- 论坛徽章:
- 0
|
#!/bin/bash
# .....2007.01.04...,......
###--------------------------------------------------------------------###
#.......
###--------------------------------------------------------------------###
PATH=/sbin:/usr/sbin:/bin:/usr/bin
TRUE_PORT="21 22 25 53 110 433 3308"
###--------------------------------------------------------------------###
#confirm iptables install
###--------------------------------------------------------------------###
which iptables &>/dev/null || {
echo
echo "$(basename $0): iptables Driver not found!"
echo ".........."
echo
exit 1
}
###--------------------------------------------------------------------###
#close ipchains,....redhat.....,.....iptables......
###--------------------------------------------------------------------###
lsmod | grep ipchains &>/dev/null && {
echo "Please wait a monment closing ipchains server!"
rmmod ipchains
}
###--------------------------------------------------------------------###
# add modules
###--------------------------------------------------------------------###
echo "adding Modules"
modprobe ip_tables &>/dev/null || {
echo -n "$(basename $0): add ip_tables fail!"
echo "Please check!"
exit 3
}
for file in /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_conntrack_*.o
do
module=$(basename $file)
modprobe ${module%.*} &>/dev/null
done
for file in /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_nat_*.o
do
module=$(basename $file)
modprobe ${module%.*} &>/dev/null
done
#clear all
iptables -F
iptables -X
iptables -Z
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -F -t mangle
iptables -X -t mangle
iptables -Z -t mangle
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p imcp -j ACCEPT
for PORT in $TRUE_PORT;do
iptables -A INPUT -p tcp --dport $POTR -j ACCEPT
done
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE
iptables -A PORWARD -m state --state ESTABLUSHED,RELATED -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward
#DNS
iptables -A FORWARD -p tcp -s 192.168.1.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -p udp -s 192.168.1.0/24 --dport 53 -j ACCEPT
#FTP
modprobe ip_conntrack_ftp
iptables -A FORWARD -p tcp -s 192.168.1.0/24 -dport 21 -j ACCEPT
#Mail
iptables -A FORWARD -p tcp -s 192.168.1.0/24 -dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.1.0/24 -dport 110 -j ACCEPT
#Remote Desktop Connection
iptables -A FORWARD -p tcp -s 192.168.1.0/24 --dport 3389 -j ACCEPT
#MySql
iptables -A FORWARD -p tcp -s 192.168.1.0/24 --dport 3306 -j ACCEPT
#VNC
iptables -A FORWARD -p tcp -s 192.168.1.0/24 --dport 5900 -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.1.0/24 --dport 5800 -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.1.0/24 --dport 3600 -j ACCEPT
#Open 192.168.1.206 可以上網
iptables -A FORWARD -p tcp -s 192.168.1.206 --dport 80 -j ACCEPT
[ 本帖最后由 zxwwen 于 2007-1-4 08:58 编辑 ] |
|
免费注册
发表于 2006-12-29 15:48