- 论坛徽章:
- 0
|
本帖最后由 piaojifeng88 于 2010-04-15 11:03 编辑
Q#!/bin/bash
#ip.sh
#############clear iptables table###33
iptables -F
iptables -X
iptables -Z
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
############ default policy#########
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
##################basic########
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 20 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 23 -j DROP
iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 3306 -j ACCEPT
#iptables -t filter -A INPUT -p tcp --dport 1433 -j ACCEPT
#iptables -t filter -A OUTPUT -p tcp --sport 1433 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 21 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 20 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 22 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 23 -j REJECT
iptables -t filter -A OUTPUT -p tcp --sport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 3306 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 53 -j ACCEPT
iptables -t filter -A INPUT -p icmp --icmp-type 0 -j ACCEPT
iptables -t filter -A INPUT -p icmp --icmp-type 3 -j ACCEPT
iptables -t filter -A INPUT -p icmp --icmp-type 8 -j ACCEPT
iptables -t filter -A INPUT -p icmp --icmp-type 11 -j ACCEPT
iptables -t filter -A OUTPUT -p icmp --icmp-type 0 -j ACCEPT
iptables -t filter -A OUTPUT -p icmp --icmp-type 3 -j ACCEPT
iptables -t filter -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
iptables -t filter -A OUTPUT -p icmp --icmp-type 11 -j ACCEPT
#icmphacking############
###-------------------------------------------------------------------------###
iptables -A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
###-------------------------------------------------------------------------###
# zu zhi DDOS
###-------------------------------------------------------------------------###
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
#ruchong
#444/445/69/135/139
###-----------------------------------------------------------------###
iptables -A FORWARD -p tcp --dport 4444 -j DROP
iptables -A FORWARD -p udp --dport 4444 -j DROP
iptables -A FORWARD -p tcp --dport 445 -j DROP
iptables -A FORWARD -p udp --dport 445 -j DROP
iptables -A FORWARD -p tcp --dport 69 -j DROP
iptables -A FORWARD -p udp --dport 69 -j DROP
iptables -A FORWARD -p tcp --dport 135 -j DROP
iptables -A FORWARD -p udp --dport 135 -j DROP
iptables -A FORWARD -p tcp --dport 139 -j DROP
iptables -A FORWARD -p udp --dport 139 -j DROP
service iptables save
service iptables restart
1433开了也不好使啊 。。 网上有人说是 1433 |
|