一个简单的firewall的配置

最新推荐文章于 2025-07-13 09:15:15 发布

原创最新推荐文章于 2025-07-13 09:15:15 发布 · 1k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#input #interface #numbers #internet #network #filter

本文介绍了一个简单的防火墙配置脚本，该脚本可以根据不同设备类型（如笔记本电脑、工作站、路由器或服务器）进行定制。脚本包括设置网络接口、启用特定服务、配置地址转换（NAT）等功能。

一个简单的firewall的配置

例 11.8. 一个简单的firewall的配置

   
        
#!/bin/bash

#Our complete stateful firewall script.  This firewall can be customized for
#a laptop, workstation, router or even a server. :)

#change this to the name of the interface that provides your "uplink"
#(connection to the Internet)

UPLINK="eth1"

#if you're a router (and thus should forward IP packets between interfaces),
#you want ROUTER="yes"; otherwise, ROUTER="no"

ROUTER="yes"

#change this next line to the static IP of your uplink interface for static SNAT, or
#"dynamic" if you have a dynamic IP.  If you don't need any NAT, set NAT to "" to
#disable it.

NAT="1.2.3.4"

#change this next line so it lists all your network interfaces, including lo

INTERFACES="lo eth0 eth1"

#change this line so that it lists the assigned numbers or symbolic names (from
#/etc/services) of all the services that you'd like to provide to the general
#public.  If you don't want any services enabled, set it to ""

SERVICES="http ftp smtp ssh rsync"

if [ "$1" = "start" ]
then
	echo "Starting firewall..."
	iptables -P INPUT DROP
	iptables -A INPUT -i ! ${UPLINK} -j ACCEPT
	#下面一话的意思是如果连接(conntrack)状态是ESTABLISHED,RELATED,就接受
	iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

	#enable public access to certain services
	for x in ${SERVICES}
	do
		#如果是状态NEW的话,并且是$x端口,就accept
		iptables -A INPUT -p tcp --dport ${x} -m state --state NEW -j ACCEPT
	done

	#为了模拟没有服务
	iptables -A INPUT -p tcp -i ${UPLINK} -j REJECT --reject-with tcp-reset
	iptables -A INPUT -p udp -i ${UPLINK} -j REJECT --reject-with icmp-port-unreachable
	
	#explicitly disable ECN
	if [ -e /proc/sys/net/ipv4/tcp_ecn ]
	then
		echo 0 > /proc/sys/net/ipv4/tcp_ecn
	fi

	#disable spoofing on all interfaces
	for x in ${INTERFACES}
	do	
		echo 1 > /proc/sys/net/ipv4/conf/${x}/rp_filter
	done

	if [ "$ROUTER" = "yes" ]
	then
		#we're a router of some kind, enable IP forwarding
		echo 1 > /proc/sys/net/ipv4/ip_forward
		if [ "$NAT" = "dynamic" ]
		then
			#dynamic IP address, use masquerading	
			echo "Enabling masquerading (dynamic ip)..."
			iptables -t nat -A POSTROUTING -o ${UPLINK} -j MASQUERADE
		elif [ "$NAT" != "" ]
		then
			#static IP, use SNAT
			echo "Enabling SNAT (static ip)..."
			iptables -t nat -A POSTROUTING -o ${UPLINK} -j SNAT --to ${UPIP}
		fi
	fi
	
elif [ "$1" = "stop" ]
then
	echo "Stopping firewall..."
	iptables -F INPUT
	iptables -P INPUT ACCEPT
	#turn off NAT/masquerading, if any
	iptables -t nat -F POSTROUTING
fi