Erjing’s Blog

linux下的iptables防火墙脚本，

没有用啥特殊的东西，没有加放DDOS之类的，就一个限制端口功能，

然后融合了收集来的一些其他iptables脚本，能Drop IP之类的。

总之用起来很方便，开机直接运行就行了，默认就开22和80。

过几天有空了添加一些增强，比如DDOS，高级过滤之类的。

现在没空啊….

点此下载linux防火墙脚本

内容如下：

#! /bin/bash
#Script fwinit.sh by erjing@@@126@@@com.

#Initial environment.
IPT=/sbin/iptables
DIR=/root/bin/fwinit
OUTIP=`ifconfig eth0|grep “inet addr”|awk ‘{print$2}’|awk -F \: ‘{print$2}’`
INIP=`ifconfig eth1|grep “inet addr”|awk ‘{print$2}’|awk -F \: ‘{print$2}’`
Allow_ip_inside=`cat $DIR/share/list |grep “allow_ip_inside=”|awk -F \= ‘{print$2}’`
Allow_ip_outside=`cat $DIR/share/list |grep “allow_ip_outside=”|awk -F \= ‘{print$2}’`
Allow_ports_inbound_inside=`cat $DIR/share/list |grep “allow_ports_intbound_inside=”|awk -F \= ‘{print$2}’`
Allow_ports_inbound_outside=`cat $DIR/share/list |grep “allow_ports_inbound_outside=”|awk -F \= ‘{print$2}’`
Drop_ip_outside=`cat $DIR/share/list |grep “drop_ip_outside=”|awk -F \= ‘{print$2}’`
Drop_ip_inside=`cat $DIR/share/list |grep “drop_ip_inside=”|awk -F \= ‘{print$2}’`
Good_ip_outside=`cat $DIR/share/list |grep “good_ip_outside=”|awk -F \= ‘{print$2}’`
Good_ip_inside=`cat $DIR/share/list |grep “good_ip_inside=”|awk -F \= ‘{print$2}’`

#Clean and set all to default.
$IPT -F INPUT
$IPT -X
$IPT -P INPUT ACCEPT
$IPT -F OUTPUT
$IPT -P OUTPUT ACCEPT
$IPT -F FORWARD
$IPT -P FORWARD DROP

#For local loop device.
$IPT -A INPUT -i lo -p all -j ACCEPT
$IPT -A OUTPUT -o lo -p all -j ACCEPT

#Common rule.
$IPT -A INPUT -m state –state ESTABLISHED -j ACCEPT

#For allow port in outside.
for Port in $Allow_ports_inbound_outside
do
for IP in $Allow_ip_outside
do
$IPT -A INPUT -i eth0 -p tcp -s $IP -d $OUTIP –dport $Port -j ACCEPT
$IPT -A INPUT -i eth0 -p udp -s $IP -d $OUTIP –dport $Port -j ACCEPT
$IPT -A INPUT -i eth0 -p icmp -s $IP -d $OUTIP -j ACCEPT
done
done
#For allow port in inside.
for Port in $Allow_ports_inbound_inside
do
for IP in $Allow_ip_inside
do
$IPT -A INPUT -i eth1 -p tcp -s $IP -d $INIP –dport $Port -j ACCEPT
$IPT -A INPUT -i eth1 -p udp -s $IP -d $INIP –dport $Port -j ACCEPT
$IPT -A INPUT -i eth1 -p icmp -s $IP -d $INIP -j ACCEPT
done
done

#For allow ip in outside. Warning: “you should be careful for use this, The ip address will be trusted, No limit! “
for IP in $Good_ip_outside
do
$IPT -I INPUT -i eth0 -s $IP -j ACCEPT
$IPT -I OUTPUT -o eth0 -d $IP -j ACCEPT
done

#For allow ip in inside. Warning: “you should be careful for use this, The ip address will be trusted, No limit! “
for IP in $Good_ip_inside
do
$IPT -I INPUT -i eth1 -s $IP -j ACCEPT
$IPT -I OUTPUT -o eth1 -d $IP -j ACCEPT
done

#For drop ip in outside.
for IP in $Drop_ip_outside
do
$IPT -I INPUT -i eth0 -s $IP -j DROP
$IPT -I OUTPUT -o eth0-d $IP -j DROP
$IPT -I FORWARD -i eth0 -d $IP -j DROP
done

#For drop ip in inside.
for IP in $Drop_ip_inside
do
$IPT -I INPUT -i eth1 -s $IP -j DROP
$IPT -I OUTPUT -o eth1 -d $IP -j DROP
$IPT -I FORWARD -i eth1 -d $IP -j DROP
done

$IPT -P INPUT DROP
$IPT -nL

——————————————————-

看到了吗？就是把文件解压缩到/root/bin/fwinit，然后执行，文件会从/root/bin/fwinit/share/list里找哪些端口需要打开，哪些是信任主机。

/root/bin/fwinit/share/list内容如下：

#There is port and IP list for fwinit.sh

allow_ip_outside= 0.0.0.0/0
allow_ip_inside=
allow_ports_inbound_outside=22 80
allow_ports_intbound_inside=
good_ip_outside=1.2.3.4/32
good_ip_inside=
drop_ip_outside=
drop_ip_inside=

简单吧，写这个就是为了简单，看到那么多的linux防火墙脚本我头都要大了，我仅仅想有一个脚本能从配置文件里读取参数然后开放端口之类的，就需要这个功能而已。