防火墙模板

#!/bin/sh

/sbin/modprobe ip_conntrack_ftp

CONNECTION_TRACKING="1"
ACCEPT_AUTH="0"
DHCP_CLIENT="0"
IPT="/sbin/iptables"
INTERNET="eth1"
LOOPBACK_INTERFACE="lo"
IPADDR="my.ip.address"
SUBNET_BASE="network.address"
SUBNET_BROADCAST="directed.broadcast"
MY_ISP="my.isp.address.range"

NAMESERVER_1="isp.name.server.1"
NAMESERVER_2="isp.name.server.2"
NAMESERVER_3="isp.name.server.3"
POP_SERVER="isp.pop.server"
MAIL_SERVER="isp.mail.server"
NEWS_SERVER="isp.news.server"
TIMES_SERVER="some.time.server"
#DHCP_SERVER="isp.dhcp.server"
SSH_CLIENT="some.ssh.client"

LOOPBACK="127.0.0.0/8"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12"
CLASS_C="192.168.0.0/16"
CLASS_D_MULTICAST="224.0.0.0/4"
CLASS_E_RESERVED_NET="224.0.0.0/5"
BROADCAST_SRC="0.0.0.0"
BROADCAST_DEST="255.255.255.255"

PRIVPORTS="0:1023"
UNPRIVPORTS="1024:65535"

TRACEROUTE_SRC_PORTS="32769:65535"
TRACEROUTE_DEST_PORTS="33434:33523"

USER_CHAINS="EXT-input                     EXT-ouput \
             tcp-state-flags               connection-tracking \
             source-address-check          destination-address-check \
             local-dns-server-query        remote-dns-server-response \
             local-tcp-client-request      remote-tcp-client-response \
             remote-tcp-client-request     local-tcp-server-response \
             local-udp-client-request      remote-udp-server-response \
             local-dhcp-client-query       remote-dhcp-server-response \
             EXT-icmp-out                  EXT-icmp-in
             EXT-log-in                    EXT-log-out
             log-tcp-state"

# Enable broadcast ehco Protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
  echo 0 > $f
done

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
  echo 0 >$f
done

for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
  echo 0 >$f
done

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
  echo 1 >$f
done

for f in /proc/sys/net/ipv4/conf/*/log_martians; do
  echo 1 >$f 
done
##################

# remove any existing rules from all chain
$IPT --flush
$IPT -t nat --flush
$IPT -t mangle --flush
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X

$IPT --policy INPUT ACCEPT
$IPT --policy OUTPUT ACCEPT
$IPT --policy FORWARD ACCEPT
$IPT -t nat --policy PREROUTING ACCEPT
$IPT -t nat --policy OUTPUT ACCEPT
$IPT -t nat --policy POSTROUTING ACCEPT
$IPT -t mangle --policy PREROUTING ACCEPT
$IPT -t mangle --policy OUTPUT ACCEPT
if [ "$1" = "stop" ]
then
echo "Firewall complete stoped!"
exit 0
fi


$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

$IPT --policy INPUT DROP
$IPT --policy OUTPUT DROP
$IPT --policy FORWARD DROP

for i in $USER_CHAINS; do
  $IPT -N $i
done

$IPT -A EXT-ouput -p udp --sport 53 --dport 53 \
-j local-dns-server-query
$IPT -A EXT-input -p udp --sport 53 --dport 53 \
-j remote-dns-server-response

$IPT -A EXT-ouput -p tcp \
--sport $UNPRIVPORTS --dport 53 \
-j local-dns-server-query
$IPT -A EXT-input -p tcp \
--sport 53 --dport $UNPRIVPORTS \
-j remote-dns-server-response

if [ "$CONNECTION_TRACKING" = "1"]; then
  $IPT -A local-dns-server-query \
  -d $NAMESERVER_1 \
  -m state --state NEW -j ACCEPT
  
  $IPT -A local-dns-server-query \
  -d $NAMESERVER_2 \
  -m state --state NEW -j ACCEPT

  $IPT -A local-dns-server-query \
  -d $NAMESERVER_3 \
  -m state --state NEW -j ACCEPT
fi 

$IPT -A local-dns-server-query \
-d $NAMESERVER_1 -j ACCEPT
$IPT -A local-dns-server-query \
-d $NAMESERVER_2 -j ACCEPT
$IPT -A local-dns-server-query \
-d $NAMESERVER_3 -j ACCEPT


$IPT -A remote-dns-server-response \
-s $NAMESERVER_1 -j ACCEPT
$IPT -A remote-dns-server-response \
-s $NAMESERVER_2 -j ACCEPT
$IPT -A remote-dns-server-response \
-s $NAMESERVER_3 -j ACCEPT

###############
#local TCP client remote server

$IPT -A EXT-ouput -p tcp \
--sport $UNPRIVPORTS \
-j local-tcp-client-request
$IPT -A EXT-input -p ! --syn \
--dport $UNPRIVPORTS \
-j remote-tcp-server-response

#SSH
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d <selected host> --dport 22 \
  -m state --state NEW \
  -j ACCEPT
fi  
$IPT -A local-tcp-client-request -p tcp \
-d <selected host> --dport 22 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s <selected host> --sport 22 \
-j ACCEPT

# client http https auth FTP
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -m multiport --destination-port 80,433,21 \
  --syn -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-m multiport --destination-port 80,433,21 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp \
-m multiport --source-port 80,433,21 ! --syn \
-j ACCEPT

#POP client
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d $POP_SERVER --dport 110 \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-d $POP_SERVER --dport 110 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s $POP_SERVER --sport 110 \
-j ACCEPT

#SMTP client
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d $MAIL_SERVER --dport 25 \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-d $MAIL_SERVER --dport 25 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s $MAIL_SERVER --sport 25 \
-j ACCEPT
# new client

if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d $NEWS_SERVER --dport 119 \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-d $NEWS_SERVER --dport 119 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s $NEWS_SERVER --sport 119 \
-j ACCEPT

#FTP client
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  --dport $UNPRIVPORTS \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
--dport $UNPRIVPORTS -j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
--sport $UNPRIVPORTS -j ACCEPT

##################
#local tcp server

$IPT -A EXT-input -p tcp \
--sport $UNPRIVPORTS \
-j remote-tcp-client-request
$IPT -A EXT-ouput -p tcp ! --syn \
--dport $UNPRIVPORTS \
-j local-tcp-server-response

#FTP

$IPT -A EXT-input -p tcp \
--sport 20 --dport $UNPRIVPORTS \
-j ACCEPT

$IPT -A EXT-ouput -p tcp ! --syn \
--sport $UNPRIVPORTS --dport 20 \
-j ACCEPT

#ssh server
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A remote-tcp-client-request -p tcp \
  -s <selected host> --dport 22 \
  -m state --state NEW \
  -j ACCEPT
fi  
$IPT -A remote-tcp-client-request -p tcp \
-s <selected host> --dport 22 \
-j ACCEPT
$IPT -A local-tcp-server-response -p tcp ! --syn \
-d <selected host> --sport 22 \
-j ACCEPT
#local udp client remote server

$IPT -A EXT-ouput -p udp \
--sport $UNPRIVPORTS \
-j local-udp-client-request

$IPT -A EXT-input -p udp \
--dport $UNPRIVPORTS \
-j remote-udp-server-response
# time client
if [ "CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-udp-client-request -p udp \
  -d $TIMES_SERVER --dport 123 \
  -m state --state NEW \
  -j ACCEPT
fi 
$IPT -A local-udp-client-request -p udp \
-d $TIMES_SERVER --dport 123 \
-j ACCEPT
$IPT -A remote-udp-server-response -p udp \
-s $TIMES_SERVER --sport 123 \
-j ACCEPT
######################
#icmp
 

#################
#TCP state flags 
$IPT -A tcp-state-flags -p tcp --tcp-flags ALL NONE -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags SYN,RST SYN,RST -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags FIN,RST FIN,RST -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags ACK,FIN FIN -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags ACK,PSH PSH -j log-tcp-state 
$IPT -A tcp-state-flags -p tcp --tcp-flags ACK,URG URG -j log-tcp-state

$IPT -A log-tcp-state -p tcp -j LOG \
--log-prefix "Illegal TCP state: " \
--log-ip-options --log-tcp-options
$IPT -A log-tcp-state -j DROP
#bypass rule check for ESTABLISHED exchanges
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A connection-tracking -m state \
  --state ESTABLISHED,RELATED \
  -j ACCEPT
  $IPT -A connection-tracking -m state --state INVALID \
  -j LOG --log-prefix "INVALID packet: "
  $IPT -A connection-tracking -m state --state INVALID -j DROP
fi 
#source-address-check
$IPT -A source-address-check -s $IPADDR -j DROP
$IPT -A source-address-check -s $CLASS_A -j DROP
$IPT -A source-address-check -s $CLASS_B -j DROP
$IPT -A source-address-check -s $CLASS_C -j DROP
$IPT -A source-address-check -s $CLASS_D_MULTICAST -j DROP
$IPT -A source-address-check -s $CLASS_E_RESERVED_NET -j DROP
$IPT -A source-address-check -s $LOOPBACK -j DROP
$IPT -A source-address-check -s 0.0.0.0/8 -j DROP
$IPT -A source-address-check -s 169.254.0.0/16 -j DROP
$IPT -A source-address-check -s 192.0.2.0/24 -j DROP
#destination-address-check
$IPT -A destination-address-check -d $BROADCAST_DEST -j DROP
$IPT -A destination-address-check -d $SUBNET_BASE -j DROP
$IPT -A destination-address-check -d $SUBNET_BROADCAST -j DROP
$IPT -A destination-address-check ! -p udp \
-d $CLASS_D_MULTICAST -j DROP
$IPT -A INPUT -p -tcp -j tcp-state-flags
$IPT -A OUTPUT -p -tcp -j tcp-state-flags

if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A INPUT -j connection-tracking
  $IPT -A OUTPUT -j connection-tracking
fi 

$IPT -A INPUT ! -p tcp -j source-address-check 
$IPT -A INPUT -p tcp --syn -j source-address-check
$IPT -A INPUT -j destination-address-check

$IPT -A OUTPUT -j destination-address-check

$IPT -A INPUT -i $INTERNET -d $IPADDR -j EXT-input

$IPT -A INPUT -i $INTERNET -p udp -d $CLASS_D_MULTICAST -j DROP
$IPT -A OUTPUT -o $INTERNET -p udp -s $IPADDR -d $CLASS_D_MULTICAST \
-j DROP


$IPT -A OUTPUT -o $INTERNET -s $IPADDR -j EXT-ouput

$IPT -A INPUT -j EXT-log-in
$IPT -A OUTPUT -j EXT-log-out
exit 0

最后编辑于：2017.12.06 03:51:53

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 199,393评论 5赞 467
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 83,790评论 2赞 376
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 146,391评论 0赞 330
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 53,703评论 1赞 270
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 62,613评论 5赞 359
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 48,003评论 1赞 275
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 37,507评论 3赞 390
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 36,158评论 0赞 254
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 40,300评论 1赞 294
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 35,256评论 2赞 317
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 37,274评论 1赞 328
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 32,984评论 3赞 316
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 38,569评论 3赞 303
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 29,662评论 0赞 19
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 30,899评论 1赞 255
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 42,268评论 2赞 345
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 41,840评论 2赞 339

防火墙模板

推荐阅读更多精彩内容