双线脚本 

 
#!/bin/sh
/sbin/modprobe ip_tables
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp

/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -X
/sbin/iptables -Z

/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -P OUTPUT ACCEPT

#route del -net 169.254.0.0 netmask 255.255.0.0 dev eth2

echo "1" > /proc/sys/net/ipv4/ip_forward
echo "262144" > /proc/sys/net/ipv4/ip_conntrack_max 

/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE  
/sbin/iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
/sbin/iptables -A FORWARD -s 0/0 -j ACCEPT
/sbin/iptables -A FORWARD -d 0/0 -j ACCEPT

iptables -t nat -A PREROUTING -P UDP -d 192.168.0.1 --dport 53 -j DNAT --to 219.150.32.132:53
iptables -t nat -A PREROUTING -P UDP -d 192.168.0.1 --dport 53 -j DNAT --to 202.99.192.68 :53

#drop bug
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 445 -j DROP
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 139 -j DROP
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 135 -j DROP
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 139 -j DROP
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 137 -j DROP
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 136 -j DROP
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 138 -j DROP

#igmp
#iptables -A INPUT -p ICMP -d 219.149.182.21 -m limit --limit 1/s --limit-burst 10 -j ACCEPT
#iptables -A INPUT -p ICMP -d 218.26.221.73 -m limit --limit 1/s --limit-burst 10 -j ACCEPT
#iptables -A INPUT -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT

#syn freewall
iptables -N synfoold
iptables -A synfoold -p tcp --syn -m limit --limit 1/s -j RETURN
iptables -A synfoold -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp -m state --state NEW -j synfoold

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -N syn-flood
iptables -A INPUT -p tcp --syn -j syn-flood
iptables -I syn-flood -p tcp -m limit --limit 3/s --limit-burst 6 -j RETURN
iptables -A syn-flood -j REJECT
sysctl -w net.ipv4.icmp_echo_ignore_all=1
echo "1" > /proc/sys/net/ipv4/tcp_syncookies