iptables防火墙脚本

关注

原创最新推荐文章于 2026-10-14 09:55:46 发布 1.6k 阅读 AI 写同款· GEO 优化 ›

一键配置CentOS iptables防火墙的Shell脚本分享主要介绍了一键配置CentOS iptables防火墙Shell脚本分享,可保存到一个脚本文件中,在新安装的CentOS系统时一条命令搞定iptables配置,需要的朋友可以参考下立即下载

[root@hkweb root]# cat /etc/xxx
#!/bin/bash
echo "1" > /proc/sys/net/ipv4/ip_forward
INET_IFACE="eth0"
INET_IP="202.96.155.37"
LAN_IFACE="eth1"
LAN_IP="10.0.0.252"
LAN_IP_RANGE="10.0.0.0/8"
IPT="/sbin/iptables"
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_LOG
for TABLE in filter nat mangle ; do
$IPT -t $TABLE -F
$IPT -t $TABLE -X
done
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -o eth1 -j ACCEPT
#iptables -A INPUT -i eth0 -j ACCEPT
iptables -A OUTPUT -o eth0 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p udp -s 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p icmp -s 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -s 0/0 -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 203.86.67.18 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 202.96.155.38 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 211.96.97.20 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 211.96.97.22 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.33 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.34 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.35 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.36 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.37 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 210.75.18.38 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 61.144.222.111 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 1521 -j ACCEPT
#iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 8000 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 8080 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 8083 -j ACCEPT
#iptables -A INPUT -i eth0 -p tcp -s ! 210.75.18.33 --dport 8083 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 8888 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 8880 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 9999 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 10000 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 23 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s ! 202.66.8.210 --dport 5368 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 202.96.155.38 --dport 138 -j ACCEPT
iptables -A INPUT -i eth0 -p udp -s 202.96.155.38 --dport 138 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 202.96.155.38 --dport 139 -j ACCEPT
iptables -A INPUT -i eth0 -p udp -s 202.96.155.38 --dport 139 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 202.96.155.38 --dport 1984 -j ACCEPT
iptables -A INPUT -p icmp -i eth0 -s 0/0 -m limit --limit 1/s --limit-burst 10 -j ACCEPT
iptables -A INPUT -f -i eth0 -m limit --limit 100/s --limit-burst 100 -j ACCEPT
[root@hkweb root]#