iptables基础规则配置

设置默认规则

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

INPUT

• 允许已建立的或相关连接的通行，即允许我发出去的数据包入站

  iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

• 允许80(HTTP)/443(HTTPS)

  iptables -A INPUT -p tcp -m state --state NEW -m multiport --dports 80,143 -m comment --comment HTTP -j ACCEPT

• 允许访问NTP服务

  iptables -A INPUT -p udp -m udp --dport 123 -j ACCEPT

• 允许访问DNS服务

  iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT
  iptables -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT

• 允许回环网卡

  iptables -A INPUT -i lo -j ACCEPT

• 允许SSH端口的连接,脚本自动侦测目前的SSH端口,否则默认为22端口

  if grep "^Port" /etc/ssh/sshd_config>/dev/null;then
      sshdport=`grep "^Port" /etc/ssh/sshd_config | sed "s/Port\s//g" `
  else
      sshdport=22
  fi
  iptables -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport ${sshdport} -m comment --comment SSH -j ACCEPT

• 允许被ping

  iptables -A INPUT -p icmp -j ACCEPT

• 拒绝所有并且发送一条Destination Host Prohibited的消息给被拒绝的主机

  iptables -A INPUT -j REJECT --reject-with icmp-host-prohibite

OUTPUT

• 允许已建立的或相关连接的通行

  iptables -I OUTPUT 1 -m state --state ESTABLISHED,RELATED -j ACCEPT

• 允许回环网卡

  iptables -A OUTPUT -o lo -j ACCEPT

• 允许机器可以进行DNS查询

  iptables -A OUTPUT -p udp -m udp -j ACCEPT

默认规则和保存

iptables -Z; iptables-save > /etc/sysconfig/iptables

脚本

#!/bin/bash
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F

iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m multiport --dports 80,143 -m comment --comment HTTP -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 123 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

if grep "^Port" /etc/ssh/sshd_config>/dev/null;then
    sshdport=`grep "^Port" /etc/ssh/sshd_config | sed "s/Port\s//g" `
else
    sshdport=22
fi
iptables -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport ${sshdport} -m comment --comment SSH -j ACCEPT

iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

iptables -I OUTPUT 1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p udp -m udp -j ACCEPT

打赏