完你的脚本的。