#!/bin/sh
#
# rc.firewall - Initial SIMPLE IP Firewall script for Linux 2.4.x and iptables
#
# Copyright (C) 2001?Oskar Andreasson <bluefluxATkoffeinDOTnet>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.?See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program or from the site that you downloaded it
# from; if not, write to the Free Software Foundation, Inc., 59 Temple
# Place, Suite 330, Boston, MA?02111-1307?USA
#
###########################################################################
#
# 1. 配置选项.
#
#
# 1.1 Internet 相关变量设置.
#
INET_IP="194.236.50.155"
INET_IFACE="eth0"
INET_BROADCAST="194.236.50.255"
#
# 1.1.1 DHCP相关设置
#
#
# 1.1.2 PPPoE相关设置
#
#
# 1.2 局域网相关变量设置.
#
LAN_IP="192.168.0.2" #防火墙连接局域网的IP地址
LAN_IP_RANGE="192.168.0.0/16" #局域网地址
LAN_IFACE="eth1" #防火墙连接局域网的网络接口
#
# 1.3 DMZ 非军事区相关变量设置.
#
#
# 1.4 本机相关变量设置.
#
LO_IFACE="lo" #本地接口名称
LO_IP="127.0.0.1" #本地接口IP
#
# 1.5 IPTables 路径设置.
#
IPTABLES="/usr/sbin/iptables"
#
# 1.6 其它配置.
#
###########################################################################
#
# 2. 要加载的模块.
#
#
# 初始加载的模块
#
/sbin/depmod -a
#
# 2.1 需加载的模块
#
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
#
# 2.2 不需加载的模块
#
#/sbin/modprobe ipt_owner
#/sbin/modprobe ipt_REJECT
#/sbin/modprobe ipt_MASQUERADE
#/sbin/modprobe ip_conntrack_ftp
#/sbin/modprobe ip_conntrack_irc
#/sbin/modprobe ip_nat_ftp
#/sbin/modprobe ip_nat_irc
###########################################################################
#
# 3. /proc 设置.
#
#
# 3.1 需要的proc配置
#
echo "1" > /proc/sys/net/ipv4/ip_forward
#
# 3.2 不需要的proc配置
#
#echo "1" >
/proc/sys/net/ipv4/conf/all/rp_filter
#echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
#echo "1" > /proc/sys/net/ipv4/ip_dynaddr
###########################################################################
#
# 4. 建立规则.
#
######
# 4.1 Filter表
#
#
# 4.1.1 建立策略
#
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
#
# 4.1.2 创建自定义链Create userspecified chains
#
#
# 为不可靠的tcp包建立自定义链Create chain
for bad tcp packets
#
$IPTABLES -N bad_tcp_packets
#
# 分别为ICMP, TCP 和 UDP协议建立自定义链Create separate chains for ICMP, TCP and UDP to traverse
#
$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets
#
# 4.1.3 在自定义链建立规则Create content in userspecified chains
#
#
# bad_tcp_packets链bad_tcp_packets chain
#
#这条链包含的规则检查进入包（incoming packet）的包头是否不正常或有没有其他问题，并进行相应地处理。但事实上，我们使用它只是为了过滤掉一些特殊的包：没有设置SYN位但又是NEW状态的TCP包，还有那些设置了SYN/ACK但也被认为是NEW状态的TCP包。这条链可以用来检查所有可能的不一致的东西
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
#
# allowed链?allowed chain
#
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
#
# TCP规则?TCP rules
#
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j
allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed
#
# UDP端口?UDP ports
#
#$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port
53 -j ACCEPT
#$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 123 -j ACCEPT
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 2074 -j ACCEPT
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 4000 -j ACCEPT
#
# 如果网络中存在Microsoft网络的话，你会遭遇洪水一样的广播信息，下面的指令将阻止这些广播并在日志中#记录．?In Microsoft Networks you will be
swamped by broadcasts. These lines
# will prevent them from showing up in the logs.
#
#$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d $INET_BROADCAST --destination-port?135:139 -j DROP
#
# 如果有来自我们网络之外的DHCP请求的话，就会很快把我们的日志塞满，下面的指令If we get DHCP requests from the Outside of our network, our logs
will
# be swamped as well. This rule will block them from getting logged.
#
#$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 --destination-port 67:68 -j DROP
#
#ICMP规则?ICMP rules
#
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j
ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
#
# 4.1.4 INPUT链?INPUT chain
#
#
# 排除不良TCP包?Bad TCP packets we
don't want.
#
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
#
# 非internet网络部分的规则?Rules for
special networks not part of the Internet
#
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j
ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT
#
# 有关本地DHCP的特殊规则?Special rule
for DHCP requests from LAN, which are not caught properly
# otherwise.
#
$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT
#
# 来自因特网的进入包的规则 Rules for incoming packets from the
internet.
#
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
#
# 如果防火墙外存在Microsoft网络的话，你会遭遇洪水一样的多播信息，下面的指令将丢弃这些包，所以日志就不会被这些东西淹没# 记录If you have a Microsoft Network on the
outside of your firewall, you may
# also get flooded by Multicasts. We drop them so we do not get flooded by
# logs
#
#$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP
#
# 将不满足上述规则的形为怪异的包记录在案 Log weird packets that don't
match the above.
#
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "
#
# 4.1.5 FORWARD链?FORWARD chain
#
#
# 排除不良TCP包?Bad TCP packets we
don't want
#
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
#
# 接收想要转发的TCP包?Accept the
packets we actually want to forward
#
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# 将不满足上述规则的形为怪异的包记录在案?Log weird packets that don't
match the above.
#
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "
#
# 4.1.6?OUTPUT链?OUTPUT chain
#
#
# 排除不良TCP包?Bad TCP packets we
don't want.
#
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
#
# 决定允许哪个IP包OUTPUT的规则?Special OUTPUT rules to decide which IP's to allow.
#
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
#
# 将不满足上述规则的形为怪异的包记录在案?Log weird packets that don't
match the above.
#
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
######
# 4.2 nat表?nat table
#
#
# 4.2.1 设置策略?Set policies
#
#
# 4.2.2 创建用户自定义链?Create user specified chains
#
#
# 4.2.3 在用户自定义链中建立规则?Create content in user specified
chains
#
#
# 4.2.4 PREROUTING链?PREROUTING chain
#
#
# 4.2.5 POSTROUTING链?POSTROUTING chain
#
#
# 允许简单的IP转发及网络地址转换?Enable
simple IP Forwarding and Network Address Translation
#
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP
#
# 4.2.6 OUTPUT链?OUTPUT chain
#
######
# 4.3 mangle表?mangle table
#
#
# 4.3.1 设置策略?Set policies
#
#
# 4.3.2 创建用户自定义链?Create user specified chains
#
#
# 4.3.3 在用户自定义链中建立规则?Create content in user specified
chains
#
#
# 4.3.4 PREROUTING链?PREROUTING chain
#
#
# 4.3.5 INPUT链?INPUT chain
#
#
# 4.3.6 FORWARD链?FORWARD chain
#
#
# 4.3.7 OUTPUT链?OUTPUT chain
#
#
# 4.3.8 POSTROUTING链?POSTROUTING chain
#
初始化
IPTABLES -X
IPTABLES -t nat -X
IPTABLES -t mangle -X
iptables -Z
定义策略(默认规则)
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED -j ACCEPT