linux iptables shell scripts

caioki

刚来乍到,希望能一起研究技术,刚开始，没什么好东西送大家的，就送一个scripts给大家把！前天自己研究出来的,不好的地方希望大家一起修改，谢谢！

----------------------------------------
# mkdir -p /usr/local/virus/iptables
# cd /usr/local/virus/iptables

# vi iptables.rule

#!/bin/bash

set -x
EXTIF="eth0"
INIF=""
INNET=""
export EXTIF INIF INNET

#STATION ONE
#part one

echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
for i in /proc/sys/net/ipv4/conf/*/rp_filter;do
echo "1" > $i
done
for i in /proc/sys/net/ipv4/conf/*/log_martians;do
echo "1" > $i
done
for i in /proc/sys/net/ipv4/conf/*/accept_source_route;do
echo "0" > $i
done
for i in /proc/sys/net/ipv4/conf/*/accept_redirects;do
echo "0" > $i
done
for i in /proc/sys/net/ipv4/conf/*/send_redirects;do
echo "0" > $i
done

#part two

PATH=/sbin:/usr/sbin:/bin:/usr/bin; export PATH
iptables -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P OUNTPUT ACCEPT
iptables -P FORWWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED -j ACCEPT

#part three

if [ -f /usr/local/virus/iptables/iptables.deny ]; then
sh /usr/local/virus/iptables/iptables.deny
fi
if [ -f /usr/local/virus/iptables/iptables.allow ]; then
sh /usr/local/virus/iptables/iptables.allow
fi
if [ -f /usr/local/virus/httpd-err/iptables.http ]; then
sh /usr/local/virus/httpd-err/iptables.http
fi
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

#part four

AICMP="0 3 3/4 4 11 12 14 16 18"
for tyicmp in $AICMP
do
iptables -A INPUT -i $EXTIF -p icmp --icmp-type $tyicmp -j ACCEPT
done

#part five

iptables -A INPUT -p TCP -i $EXTIF --dport 22 -j ACCEPT

#STATION TWO
#part one

modules="ip_tables iptable_nat ip_nat_ftp ip_nat_irc ip_conntrack ip_conntrack_ftp ip_conntrack_irc"
for mod in $modules
do
testmod=` lsmod | grep "${mod} "`
if [ "$testmod" == "" ]; then
modprobe $mod
fi
done

#part two

iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

#part three

if [ "$INIF" != "" ]; then
iptables -A INPUT -i $INIF -j ACCEPT
echo "1" > /proc/sys/net/ipv4/ip_forward
if [ "$INNET" != "" ]; then
for innet in $INNET
do
iptables -t nat -A POSTROUTING -s $innet -o $EXTIF -j MASUQERADE
done
fi
fi


#iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu

#part four
#iptables -t nat -A PREROUTING -p tcp -i $EXTIF --dport 80 -j DNAT --to 192.168..200.1

# vi iptables.allow
#!/bin/bash
iptables -A INPUT -i $EXTIF -s 192.168.1.0/24 -j ACCEPT
# vi iptables.deny
#!/bin/bash
iptables -A INPUT -i $EXTIF -s 192.168.1.11 -j DROP
# chmod 700 iptables.*
----------------------------------------------------------------------

visiter

干什么用的。