美文网首页
防火墙模板

防火墙模板

作者: halfsmile | 来源:发表于2017-03-16 21:47 被阅读0次
#!/bin/sh

/sbin/modprobe ip_conntrack_ftp

CONNECTION_TRACKING="1"
ACCEPT_AUTH="0"
DHCP_CLIENT="0"
IPT="/sbin/iptables"
INTERNET="eth1"
LOOPBACK_INTERFACE="lo"
IPADDR="my.ip.address"
SUBNET_BASE="network.address"
SUBNET_BROADCAST="directed.broadcast"
MY_ISP="my.isp.address.range"

NAMESERVER_1="isp.name.server.1"
NAMESERVER_2="isp.name.server.2"
NAMESERVER_3="isp.name.server.3"
POP_SERVER="isp.pop.server"
MAIL_SERVER="isp.mail.server"
NEWS_SERVER="isp.news.server"
TIMES_SERVER="some.time.server"
#DHCP_SERVER="isp.dhcp.server"
SSH_CLIENT="some.ssh.client"

LOOPBACK="127.0.0.0/8"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12"
CLASS_C="192.168.0.0/16"
CLASS_D_MULTICAST="224.0.0.0/4"
CLASS_E_RESERVED_NET="224.0.0.0/5"
BROADCAST_SRC="0.0.0.0"
BROADCAST_DEST="255.255.255.255"

PRIVPORTS="0:1023"
UNPRIVPORTS="1024:65535"

TRACEROUTE_SRC_PORTS="32769:65535"
TRACEROUTE_DEST_PORTS="33434:33523"

USER_CHAINS="EXT-input                     EXT-ouput \
             tcp-state-flags               connection-tracking \
             source-address-check          destination-address-check \
             local-dns-server-query        remote-dns-server-response \
             local-tcp-client-request      remote-tcp-client-response \
             remote-tcp-client-request     local-tcp-server-response \
             local-udp-client-request      remote-udp-server-response \
             local-dhcp-client-query       remote-dhcp-server-response \
             EXT-icmp-out                  EXT-icmp-in
             EXT-log-in                    EXT-log-out
             log-tcp-state"

# Enable broadcast ehco Protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
  echo 0 > $f
done

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
  echo 0 >$f
done

for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
  echo 0 >$f
done

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
  echo 1 >$f
done

for f in /proc/sys/net/ipv4/conf/*/log_martians; do
  echo 1 >$f 
done
##################

# remove any existing rules from all chain
$IPT --flush
$IPT -t nat --flush
$IPT -t mangle --flush
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X

$IPT --policy INPUT ACCEPT
$IPT --policy OUTPUT ACCEPT
$IPT --policy FORWARD ACCEPT
$IPT -t nat --policy PREROUTING ACCEPT
$IPT -t nat --policy OUTPUT ACCEPT
$IPT -t nat --policy POSTROUTING ACCEPT
$IPT -t mangle --policy PREROUTING ACCEPT
$IPT -t mangle --policy OUTPUT ACCEPT
if [ "$1" = "stop" ]
then
echo "Firewall complete stoped!"
exit 0
fi


$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

$IPT --policy INPUT DROP
$IPT --policy OUTPUT DROP
$IPT --policy FORWARD DROP

for i in $USER_CHAINS; do
  $IPT -N $i
done

$IPT -A EXT-ouput -p udp --sport 53 --dport 53 \
-j local-dns-server-query
$IPT -A EXT-input -p udp --sport 53 --dport 53 \
-j remote-dns-server-response

$IPT -A EXT-ouput -p tcp \
--sport $UNPRIVPORTS --dport 53 \
-j local-dns-server-query
$IPT -A EXT-input -p tcp \
--sport 53 --dport $UNPRIVPORTS \
-j remote-dns-server-response

if [ "$CONNECTION_TRACKING" = "1"]; then
  $IPT -A local-dns-server-query \
  -d $NAMESERVER_1 \
  -m state --state NEW -j ACCEPT
  
  $IPT -A local-dns-server-query \
  -d $NAMESERVER_2 \
  -m state --state NEW -j ACCEPT

  $IPT -A local-dns-server-query \
  -d $NAMESERVER_3 \
  -m state --state NEW -j ACCEPT
fi 

$IPT -A local-dns-server-query \
-d $NAMESERVER_1 -j ACCEPT
$IPT -A local-dns-server-query \
-d $NAMESERVER_2 -j ACCEPT
$IPT -A local-dns-server-query \
-d $NAMESERVER_3 -j ACCEPT


$IPT -A remote-dns-server-response \
-s $NAMESERVER_1 -j ACCEPT
$IPT -A remote-dns-server-response \
-s $NAMESERVER_2 -j ACCEPT
$IPT -A remote-dns-server-response \
-s $NAMESERVER_3 -j ACCEPT

###############
#local TCP client remote server

$IPT -A EXT-ouput -p tcp \
--sport $UNPRIVPORTS \
-j local-tcp-client-request
$IPT -A EXT-input -p ! --syn \
--dport $UNPRIVPORTS \
-j remote-tcp-server-response

#SSH
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d <selected host> --dport 22 \
  -m state --state NEW \
  -j ACCEPT
fi  
$IPT -A local-tcp-client-request -p tcp \
-d <selected host> --dport 22 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s <selected host> --sport 22 \
-j ACCEPT

# client http https auth FTP
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -m multiport --destination-port 80,433,21 \
  --syn -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-m multiport --destination-port 80,433,21 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp \
-m multiport --source-port 80,433,21 ! --syn \
-j ACCEPT

#POP client
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d $POP_SERVER --dport 110 \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-d $POP_SERVER --dport 110 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s $POP_SERVER --sport 110 \
-j ACCEPT

#SMTP client
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d $MAIL_SERVER --dport 25 \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-d $MAIL_SERVER --dport 25 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s $MAIL_SERVER --sport 25 \
-j ACCEPT
# new client

if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d $NEWS_SERVER --dport 119 \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-d $NEWS_SERVER --dport 119 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s $NEWS_SERVER --sport 119 \
-j ACCEPT

#FTP client
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  --dport $UNPRIVPORTS \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
--dport $UNPRIVPORTS -j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
--sport $UNPRIVPORTS -j ACCEPT

##################
#local tcp server

$IPT -A EXT-input -p tcp \
--sport $UNPRIVPORTS \
-j remote-tcp-client-request
$IPT -A EXT-ouput -p tcp ! --syn \
--dport $UNPRIVPORTS \
-j local-tcp-server-response

#FTP

$IPT -A EXT-input -p tcp \
--sport 20 --dport $UNPRIVPORTS \
-j ACCEPT

$IPT -A EXT-ouput -p tcp ! --syn \
--sport $UNPRIVPORTS --dport 20 \
-j ACCEPT

#ssh server
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A remote-tcp-client-request -p tcp \
  -s <selected host> --dport 22 \
  -m state --state NEW \
  -j ACCEPT
fi  
$IPT -A remote-tcp-client-request -p tcp \
-s <selected host> --dport 22 \
-j ACCEPT
$IPT -A local-tcp-server-response -p tcp ! --syn \
-d <selected host> --sport 22 \
-j ACCEPT
#local udp client remote server

$IPT -A EXT-ouput -p udp \
--sport $UNPRIVPORTS \
-j local-udp-client-request

$IPT -A EXT-input -p udp \
--dport $UNPRIVPORTS \
-j remote-udp-server-response
# time client
if [ "CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-udp-client-request -p udp \
  -d $TIMES_SERVER --dport 123 \
  -m state --state NEW \
  -j ACCEPT
fi 
$IPT -A local-udp-client-request -p udp \
-d $TIMES_SERVER --dport 123 \
-j ACCEPT
$IPT -A remote-udp-server-response -p udp \
-s $TIMES_SERVER --sport 123 \
-j ACCEPT
######################
#icmp
 

#################
#TCP state flags 
$IPT -A tcp-state-flags -p tcp --tcp-flags ALL NONE -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags SYN,RST SYN,RST -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags FIN,RST FIN,RST -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags ACK,FIN FIN -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags ACK,PSH PSH -j log-tcp-state 
$IPT -A tcp-state-flags -p tcp --tcp-flags ACK,URG URG -j log-tcp-state

$IPT -A log-tcp-state -p tcp -j LOG \
--log-prefix "Illegal TCP state: " \
--log-ip-options --log-tcp-options
$IPT -A log-tcp-state -j DROP
#bypass rule check for ESTABLISHED exchanges
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A connection-tracking -m state \
  --state ESTABLISHED,RELATED \
  -j ACCEPT
  $IPT -A connection-tracking -m state --state INVALID \
  -j LOG --log-prefix "INVALID packet: "
  $IPT -A connection-tracking -m state --state INVALID -j DROP
fi 
#source-address-check
$IPT -A source-address-check -s $IPADDR -j DROP
$IPT -A source-address-check -s $CLASS_A -j DROP
$IPT -A source-address-check -s $CLASS_B -j DROP
$IPT -A source-address-check -s $CLASS_C -j DROP
$IPT -A source-address-check -s $CLASS_D_MULTICAST -j DROP
$IPT -A source-address-check -s $CLASS_E_RESERVED_NET -j DROP
$IPT -A source-address-check -s $LOOPBACK -j DROP
$IPT -A source-address-check -s 0.0.0.0/8 -j DROP
$IPT -A source-address-check -s 169.254.0.0/16 -j DROP
$IPT -A source-address-check -s 192.0.2.0/24 -j DROP
#destination-address-check
$IPT -A destination-address-check -d $BROADCAST_DEST -j DROP
$IPT -A destination-address-check -d $SUBNET_BASE -j DROP
$IPT -A destination-address-check -d $SUBNET_BROADCAST -j DROP
$IPT -A destination-address-check ! -p udp \
-d $CLASS_D_MULTICAST -j DROP
$IPT -A INPUT -p -tcp -j tcp-state-flags
$IPT -A OUTPUT -p -tcp -j tcp-state-flags

if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A INPUT -j connection-tracking
  $IPT -A OUTPUT -j connection-tracking
fi 

$IPT -A INPUT ! -p tcp -j source-address-check 
$IPT -A INPUT -p tcp --syn -j source-address-check
$IPT -A INPUT -j destination-address-check

$IPT -A OUTPUT -j destination-address-check

$IPT -A INPUT -i $INTERNET -d $IPADDR -j EXT-input

$IPT -A INPUT -i $INTERNET -p udp -d $CLASS_D_MULTICAST -j DROP
$IPT -A OUTPUT -o $INTERNET -p udp -s $IPADDR -d $CLASS_D_MULTICAST \
-j DROP


$IPT -A OUTPUT -o $INTERNET -s $IPADDR -j EXT-ouput

$IPT -A INPUT -j EXT-log-in
$IPT -A OUTPUT -j EXT-log-out
exit 0

相关文章

  • 防火墙模板

  • 晨间日记2022-0910

    【嘉许】：组件模板设计，思考防火墙功能。esg的防火墙确认。 【感恩】：感恩肖老师提醒讨论职场潜规则。感恩力永帮忙...

  • centos7防火墙基本命令

    防火墙的基本使用命令 启动防火墙 停止防火墙 开机启动防火墙 开机禁止防火墙 查看防火墙状态 查看防火墙是否开机启...

  • LINUX防火墙

    一、iptables防火墙 -1、基本操作 查看防火墙状态 停止防火墙 启动防火墙 重启防火墙 永久关闭防火墙 永...

  • Linux 防火墙firewall设置

    Linux 防火墙设置说明：使用的是FIREWALL防火墙 安装防火墙 开启防火墙 排除端口 命令含义： 防火墙重...

  • Linux 防火墙设置

    Linux 防火墙设置 说明：使用的是FIREWALL防火墙 安装防火墙 开启防火墙 排除端口 防火墙重启 关闭端...

  • Centos6.5 关闭系统防火墙及内核防火墙

    清空系统防火墙 保存防火墙配置 临时关闭内核防火墙 永久关闭内核防火墙

  • firewall防火墙相关操作

    firewall 查看防火墙状态 开启防火墙 设置防火墙开机自启 查看防火墙设置开机自启是否成功 重启防火墙 查看...

  • Linux基本命令介绍

    本文命令都是基于CentOS7系统 一、防火墙相关命令 临时关闭防火墙 禁止防火墙开机启动 开启防火墙 查看防火墙...

  • iptables简介

    第1章 Iptables简介 防火墙分为硬件防火墙与软件防火墙，硬件防火墙价格很高，多数中小型公司使用软件防火墙，...

网友评论

      本文标题：防火墙模板

      本文链接：https://www.haomeiwen.com/subject/xmksnttx.html

      延伸阅读

      深度阅读

      • 您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！

      栏目导航

      热点阅读

      关于我们|服务条款|联系我们|防火墙模板|投稿指南|网站地图|RSS订阅|排版工具|手机版

      提供经典美文摘抄,优美散文欣赏,现代诗歌精选,短篇小说,心情随笔,表白情书范文,故事会在线阅读欣赏

      Copyright © 2014-2023 Haomeiwen.com All Rights Reserved. 好美文阅读网 版权所有

      备案信息：桂公网安备 45052102000051号 · 桂ICP备13007215号-3

      本站所收录作品、热点评论等信息部分来源互联网，目的只是为了系统归纳学习和传递资讯

      所有作品版权归原创作者所有，与本站立场无关，如不慎侵犯了你的权益，请联系我们告知，我们将做删除处理！