[原创]iptables之初始化-凯发app官方网站

 自己总结的一套iptables初化脚本，自认为是比较好一些，可以根本实际情况更改

*filter

:logdrop_illegal_packet - [0:0]

-a  input -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,psh,urg -j logdrop_illegal_packet 

-a  input -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,syn,rst,psh,ack,urg -j logdrop_illegal_packet 

-a  input -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg none -j logdrop_illegal_packet 

-a  input -p tcp -m tcp --tcp-flags syn,rst syn,rst -j logdrop_illegal_packet 

-a  input -p tcp -m tcp --tcp-flags fin,syn fin,syn -j logdrop_illegal_packet 

-a  input -p tcp -m tcp --tcp-flags fin,ack fin -j logdrop_illegal_packet 

-a  input -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,syn,rst,ack,urg -j logdrop_illegal_packet 

-a  logdrop_illegal_packet -m limit --limit 2/sec -j log --log-prefix "iptfw-bad-flag " --log-level 7

#-a input -s 192.168.0.0/255.255.0.0 -i eth0 -j logdrop_illegal_packet

-a input -s 172.16.0.0/255.240.0.0 -i eth0 -j logdrop_illegal_packet

-a input -s 169.254.0.0/255.255.0.0 -j logdrop_illegal_packet 

-a  logdrop_illegal_packet -j drop 

:forward accept [0:0]

:input drop [0:0]

-a input -m state --state related,established -j accept 

-a input -s 192.168.11.0/24 -j accept

-a input -p vrrp -j accept

-a input -s 210.14.144.220 -j accept

-a input -s 192.168.0.0/255.255.0.0 -j drop

-a input -s 239.2.11.71  -j drop

-a input -p udp -m state --state new -m udp --dport 53 -j accept

-a input -i lo -j accept 

-a input -p icmp -m icmp --icmp-type 8 -m limit --limit 5/sec -j accept 

-a input -p icmp -m icmp --icmp-type 0 -m limit --limit 5/sec -j accept 

-a input -p icmp -m icmp --icmp-type 11 -m limit --limit 5/sec -j accept 

-a input -p icmp -m icmp --icmp-type 3 -m limit --limit 5/sec -j accept 

-a input -p icmp -j drop 

#-a input -i eth0 -p tcp -m state --state new -m tcp --dport 8900 -j accept

-a input -i eth0 -j reject --reject-with icmp-host-prohibited 

:output drop [0:0]

-a output -d 192.168.11.0/24 -j accept

-a output -p vrrp -j accept 

-a output -d 210.14.144.220 -j accept

-a output -d 239.2.11.71  -j drop

-a output -m state --state related,established -j accept 

-a output -o lo -j accept  

-a output -p udp -m state --state new -m udp --dport 53 -j accept

-a output -p icmp -m icmp --icmp-type 8 -m limit --limit 5/sec -j accept 

-a output -p icmp -m icmp --icmp-type 0 -m limit --limit 5/sec -j accept 

-a output -p icmp -m icmp --icmp-type 11 -m limit --limit 5/sec -j accept 

-a output -p icmp -m icmp --icmp-type 3 -m limit --limit 5/sec -j accept 

-a output -p icmp -j drop

commit

本文出自 “” 博客，请务必保留此出处