iptables 的单机基本配置

leige_linux

#!/bin/sh
#ip.sh
echo "------------Iptables starting-----------------------------------------"
iptables -F
iptables -X
iptables  -Z
iptables -t nat -F
iptables -t nat -X
iptables -t nat -z
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
echo "-----------------Iptables rule----------------------------------------"
iptables -t filter -A INPUT -p tcp -s 192.168.0.0/24  --dport 21 -j ACCEPT
iptables -t filter -A INPUT -p tcp -s 192.168.0.0/24  --dport 20 -j ACCEPT
iptables -t filter -A INPUT -p tcp -s 192.168.0.0/24  --dport 23 -j DROP
iptables -t filter -A INPUT -p tcp -s 192.168.0.0/24  --dport www -j ACCEPT
iptables -t filter -A OUTPUT -p tcp -j ACCEPT
iptables -t filter -A INPUT -P icmp --icmp-type 0 -j ACCEPT
iptables -t filter -A INPUT -P icmp --icmp-type 3 -j ACCEPT
iptables -t filter -A INPUT -P icmp --icmp-type 8 -j ACCEPT
iptables -t filter -A INPUT -P icmp --icmp-type 11 -j ACCEPT

iptables -t filter -A OUTPUT -P icmp --icmp-type 0 -j ACCEPT
iptables -t filter -A OUTPUT -P icmp --icmp-type 3 -j ACCEPT
iptables -t filter -A OUTPUT -P icmp --icmp-type 8 -j ACCEPT
iptables -t filter -A OUTPUT -P icmp --icmp-type 11 -j ACCEPT


注释：
icmp 类型：
echo-reply     0
echo-request    8
time-exceeded  11
destination-unreachable   3

本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u2/88248/showart_1948439.html