一个简单的防火墙（iptables）实例

Posted 2020-09-30

#!/bin/bash
#
#for centos7 iptables table
#
#yum install iptables-services -y
#
#
#规则的排列是有顺序的
#
#清除默认规则

iptables -F
iptables -X
iptables -Z

#设置策略

iptables -P INPUT DROP
#iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

#定制规则
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -s 10.44.148.0/21 -j ACCEPT
iptables -A INPUT -i eth0 -s 10.51.177.0/21 -j ACCEPT
iptables -A INPUT -i eth0 -s 10.51.181.0/21 -j ACCEPT
iptables -A INPUT -i eth0 -s 10.44.148.0/21 -j ACCEPT
iptables -A INPUT -i eth0 -s 10.51.179.0/21 -j ACCEPT
iptables -A INPUT -i eth0 -s 10.44.167.0/21 -j ACCEPT
iptables -A INPUT -i eth0 -s 10.44.200.0/21 -j ACCEPT

#eth1定制规则
iptables -A INPUT -i eth1 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 52113 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 21 -j ACCEPT
#mysql
iptables -A INPUT -i eth1 -p tcp --dport 3306 -j ACCEPT
#redis
iptables -A INPUT -i eth1 -p tcp --dport 6380 -j ACCEPT
#mongodb
iptables -A INPUT -i eth1 -p tcp --dport 27017 -j ACCEPT
#svn
iptables -A INPUT -i eth1 -p tcp --dport 3690 -j ACCEPT
#address
iptables -A INPUT -i eth1 -p tcp --dport 7070 -j ACCEPT
#admin117
iptables -A INPUT -i eth1 -p tcp --dport 7474 -j ACCEPT
#bigscreen
iptables -A INPUT -i eth1 -p tcp --dport 9999 -j ACCEPT
#bss
iptables -A INPUT -i eth1 -p tcp --dport 9191 -j ACCEPT
#callcenter
iptables -A INPUT -i eth1 -p tcp --dport 7171 -j ACCEPT
#employee
iptables -A INPUT -i eth1 -p tcp --dport 9292 -j ACCEPT
#jenkins
iptables -A INPUT -i eth1 -p tcp --dport 9595 -j ACCEPT
#mobile
iptables -A INPUT -i eth1 -p tcp --dport 9393 -j ACCEPT
#oa
iptables -A INPUT -i eth1 -p tcp --dport 9494 -j ACCEPT
#选址分析
iptables -A INPUT -i eth1 -p tcp --dport 7373 -j ACCEPT
#mysql-tool
iptables -A INPUT -i eth1 -p tcp --dport 9797 -j ACCEPT
#universiyt
iptables -A INPUT -i eth1 -p tcp --dport 9696 -j ACCEPT
#university_test
iptables -A INPUT -i eth1 -p tcp --dport 7272 -j ACCEPT

 

iptables -A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

#NAT规则

#次规则只需在NAT服务器上配置，其他内网机指定网关(gateway)为此内网IP

#清除NAT　table 的规则

#iptables -F -t nat
#iptables -X -t nat
#iptables -Z -t nat
#iptables -t nat -P PREROUTING ACCEPT
#iptables -t nat -P POSTROUTING ACCEPT
#iptables -t nat -P OUTPUT ACCEPT

 

#iptables -A INPUT -i eth1 -j ACCEPT
#echo "0" > /proc/sys/net/ipv4/ip_forward

#把收到的所有数据包SNAT成101.200.177.83发出去

#iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 101.200.177.83
#iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 101.200.177.83

#DNAT转换，公网IP 在eth0 　　　内网IP 192.168.1.10(注意内网防火墙)

#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 13306 -j DNAT --to-destination 10.51.177.139:3306
#iptables -t nat -A PREROUTING -i eth1 -d 101.200.177.83 -p tcp --dport 13306 -j DNAT --to-destination 115.28.134.12:3306

#写入防火墙规则
#/etc/init.d/iptables save
#/usr/libexec/iptables/iptables.init save
service iptables save