在securityfocus中找到的一個防火牆腳本有興趣的看看,

Question

在securityfocus中找到的一個防火牆腳本有興趣的看看,,,,值得一看,

#!/bin/bash
#################################################################################
#                                                                                      #
# Created......: 17 August 2001                                                             #
# Last Modified: 13/09/2001 20:28                                                     #
# Author.......: Skylinux                                                             #
# Version......: 0.2.2                                                                #
# Download.....: http://home.earthlink.net/~skylinux/                                #
#                                                                                #
#################################################################################
#                                                                                #
# Source:                                                                        #
#                                                                                #
# - James Stephens' Iptables script @                                                #
#   http://www.cs.princeton.edu/~jns/security/iptables/index.html                #
# - Linux 2.4 Packet Filtering HOWTO                                                #
# - Linux 2.4 NAT HOWTO                                                                #
#                                                                                #
#################################################################################
#                                                                                #
# Change Log:                                                                        #
#                                                                                #
# v0.2.2 -added FORWARD icmp rule                                                #
#                                                                                #
# v0.2        -fixed the FTP forward problem,                                                #
#        -removed some "double rules",                                                #
# v0.11 -added NetBus,Back Orifice & Trin00 protection                                #
#                                                                                #
#################################################################################
#                                                                                #
# To do List:                                                                        #
#                                                                                #
# - add Netkiller flood protection                                                #
# - implement script with start/stop function                                        #
# - add mirror function (attacker is scanning himself)                                #
# - add another TCP_SERVICES_OUT_* Setting like FORWARD_PORTS_2                        #
# - fix the error message from the ICQ rule while starting firewall                #
#                                                                                #
#################################################################################
#
# Documentation
# -------------
# This firewall script is using the default policy DROP EVERYTHING, in order to get all the services working you need to adjust the
# "Standard Settings".
# - IPTABLES="/usr/sbin/iptables"         =>; This defines the path where your "iptables" executable is. You can find it by using "whereis iptables"
# - INT_IF="eth0"                        =>; Change "eth0" to the name of your INTERNAL NIC (Network Interface Card) eg: "eth0" "eth1" "eth2"
# - BROADCAST="192.168.3.255/24"        =>; Change the IP to the BROADCAST address of your network. eg: "192.168.0.255/24" "192.168.1.255/24"
# - EXT_IF="ppp0"                        =>; This is you EXTERNAL INTERFACE, if you use dial up it is "ppp0", if you use broadband it is one of your Ethernets.
# - FORWARD_PORTS_1="22,80"                =>; These are the ports which will be FORWARDED from your INTERNAL INTERFACE to your EXTERNAL INTERFACE (maximum 15 ports)
# - FORWARD_PORTS_2="194,443"                =>; Same as above, this is just here if you need more than 15 ports (To prevent error messages you should enter at least one port in here)
# - TCP_SERVICES_IN_INT_IF="6"                =>; Server ports you want to export to your LOCAL NETWORK. (To prevent error messages enter at least one value, port 6 is Unassigned)
# - TCP_SERVICES_IN_EXT_IF="80"                =>; Server ports you want to export to your EXTERNAL INTERFACE (Internet). (To prevent error messages enter at least one value, port 6 is Unassigned)
# - TCP_SERVICES_OUT_INT_IF="22,80"        =>; If you want to access ports from the machine where you install the firewall INSIDE your network you need to specify the ports. (To prevent error messages enter at least one value, port 6 is Unassigned)
# - TCP_SERVICES_OUT_EXT_IF="22,80"        =>; Ports you want to connect to OUTSIDE your local network from the machine where the firewall is installed. (To prevent error messages enter at least one value, port 6 is Unassigned)
# - NAMESERVER_1="XXX.XXX.XXX.XXX"        =>; The IP of your EXTERNAL DNS1/NAMESERVER (you can get the IP from your ISP)
# - NAMESERVER_2="XXX.XXX.XXX.XXX"        =>; The IP of your EXTERNAL DNS2/NAMESERVER (you can get the IP from your ISP)
# - LOOPBACK="127.0.0.0/8"                =>; This is your loopback IP, don't change this unless you know what you are doing
# - CLASS_A="10.0.0.0/8"                =>; This will block a /8 (Class A) IP coming in through your EXTERNAL interface, because it will be spoofed.
# - CLASS_B="172.16.0.0/16"                =>; This will block a /16 (Class B) IP coming in through your EXTERNAL interface, because it will be spoofed.
# - CLASS_C="192.168.0.0/16"                 =>; This will block a /24 (Class C) IP coming in through your EXTERNAL interface, because it will be spoofed.
# - XSERVER_PORTS="6000:6063"                =>; Most X servers listen at these ports, this will block the specified ports
# - ICQ_PORT_TCP="5190"                        =>; This is the default port where ICQ connects to the ICQ network
# - ICQ_PORT_UDP="4000"                        =>; This is the default port where ICQ connects to the ICQ network
# - TROJAN_PORTS_TCP="12345,12346"        =>; This will block INCOMING requests for Trojans on your Network tcp. You can add more ports (max 15 ports) or use port 6 to disable this feature.
# - TROJAN_PORTS_UDP="27444,31335"        =>; This will block INCOMING requests for Trojans on your Network udp. You can add more ports (max 15 ports) or use port 6 to disable this feature.
#
#
##########
# Standard Settings
IPTABLES="/usr/sbin/iptables"
INT_IF="eth0"
BROADCAST="192.168.1.255/24"
EXT_IF="ppp0"
FORWARD_PORTS_1="20,21,22,23,25,79,80,81,110,119"
FORWARD_PORTS_2="194,443"
TCP_SERVICES_IN_INT_IF="22,80"
TCP_SERVICES_IN_EXT_IF="80"
TCP_SERVICES_OUT_INT_IF="22,80"
TCP_SERVICES_OUT_EXT_IF="21,22,80,119"
NAMESERVER_1="207.217.126.81"
NAMESERVER_2="207.217.77.82"
LOOPBACK="127.0.0.0/8"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/16"
CLASS_C="192.168.0.0/16"
UP_PORTS="1024:65535"
XSERVER_PORTS="6000:6063"
ICQ_PORT_TCP="5190"
ICQ_PORT_UDP="4000"
TROJAN_PORTS_TCP="12345,12346,1524,27665,31337"
TROJAN_PORTS_UDP="12345,12346,27444,31335,31337"
#
#
echo "Starting Firewall ....."
# Load appropriate modules.
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_ftp
#
##########
# Flush Rules
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -F INPUT
$IPTABLES -F FORWARD
$IPTABLES -F OUTPUT
$IPTABLES -t nat -F PREROUTING
$IPTABLES -t nat -F POSTROUTING
#
#
##########
# Changing Kernel Parameters, you need CONFIG_SYSCTL defined in your kernel
#
# SYN Cookie Protection
/bin/echo "1" >; /proc/sys/net/ipv4/tcp_syncookies

# Disable response to ping
/bin/echo "1" >; /proc/sys/net/ipv4/icmp_echo_ignore_all

# Disable response to broadcasts
/bin/echo "1" >; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Don't accept source routed packets
/bin/echo "0" >; /proc/sys/net/ipv4/conf/all/accept_source_route
/bin/echo "0" >; /proc/sys/net/ipv4/conf/all/send_redirects

# Disable ICMP redirect acceptance
/bin/echo "0" >; /proc/sys/net/ipv4/conf/all/accept_redirects

# Enable bad error message protection
/bin/echo "1" >; /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

# Turn on reverse path filtering
for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
/bin/echo "1" >; ${interface}
done

# Log spoofed packets, source routed packets, redirect packets
/bin/echo "1" >; /proc/sys/net/ipv4/conf/all/log_martians

# Enable IP forwarding
echo "1" >; /proc/sys/net/ipv4/ip_forward
#
#
##########
# Rules
#
# Standard Rules
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP
#
# Deny packets claiming to be to or from a /8,/16,/24 (Class A,B,C) Network ($EXT_IF)
$IPTABLES -A INPUT -i $EXT_IF -s $CLASS_A -j DROP
$IPTABLES -A INPUT -i $EXT_IF -d $CLASS_A -j DROP
$IPTABLES -A INPUT -i $EXT_IF -s $CLASS_B -j DROP
$IPTABLES -A INPUT -i $EXT_IF -d $CLASS_B -j DROP
$IPTABLES -A INPUT -i $EXT_IF -s $CLASS_C -j DROP
$IPTABLES -A INPUT -i $EXT_IF -d $CLASS_C -j DROP
$IPTABLES -A OUTPUT -o $EXT_IF -s $CLASS_A -j DROP
$IPTABLES -A OUTPUT -o $EXT_IF -d $CLASS_A -j DROP
$IPTABLES -A OUTPUT -o $EXT_IF -s $CLASS_B -j DROP
$IPTABLES -A OUTPUT -o $EXT_IF -d $CLASS_B -j DROP
$IPTABLES -A OUTPUT -o $EXT_IF -s $CLASS_C -j DROP
$IPTABLES -A OUTPUT -o $EXT_IF -d $CLASS_C -j DROP
#
# Firewall syn/flood and port scanner protection $INT_IF
$IPTABLES -N syn-flood_INT_IF
$IPTABLES -F syn-flood_INT_IF
$IPTABLES -A INPUT -i $INT_IF -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j syn-flood_INT_IF
#$IPTABLES -A INPUT -i $INT_IF -p tcp --syn -j syn-flood_INT_IF
$IPTABLES -A syn-flood_INT_IF -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A syn-flood_INT_IF -j DROP
#
# Firewall syn/flood and port scanner protection $EXT_IF
$IPTABLES -N syn-flood_EXT_IF
$IPTABLES -F syn-flood_EXT_IF
$IPTABLES -A INPUT -i $EXT_IF -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j syn-flood_EXT_IF
#$IPTABLES -A INPUT -i $EXT_IF -p tcp --syn -j syn-flood_EXT_IF
$IPTABLES -A syn-flood_EXT_IF -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A syn-flood_EXT_IF -j DROP
#
#  Make sure NEW tcp connections are SYN packets
$IPTABLES -A INPUT -i $INT_IF -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A INPUT -i $EXT_IF -p tcp ! --syn -m state --state NEW -j DROP
#
# Block incoming fragments $INT_IF
$IPTABLES -A INPUT -i $INT_IF -f -j LOG --log-prefix "IPTABLES FRAGMENTS $INT_IF: "
$IPTABLES -A INPUT -i $INT_IF -f -j DROP
#
# Block incoming fragments $EXT_IF
$IPTABLES -A INPUT -i $EXT_IF -f -j LOG --log-prefix "IPTABLES FRAGMENTS $EXT_IF: "
$IPTABLES -A INPUT -i $EXT_IF -f -j DROP
#
# Drop broadcast packets
$IPTABLES -A INPUT -i $EXT_IF -d $BROADCAST -j DROP
#
# Trojan protection
$IPTABLES -A INPUT -i $INT_IF -p tcp -m multiport --dport $TROJAN_PORTS_TCP -j LOG --log-prefix "IPTABLES Trojan INT_IF: "
$IPTABLES -A INPUT -i $INT_IF -p udp -m multiport --dport $TROJAN_PORTS_UDP -j LOG --log-prefix "IPTABLES Trojan INT_IF: "
$IPTABLES -A INPUT -i $INT_IF -p tcp -m multiport --dport $TROJAN_PORTS_TCP -j DROP
$IPTABLES -A INPUT -i $INT_IF -p udp -m multiport --dport $TROJAN_PORTS_UDP -j DROP
$IPTABLES -A INPUT -i $EXT_IF -p tcp -m multiport --dport $TROJAN_PORTS_TCP -j LOG --log-prefix "IPTABLES Trojan EXT_IF: "
$IPTABLES -A INPUT -i $EXT_IF -p udp -m multiport --dport $TROJAN_PORTS_UDP -j LOG --log-prefix "IPTABLES Trojan EXT_IF: "
$IPTABLES -A INPUT -i $EXT_IF -p tcp -m multiport --dport $TROJAN_PORTS_TCP -j DROP
$IPTABLES -A INPUT -i $EXT_IF -p udp -m multiport --dport $TROJAN_PORTS_UDP -j DROP
#
# ICQ INPUT/OUTPUT rules (I get the error message that the hostname is not found, if somebody knows why PLZ let me know)
#$IPTABLES -A OUTPUT -o $EXT_IF -p udp -d icq.mirabilis.com --dport $ICQ_PORT_UDP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#$IPTABLES -A OUTPUT -o $EXT_IF -p tcp -d login.icq.com --dport $ICQ_PORT_TCP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#
# icmp INPUT/OUTPUT rules $INT_IF. For a list of icmp types check the end of this file.
$IPTABLES -A INPUT -i $INT_IF -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -o $INT_IF -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#$IPTABLES -A INPUT -i $INT_IF -p icmp --icmp-type 0 -j DROP
#
# icmp INPUT/OUTPUT rules $EXT_IF. For a list of icmp types check the end of this file.
$IPTABLES -A INPUT -i $EXT_IF -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_IF -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#$IPTABLES -A INPUT -i $EXT_IF -p icmp --icmp-type 0 -j DROP
#
# Nameserver INPUT/OUTPUT
$IPTABLES -A INPUT -i $EXT_IF -p udp -s $NAMESERVER_1 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $EXT_IF -p udp -s $NAMESERVER_2 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_IF -p udp -d $NAMESERVER_1 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_IF -p udp -d $NAMESERVER_2 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
#
# INPUT
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i lo -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i $INT_IF -p tcp -m multiport --dport $TCP_SERVICES_IN_INT_IF -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $EXT_IF -p tcp -m multiport --dport $TCP_SERVICES_IN_EXT_IF -m state --state NEW,ESTABLISHED -j ACCEPT

#$IPTABLES -A INPUT  -i $EXT_IF -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT  -i $EXT_IF -p tcp --sport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT  -i $EXT_IF -p tcp --sport $UP_PORTS --dport $UP_PORTS -m state --state ESTABLISHED -j ACCEPT

#
# FORWARD
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p udp -d $NAMESERVER_1 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p udp -d $NAMESERVER_2 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p tcp -m multiport --dport $FORWARD_PORTS_1 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p udp -m multiport --dport $FORWARD_PORTS_1 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p tcp -m multiport --dport $FORWARD_PORTS_2 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p udp -m multiport --dport $FORWARD_PORTS_2 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p udp -d icq.mirabilis.com --dport $ICQ_PORT_UDP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p tcp -d login.icq.com --dport $ICQ_PORT_TCP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p tcp --sport $UP_PORTS --dport $UP_PORTS -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPTABLES -A FORWARD -i $EXT_IF -o $INT_IF -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
#$IPTABLES -A FORWARD -i $EXT_IF -o $INT_IF -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $EXT_IF -o $INT_IF -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# OUTPUT
$IPTABLES -A OUTPUT -o $EXT_IF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -o lo -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -o $INT_IF -p tcp -m multiport --sport $TCP_SERVICES_IN_INT_IF -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_IF -p tcp -m multiport --sport $TCP_SERVICES_IN_EXT_IF -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $INT_IF -p tcp -m multiport --dport $TCP_SERVICES_OUT_INT_IF -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_IF -p tcp -m multiport --dport $TCP_SERVICES_OUT_EXT_IF -m state --state NEW,ESTABLISHED -j ACCEPT

$IPTABLES -A OUTPUT -o $EXT_IF -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_IF -p tcp --sport $UP_PORTS --dport $UP_PORTS -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# POSTROUTING
$IPTABLES -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE

##########
# icmp types
#
#  0        Echo Reply                                 [RFC792]
#  1        Unassigned                                    [JBP]
#  2        Unassigned                                    [JBP]
#  3        Destination Unreachable                         [RFC792]
#  4        Source Quench                                  [RFC792]
#  5        Redirect                                 [RFC792]
#  6        Alternate Host Address                            [JBP]
#  7        Unassigned                                    [JBP]
#  8        Echo                                         [RFC792]
#  9        Router Advertisement                        [RFC1256]
# 10        Router Solicitation                        [RFC1256]
# 11        Time Exceeded                                 [RFC792]
# 12        Parameter Problem                         [RFC792]
# 13        Timestamp                                 [RFC792]
# 14        Timestamp Reply                                 [RFC792]
# 15        Information Request                         [RFC792]
# 16        Information Reply                         [RFC792]
# 17        Address Mask Request                     [RFC950]
# 18        Address Mask Reply                         [RFC950]
# 19        Reserved (for Security)                           [Solo]
# 20-29        Reserved (for Robustness Experiment)            [ZSu]
# 30        Traceroute                                [RFC1393]
# 31        Datagram Conversion Error                [RFC1475]
# 32     Mobile Host Redirect              [David Johnson]
# 33     IPv6 Where-Are-You                 [Bill Simpson]
# 34     IPv6 I-Am-Here                     [Bill Simpson]
# 35     Mobile Registration Request        [Bill Simpson]
# 36     Mobile Registration Reply          [Bill Simpson]
# 37     Domain Name Request                     [Simpson]
# 38     Domain Name Reply                       [Simpson]
# 39     SKIP                                    [Markson]
# 40     Photuris                                [Simpson]
# 41-255 Reserved                                    [JBP]
##########
echo "Firewall STARTED"
### END ###

#iptables -t nat -A PREROUTING --dport <the listening port of internal host>; -i <outer iface(eth0 for you)>; -j DNAT --to
#iptables -t nat -A PREROUTING -p tcp -i (inet iface) --dport 80 -j DNAT --to-destination xxx.xxx.xxx.xxx:80
#iptables -t filter -A FORWARD -p tcp -d xxx.xxx.xxx.xxx --dport 80 -j ACCEPT
#iptables -A OUTPUT -o $IFACE -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#iptables -A INPUT      -i $IFACE -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

Answer 1

這是第二個

----------
+++++
Contributed by Ross Vandegrift <ross@willow.seitz.com>;
+++++

My firewalling script starts by classifying traffic based on
incoming interface.  I figure if the Linux kernel gives us
rp_filter, we might as well take advantage of it.  Once we know
what the incoming interface is, it makes it much easer to classify
the traffic - we know that incoming packets on the external interface
should never be allowed to hit the NFS port, for example.

I wouldn't recommend most people have telnet and tftp open, but I
have an eccentric boss who is known to run DOS telnet and tftp servers
to enable connectivity at odd times...

        Ross Vandegrift
        ross@willow.seitz.com

#!/bin/sh

DMZIP=207.106.55.128/26
MAINIP=207.106.55.64/26
FWMAINIP=207.106.55.126
IPT=/usr/local/sbin/iptables
TCP_OPENPORTS=20,21,22,23,25,53,69,80,113
UDP_OPENPORTS=53,123
WORMPORTS=31337,33270,1234,6711,16660,60001,12345,12346,1524,27665,27444,31335,6000,6001,6002

# Correctly configure draconian routing policies
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP

# Add the chains we need
$IPT -N IN_ETH0
$IPT -N IN_TCP
$IPT -N IN_UDP
$IPT -N FOR_ETH0
$IPT -N FOR_ETH1
$IPT -N FOR_TCP0
$IPT -N FOR_UDP0
$IPT -N FOR_TCP1
$IPT -N FOR_UDP1

#
# table: filter, chain: INPUT
#

# First make decisions based on the incoming interface
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -i eth1 -j ACCEPT
$IPT -A INPUT -i eth0 -j IN_ETH0

# Then look at relevant subnets
$IPT -A INPUT -s 207.106.55.0/24 -j ACCEPT
$IPT -A INPUT -s 63.121.145.0/24 -j ACCEPT

# Should be the end for INPUT - LOG what's left
#$IPT -A INPUT -m limit --limit 3/minute -j LOG

#
# table: filter, chain: OUTPUT
#
$IPT -A OUTPUT -s $DMZIP -j ACCEPT
$IPT -A OUTPUT -s $FWMAINIP -j ACCEPT
$IPT -A OUTPUT -o lo -d 127.0.0.0/8 -j ACCEPT
$IPT -A OUTPUT -m limit --limit 3/minute -j LOG

#
# table: filter, chain IN_ETH0
#
$IPT -A IN_ETH0 -d $DMZIP -p icmp -j ACCEPT
$IPT -A IN_ETH0 -d $DMZIP -p tcp -j IN_TCP
$IPT -A IN_ETH0 -d $DMZIP -p udp -j IN_UDP

#
# table: filter, chain: IN_TCP
#

# Now install our rules for tcp packets
$IPT -A IN_TCP -p tcp -m multiport \
    -d $DMZIP --dport $TCP_OPENPORTS -j ACCEPT -m tcp --syn
$IPT -A IN_TCP -p tcp -m state --state RELATED -j ACCEPT
$IPT -A IN_TCP -p tcp -m state --state ESTABLISHED -j ACCEPT

#
# table: filter, chain: IN_UDP

# Rules for udp packets
$IPT -A IN_UDP -m multiport -p udp \
        -d $DMZIP --dport $UDP_OPENPORTS -j ACCEPT
$IPT -A IN_UDP -m multiport -p udp \
    -d $DMZIP --sport $UDP_OPENPORTS -j ACCEPT

#
# table: filter, chain: FORWARD
#

# Again, look at incoming interface
$IPT -A FORWARD -i eth0 -j FOR_ETH0
$IPT -A FORWARD -i eth1 -j FOR_ETH1

#
# table: filter, chain: FOR_ETH0
#
$IPT -A FOR_ETH0 -p icmp -j ACCEPT
$IPT -A FOR_ETH0 -p udp -j FOR_UDP0
$IPT -A FOR_ETH0 -p tcp -j FOR_TCP0

#
# table: filter, chain: FOR_ETH1
#
$IPT -A FOR_ETH1 -p icmp -j ACCEPT
$IPT -A FOR_ETH1 -p udp -j FOR_UDP1
$IPT -A FOR_ETH1 -p tcp -j FOR_TCP1
$IPT -A FOR_ETH1 -j ACCEPT

#
# table: filter, chain: FOR_UDP0
#

# Allow IPX over UDP tunnelling
$IPT -A FOR_UDP0 -p udp -s $DMZIP -d $MAINIP -j ACCEPT
$IPT -A FOR_UDP0 -p udp -s ! $DMZIP -d $MAINIP --dport 213 -j ACCEPT

#
# table: filter, chain: FOR_TCP0
#
$IPT -A FOR_TCP0 -p tcp -m multiport \
    -d $MAINIP --dport $TCP_OPENPORTS -j ACCEPT -m tcp --syn
$IPT -A FOR_TCP0 -p tcp -m state --state ESTABLISHED -j ACCEPT
$IPT -A FOR_TCP0 -p tcp -m state --state RELATED -j ACCEPT

#
# table: filter, chain: FOR_UDP1
#
$IPT -A FOR_UDP1 -p udp -m multiport --dport $WORMPORTS -j DROP

#
# table: filter, chain FOR_TCP1
#
$IPT -A FOR_TCP1 -p tcp -m multiport --dport $WORMPORTS -j DROP

#
# table: nat, chain: PREROUTING
#

# Spoof protection goes in prerouting, to stop badness
# before it even his the routing tables
$IPT -t nat -A PREROUTING -s 1.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 2.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 7.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 10.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 23.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 27.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 31.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 41.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 45.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 60.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 68.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 69.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 70.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 71.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 80.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 88.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 90.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 91.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 92.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 100.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 111.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 112.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -i ! lo -s 127.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 128.66.0.0/16 -j DROP
$IPT -t nat -A PREROUTING -s 172.16.0.0/12 -j DROP
$IPT -t nat -A PREROUTING -s 192.168.0.0/16 -j DROP
$IPT -t nat -A PREROUTING -s 197.0.0.0/16 -j DROP
$IPT -t nat -A PREROUTING -s 201.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 220.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 222.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 224.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 240.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 242.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 244.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 251.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 254.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -s 255.255.255.255 -j DROP

Answer 2

這是第三個

----------
+++++
Contributed by Jem Berkes <berkes@altavista.net>;
+++++

I'm somewhat new to iptables as well, but I think I have the hang of it.
Note that this is a firewall script used on a multipurpose machine: it
has some servers, and is also a masquerading gateway. But with the current
setup everything seems to be working perfectly (including ftp
connections). INTIF and EXTIF refer to internal and external interfaces.
TCP_SERVICES are the servers that I'm running.

#!/bin/sh

INTIF=eth0
EXTIF=ppp0
TCP_SERVICES="21,22,25,80,113"

modprobe ip_nat_ftp
modprobe ip_conntrack_ftp

iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING

# Kernel guard against SYN flooding
echo 1 >; /proc/sys/net/ipv4/tcp_syncookies

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $EXTIF -m state --state NEW -p tcp -m multiport \
        --dport $TCP_SERVICES -j ACCEPT
iptables -A INPUT -i $INTIF -m state --state NEW -j ACCEPT
iptables -A INPUT -i lo -m state --state NEW -j ACCEPT
iptables -A INPUT -j LOG --log-prefix "FW_INPUT  "

iptables -P FORWARD DROP
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
iptables -A FORWARD -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j LOG --log-prefix "FW_FORWARD  "

iptables -P OUTPUT ACCEPT

iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

Answer 3

這是第四個吧

----------
+++++
Contributed by Matthew Sachs <matthewg@zevils.com>;
+++++

The init script I use to initialize my firewall is attached.  It is
configurable through /etc/firewall.conf (also attached).  It does NAT
and can also be configured to do IPSec and port redirection.

*****
Begin firewall
*****

#!/bin/sh
#
# Set up a firewall using iptables that works with NAT and can
# be configured to work with IPSEC.  See /etc/firewall.conf.

set -x

. /etc/firewall.conf

getaddr () {
        if [ $1 = "addr" ]
                then FIELD=2
        elif [ $1 = "bcast" ]
                then FIELD=3
        elif [ $1 = "netmask" ]
                then FIELD=4
        fi
        ifconfig $2 | grep 'inet addr' | awk "{print \$$FIELD}" | sed 's/.*://'
}

LOCAL_IF=lo
LOCAL_IP=`getaddr addr $LOCAL_IF`
LOCAL_NET=`getaddr netmask $LOCAL_IF`
LOCAL_BCAST=`getaddr bcast $LOCAL_IF`

LAN_IP=`getaddr addr $LAN_IF`
LAN_NET=`getaddr netmask $LAN_IF`
LAN_BCAST=`getaddr bcast $LAN_IF`

WAN_IP=`getaddr addr $WAN_IF`
WAN_NET=`getaddr netmask $WAN_IF`
WAN_BCAST=`getaddr bcast $WAN_IF`

case $1 in
start|restart|force-reload)
        ;;
stop)
        exit 0
        ;;
esac

if [ -f /proc/sys/net/ipv4/ip_forward ]
        then if [ $FORWARDING ]
                then echo "Enabling IP forwarding..."
                echo "1" >; /proc/sys/net/ipv4/ip_forward
        else
                echo "Disabling IP forwarding..."
                echo "0" >; /proc/sys/net/ipv4/ip_forward
        fi
fi

if [ -f /proc/sys/net/ipv4/tcp_ecn ]
        then if [ $ECN ]
                then echo "Enabling ECN..."
                echo "1" >; /proc/sys/net/ipv4/tcp_ecn
        else
                echo "Disabling ECN..."
                echo "0" >; /proc/sys/net/ipv4/tcp_ecn
        fi
fi

for CHAIN in `$IPTABLES -L -n | grep Chain | awk '{ print $2 }'`
        do $IPTABLES -F $CHAIN
done

for TABLE in `cat /proc/net/ip_tables_names`
        do for CHAIN in `$IPTABLES -t $TABLE -L -n | grep Chain | awk '{ print $2 }'`
                do $IPTABLES -t $TABLE -F $CHAIN
        done       
done

echo "Clearing tables..."

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

$IPTABLES -t nat -A POSTROUTING -o $WAN_IF -j SNAT --to-source $WAN_IP
$IPTABLES -A FORWARD -i ! $WAN_IF -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -j REJECT

$IPTABLES -X icmp_packets 2>;&1 >; /dev/null
$IPTABLES -N icmp_packets
$IPTABLES -X tcp_packets 2>;&1 >; /dev/null
$IPTABLES -N tcp_packets
$IPTABLES -X udpincoming_packets 2>;&1 >; /dev/null
$IPTABLES -N udpincoming_packets

echo "Setting up rules..."

for PORT in $TCPALLOW
        do $IPTABLES -A tcp_packets -p TCP -m state --state NEW --dport $PORT -j ACCEPT
done
$IPTABLES -A tcp_packets -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A tcp_packets -j REJECT

for PORT in $UDPALLOW
        do $IPTABLES -A udpincoming_packets -p UDP --sport $PORT -j ACCEPT
        $IPTABLES -A udpincoming_packets -p UDP --dport $PORT -j ACCEPT
done
$IPTABLES -A udpincoming_packets -j REJECT

$IPTABLES -A icmp_packets -p ICMP -j ACCEPT

echo "Setting up forwarding..."

for FORWARDER in ${FORWARD

}
        do TMPFWD=`echo $FORWARDER | sed 's/:/ /g'`
        PROTO=`echo $TMPFWD | awk '{print $1}'`
        LOCALPORT=`echo $TMPFWD | awk '{print $2}'`
        REMOTEHOST=`echo $TMPFWD | awk '{print $3}'`
        REMOTEPORT=`echo $TMPFWD | awk '{print $4}'`

        $IPTABLES -t nat -A PREROUTING -p $PROTO -i $WAN_IF --dport $LOCALPORT -j DNAT --to-destination $REMOTEHOSTREMOTEPORT
        $IPTABLES -A FORWARD -p $PROTO -d $REMOTEHOST --dport $LOCALPORT -j ACCEPT
done

echo "Setting up protocol allows..."
# Let in IPSec traffic
for PROTO in $PROTOALLOW
        do $IPTABLES -A INPUT -p $PROTO -i $WAN_IF -j ACCEPT
done

echo "Setting up flow rules..."
$IPTABLES -A INPUT -i ! $WAN_IF -j ACCEPT
$IPTABLES -A INPUT -p ICMP -i $WAN_IF -j icmp_packets
$IPTABLES -A INPUT -p TCP -i $WAN_IF -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $WAN_IF -j udpincoming_packets

$IPTABLES -A INPUT -p ALL -i ! $WAN_IF -d $LOCAL_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i ! $WAN_IF -d $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $WAN_IP -s $WAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $WAN_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -j REJECT

$IPTABLES -A OUTPUT -p ALL -s $LOCAL_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $WAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s 0.0.0.0 -j ACCEPT
$IPTABLES -A OUTPUT -j DROP

echo "done."

Answer 4

lastone

----------
+++++
Contributed by vogt@hansenet.com
+++++

#! /bin/sh
#
# firewall        setting up IPTables firewalling
#                                 this is a debian startscript
(/etc/init.d/firewall)
#                                other distributions may need slight
modifications
#

IPTABLES="/sbin/iptables"

set -e

case "$1" in
  start)
        echo "Starting firewall: "
        modprobe ip_conntrack
   echo -n "setting default policy: "
   # syncookies and NO ip-forwarding
        echo 1 >; /proc/sys/net/ipv4/tcp_syncookies
        echo 0 >; /proc/sys/net/ipv4/ip_forward
        $IPTABLES -F
        $IPTABLES -X
        $IPTABLES -Z
        $IPTABLES -P INPUT DROP
        $IPTABLES -P FORWARD DROP
        $IPTABLES -P OUTPUT DROP
        $IPTABLES -N in_icmp
   $IPTABLES -N in_tcp
   $IPTABLES -N in_udp
   $IPTABLES -A INPUT -p tcp -j in_tcp
   $IPTABLES -A INPUT -p udp -j in_udp
   $IPTABLES -A INPUT -p icmp -j in_icmp
        echo "done"
        echo -n "spoofing, redirect and broadcast protection/logging: "
        echo "1" >; /proc/sys/net/ipv4/conf/all/log_martians
   echo "0" >; /proc/sys/net/ipv4/conf/all/accept_redirects
        echo "0" >; /proc/sys/net/ipv4/conf/all/accept_source_route
        echo "1" >; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
          echo "done"
        echo -n "enabling scan detection: "
   if [ -f /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ipt_psd.o ];
then
                $IPTABLES -A INPUT -m psd -m limit --limit 5/minute -j LOG
--log-prefix '#### Port Scan ####'
                echo "psd enabled"
   else
                $IPTABLES -A INPUT -p icmp --icmp-type echo-request -m limit
--limit 5/minute -j LOG --log-prefix '#### Ping Scan ####'
                # high rate for stealth scans, since they could be
legitimate connection
                # attempts as well
                $IPTABLES -A in_tcp -p tcp --tcp-flags SYN,ACK,FIN,RST RST
-m limit --limit 1/s --limit-burst 5 -j LOG --log-level info --log-prefix
'#### Stealth Scan ####'
                $IPTABLES -A in_tcp -p tcp --tcp-flags ALL FIN,URG,PSH -m
limit --limit 5/m -j LOG --log-level info --log-prefix '#### XMAS Scan ####'
                $IPTABLES -A in_tcp -p tcp --tcp-flags SYN,RST SYN,RST -m
limit --limit 5/m -j LOG --log-level info --log-prefix '#### SYN/RST Scan
####'
                $IPTABLES -A in_tcp -p tcp --tcp-flags SYN,FIN SYN,FIN -m
limit --limit 5/m -j LOG --log-level info --log-prefix '#### SYN/FIN Scan
####'
          echo "limited detection enabled (no ipt_psd module)"
   fi
   echo -n "flood, fragment and various other protections: "
        # we allow 4 TCP connects per second, no more
        $IPTABLES -N syn-flood
        $IPTABLES -A INPUT -p tcp --syn -j syn-flood
        $IPTABLES -A syn-flood -m limit --limit 1/s --limit-burst 4 -j
RETURN
        $IPTABLES -A syn-flood -j DROP
        # new connections that have no syn set are most probably evil
   $IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
        # invalid packets
        $IPTABLES -A INPUT -p tcp -m state --state INVALID -m limit --limit
10/m -j LOG --log-level info --log-prefix "### Invalid Packet ###"
   $IPTABLES -A INPUT -p tcp --tcp-option 64 -m limit --limit 5/m -j LOG
--log-level info --log-prefix "### Bad TCP FLAG(64) ###"
   $IPTABLES -A INPUT -p tcp --tcp-option 128 -m limit --limit 5/m -j LOG
--log-level info --log-prefix "### Bad TCP FLAG(12 ###"
        echo "done"
        echo -n "setting up ICMP: "
   # we allow echo requests and replies
   # could limit replies to could limit replies to related, but since we
   # answer ping requests, where would be the point in that?
        $IPTABLES -A in_icmp -p icmp --icmp-type  0 -j ACCEPT
        $IPTABLES -A in_icmp -p icmp --icmp-type  8 -j ACCEPT
   # we need destination unreachable
        $IPTABLES -A in_icmp -p icmp --icmp-type  3 -j ACCEPT
   # we are nice and allow traceroute, though it is not required
        $IPTABLES -A in_icmp -p icmp --icmp-type 11 -j ACCEPT
        $IPTABLES -A in_icmp -p icmp --icmp-type 30 -j ACCEPT
   echo "done"
   echo -n "enabling local and outgoing traffic: "
        $IPTABLES -A INPUT  -i lo -j ACCEPT
        $IPTABLES -I in_tcp -p tcp --dport 1024:65535 -m state --state
ESTABLISHED,RELATED -j ACCEPT
   $IPTABLES -A OUTPUT -j ACCEPT
   # we are nice and reject instead of drop ident traffic
   $IPTABLES -I in_tcp -p tcp --dport auth --j REJECT
   echo "done"
        echo -n "enabling selected services:"
   $IPTABLES -I in_tcp -p tcp --dport http -m state --state NEW,ESTABLISHED
-j ACCEPT
   echo -n " http"
        $IPTABLES -I in_tcp -p tcp --dport ssh -m state --state
NEW,ESTABLISHED -j ACCEPT
   echo -n " ssh"
        $IPTABLES -I in_tcp -p tcp --dport smtp -m state --state
NEW,ESTABLISHED -j ACCEPT
   echo -n " smtp"
        $IPTABLES -I in_tcp -p tcp --dport imaps -m state --state
NEW,ESTABLISHED -j ACCEPT
   echo -n " imaps"
        $IPTABLES -I in_tcp -p tcp --dport domain -m state --state
NEW,ESTABLISHED -j ACCEPT
        $IPTABLES -I in_udp -p udp --dport domain -m state --state
NEW,ESTABLISHED -j ACCEPT
   echo -n " dns"
        $IPTABLES -I in_tcp -p tcp --dport ftp -m state --state
NEW,ESTABLISHED -j ACCEPT
        # active ftp
        $IPTABLES -I in_tcp -p tcp --dport ftp-data -m state --state
ESTABLISHED,RELATED -j ACCEPT
   echo -n " ftp"
   # quake3
   $IPTABLES -I in_udp -p udp --dport 1024:65535 -j ACCEPT
   echo -n " quake (all UDP >;1024)"
   echo " - all done"
        echo "Firewall setup complete."
        ;;
  stop)
        echo -n "Shutting down firewall: "
        $IPTABLES -F
   $IPTABLES -X
        $IPTABLES -P INPUT ACCEPT
        $IPTABLES -P FORWARD ACCEPT
        $IPTABLES -P OUTPUT ACCEPT
        echo "done"
        ;;
  *)
        N=/etc/init.d/$NAME
        echo "Usage: $N {start|stop}" >;&2
        exit 1
        ;;
esac

exit 0

Answer 5

考虑很周全~我顶一把～ ^_^

Answer 6

可否解释一下

Answer 7

解释？这么多哦...
呵呵...
湖北哪里的？

Answer 8

我晕！
这样的策略规则如果正好有些数据包遍历下来从头到尾……

Answer 9

这是四个脚本...也不算长了.很多都注释掉了.
而且做fw如果有写出这样脚本要求的话～硬件也应该上得去...

btw:我的iptables脚本比这个长...