[转帖]安全脚本
这是国外一个网站的防火墙脚本，功能比较强大，转发过来，希望对大家有帮忙 <br><br>
引用: <br>
#!/bin/sh <br>
############################ <br>
# IPTABLES SCRIPT # <br>
# by Taka John Brunkhorst # <br>
# Feel Free to Copyleft # <br>
############################ <br>
<br>
#Basic Config <br>
<br>
#where your iptables is <br>
IPTABLES=/sbin/iptables <br>
<br>
#your EXTERNAL Network interface. <br>
EXT=eth0 <br>
<br>
#your INTERNAL Network interface. <br>
INT=eth1 <br>
<br>
#YOUR DNS SERVER on /etc/resolv.conf <br>
DNS1=xxx.xxx.xxx.xxx <br>
<br>
#YOUR DNS SERVER on /etc/resolv.conf <br>
DNS2=xxx.xxx.xxx.xxx <br>
<br>
#Flushing and cleaning old rules. <br>
$IPTABLES -F <br>
$IPTABLES -X <br>
<br>
#returning something. <br>
echo "iptables rules applied" <br>
<br>
#Setting Everything to DROP. <br>
#note: Setting OUTPUT or FORWARD are not friendly for network games which uses ramdom ports. <br>
$IPTABLES -P INPUT DROP <br>
$IPTABLES -P OUTPUT DROP <br>
$IPTABLES -P FORWARD DROP <br>
<br>
#NAT,To enable,comment out line below. <br>
#$IPTABLES -t nat -A POSTROUTING -o $EXT -j MASQUERADE <br>
<br>
#IPFORWARDING, To enable, comment out line below. <br>
#$IPTABLES -t nat -A PREROUTING -i $EXT -p tcp --dport 10535 -j DNAT --to-destination 192.168.0.251:10535 <br>
<br>
#Uncomment below to allow ipforwarding <br>
#echo "1" > /proc/sys/net/ipv4/ip_forward <br>
<br>
<br>
##Starting Define process.############### <br>
##To enable these, Dont forget to modify "INPUT RULE" "OUTPUT RULE" "FORWARD RULE" at bottom of the script!### <br>
<br>
#Allow ESTABLISHED connections <br>
$IPTABLES -N allowed-connection <br>
$IPTABLES -F allowed-connection <br>
$IPTABLES -A allowed-connection -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT <br>
$IPTABLES -A allowed-connection -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT <br>
<br>
<br>
#ALLOW INCOMING SSHD REQUESTS. <br>
$IPTABLES -N allow-ssh-input <br>
$IPTABLES -F allow-ssh-input <br>
$IPTABLES -A allow-ssh-input -m limit --limit 1/second -p tcp --tcp-flags ALL RST --dport 22 -j ACCEPT <br>
$IPTABLES -A allow-ssh-input -m limit --limit 1/second -p tcp --tcp-flags ALL FIN --dport 22 -j ACCEPT <br>
$IPTABLES -A allow-ssh-input -m limit --limit 1/second -p tcp --tcp-flags ALL SYN --dport 22 -j ACCEPT <br>
$IPTABLES -A allow-ssh-input -m state --state ESTABLISHED,RELATED -p tcp --dport 22 -j ACCEPT <br>
<br>
#ALLOW INCOMING FTPD REQUESTS. <br>
#$IPTABLES -N allow-ftp-input <br>
#$IPTABLES -F allow-ftp-input <br>
#$IPTABLES -A allow-ftp-input -m limit --limit 1/second -p tcp --tcp-flags ALL RST --dport 21 -j ACCEPT <br>
#$IPTABLES -A allow-ftp-input -m limit --limit 1/second -p tcp --tcp-flags ALL FIN --dport 21 -j ACCEPT <br>
#$IPTABLES -A allow-ftp-input -m limit --limit 1/second -p tcp --tcp-flags ALL SYN --dport 21 -j ACCEPT <br>
#$IPTABLES -A allow-ftp-input -m state --state ESTABLISHED,RELATED -p tcp --dport 21 -j ACCEPT <br>
<br>
#ALLOW OUTGOING SSH CONNECTIONS <br>
$IPTABLES -N allow-ssh-output <br>
$IPTABLES -F allow-ssh-output <br>
$IPTABLES -A allow-ssh-output -m state --state ESTABLISHED,RELATED -p tcp --dport 22 -j ACCEPT <br>
<br>
#ALLOW OUTGOING FTP CONNECTIONS <br>
$IPTABLES -N allow-ftp-output <br>
$IPTABLES -F allow-ftp-output <br>
$IPTABLES -A allow-ftp-output -m state --state ESTABLISHED,RELATED -p tcp --dport 21 -j ACCEPT <br>
<br>
#ALLOW OUTGOING DNS REQUESTS. <br>
$IPTABLES -N allow-dns-output <br>
$IPTABLES -F allow-dns-output <br>
$IPTABLES -A allow-dns-output -p udp -d $DNS1 --dport domain -j ACCEPT <br>
$IPTABLES -A allow-dns-output -p udp -d $DNS2 --dport domain -j ACCEPT <br>
<br>
#ALLOW OUTGOING HTTP/HTTPS REQUESTS. <br>
$IPTABLES -N allow-www-output <br>
$IPTABLES -F allow-www-output <br>
$IPTABLES -A allow-www-output -p tcp --dport www -j ACCEPT <br>
$IPTABLES -A allow-www-output -p tcp --dport https -j ACCEPT <br>
<br>
#ALLOW INCOMING SAMBA SERVER REQUESTS. <br>
$IPTABLES -N allow-samba-input <br>
$IPTABLES -F allow-samba-input <br>
$IPTABLES -A allow-samba-input -i $INT -p tcp --dport 137 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p udp --dport 137 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p tcp --sport 137 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p udp --sport 137 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p tcp --dport 138 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p udp --dport 138 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p tcp --sport 138 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p udp --sport 138 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p tcp --dport 139 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p udp --dport 139 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p tcp --sport 139 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p udp --sport 139 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p tcp --dport 445 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p udp --dport 445 -j ACCEPT <br>
$IPTABLES -A allow-samba-input -i $INT -p tcp --sport 445 -j ACCEPT <br>
#$IPTABLES -A allow-samba-input -i $INT -p udp --sport 445 -j ACCEPT <br>
<br>
<br>
#LOG and DROP Bad flags, block portscans, SYN floods. etc. <br>
$IPTABLES -N bad-flags <br>
$IPTABLES -F bad-flags <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 3/minute -j LOG --log-level alert --log-prefix "NMAP-XMA <br>
S:" <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags ALL ALL -m limit --limit 3/minute -j LOG --log-level 1 --log-prefix "XMAS:" <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags ALL ALL -j DROP <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -m limit --limit 3/minute -j LOG --log-level 1 --log-prefix "XMAS <br>
-PSH:" <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags ALL NONE -m limit --limit 3/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:" <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags ALL NONE -j DROP <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 3/minute -j LOG --log-level 5 --log-prefix "SYN/RST:" <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP <br>
$IPTABLES -A bad-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 3/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:" <br>
<br>
#BLOCK OS Fingerprint Detection <br>
$IPTABLES -N os-fingerprint <br>
$IPTABLES -F os-fingerprint <br>
$IPTABLES -A os-fingerprint -p tcp --dport 0 -j DROP <br>
$IPTABLES -A os-fingerprint -p udp --dport 0 -j DROP <br>
$IPTABLES -A os-fingerprint -p tcp --sport 0 -j DROP <br>
$IPTABLES -A os-fingerprint -p udp --sport 0 -j DROP <br>
$IPTABLES -A os-fingerprint -p icmp --icmp-type address-mask-request -j DROP <br>
$IPTABLES -A os-fingerprint -p icmp --icmp-type address-mask-reply -j DROP <br>
<br>
#DROP INVALID PACKETS <br>
$IPTABLES -N invalid-packets <br>
$IPTABLES -F invalid-packets <br>
$IPTABLES -A invalid-packets -m state --state INVALID -j DROP <br>
<br>
#BAD PORTS,TROJAN,BACKDOOR PORTS <br>
$IPTABLES -N bad-ports <br>
$IPTABLES -F bad-ports <br>
$IPTABLES -A bad-ports -p tcp -m multiport --dport 3049,1999,4329,1,2,13,98,111,901,902 -j DROP <br>
$IPTABLES -A bad-ports -p udp -m multiport --dport 3049,1999,4329,1,2,13,98,111,901,902 -j DROP <br>
$IPTABLES -A bad-ports -p tcp --dport 12345 -j DROP <br>
$IPTABLES -A bad-ports -p udp --dport 12345 -j DROP <br>
$IPTABLES -A bad-ports -p tcp --dport 1524 -j DROP <br>
$IPTABLES -A bad-ports -p udp --dport 1524 -j DROP <br>
$IPTABLES -A bad-ports -p tcp --dport 2049 -j DROP <br>
$IPTABLES -A bad-ports -p udp --dport 2049 -j DROP <br>
$IPTABLES -A bad-ports -p tcp --dport 27444 -j DROP <br>
$IPTABLES -A bad-ports -p udp --dport 27444 -j DROP <br>
$IPTABLES -A bad-ports -p tcp --dport 31335 -j DROP <br>
$IPTABLES -A bad-ports -p udp --dport 31335 -j DROP <br>
$IPTABLES -A bad-ports -p tcp --dport 27665 -j DROP <br>
$IPTABLES -A bad-ports -p udp --dport 27665 -j DROP <br>
$IPTABLES -A bad-ports -p tcp --dport 31337 -j DROP <br>
$IPTABLES -A bad-ports -p udp --dport 31337 -j DROP <br>
$IPTABLES -A bad-ports -p tcp --dport 65535 -j DROP <br>
$IPTABLES -A bad-ports -p udp --dport 65535 -j DROP <br>
<br>
##END of Define process.############### <br>
##Now Modify "INPUT RULE" "OUTPUT RULE" "FORWARD RULE" below### <br>
<br>
<br>
#FILTERS <br>
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts <br>
echo "2" > /proc/sys/net/ipv4/conf/all/rp_filter <br>
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses <br>
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all <br>
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route <br>
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects <br>
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians <br>
<br>
####INPUT RULE#### <br>
#Packets coming to your box. <br>
<br>
#DHCPD: Uncomment below if you are running DHCPD(SERVER) <br>
#$IPTABLES -A INPUT -i $INT -p udp --dport 67:68 -j ACCEPT <br>
<br>
#Uncomment below to ALLOW samba server. <br>
#$IPTABLES -A INPUT -j allow-samba-input <br>
<br>
#Uncomment below to ALLOW SSH server. <br>
#$IPTABLES -A INPUT -j allow-ssh-input <br>
<br>
#Uncomment below to ALLOW server. <br>
#$IPTABLES -A INPUT -j allow-ftp-input <br>
<br>
$IPTABLES -A INPUT -j invalid-packets <br>
$IPTABLES -A INPUT -j bad-flags <br>
$IPTABLES -A INPUT -j os-fingerprint <br>
$IPTABLES -A INPUT -j bad-ports <br>
$IPTABLES -A INPUT -i lo -j ACCEPT <br>
<br>
#Always allow "allowed-connection" last! <br>
$IPTABLES -A INPUT -j allowed-connection <br>
<br>
<br>
<br>
####OUTPUT RULE#### <br>
#Packets going out from your box. <br>
<br>
#ALLOW OUTGOING FTP CONNECTIONS <br>
$IPTABLES -A OUTPUT -j allow-ftp-output <br>
<br>
#ALLOW OUTGOING SSH CONNECTIONS <br>
$IPTABLES -A OUTPUT -j allow-ssh-output <br>
<br>
#ALLOW OUTGOING HTTP.HTTPS CONNECTIONS <br>
$IPTABLES -A OUTPUT -j allow-www-output <br>
<br>
#ALLOW OUTGOING DNS REQUEST <br>
$IPTABLES -A OUTPUT -j allow-dns-output <br>
<br>
#Uncomment below to ALLOW Outgoing DHCPC requests(DHCPCD) <br>
#$IPTABLES -A OUTPUT -o $INT -p udp --dport 67:68 -j ACCEPT <br>
<br>
$IPTABLES -A OUTPUT -j invalid-packets <br>
$IPTABLES -A OUTPUT -j bad-flags <br>
$IPTABLES -A OUTPUT -j os-fingerprint <br>
$IPTABLES -A OUTPUT -j bad-ports <br>
$IPTABLES -A OUTPUT -o lo -j ACCEPT <br>
$IPTABLES -A OUTPUT -j allowed-connection <br>
<br>
<br>
####FORWARD RULE#### <br>
#packets coming from NAT Clients. <br>
<br>
#ALLOW OUTGOING FTP CONNECTIONS <br>
$IPTABLES -A FORWARD -j allow-ftp-output <br>
<br>
#ALLOW OUTGOING HTTP.HTTPS CONNECTIONS <br>
$IPTABLES -A FORWARD -j allow-www-output <br>
<br>
#ALLOW OUTGOING DNS REQUEST <br>
$IPTABLES -A FORWARD -j allow-dns-output <br>
<br>
$IPTABLES -A FORWARD -j bad-flags <br>
$IPTABLES -A FORWARD -j invalid-packets <br>
$IPTABLES -A FORWARD -j os-fingerprint <br>
$IPTABLES -A FORWARD -j bad-ports <br>
$IPTABLES -A FORWARD -o lo -j ACCEPT <br>
$IPTABLES -A FORWARD -j allowed-connection <br>
页:
[1]
