适合Web服务器的iptables规则

1. #! /bin/sh
2. # /etc/iptables.bak
3.  
4. # Let's save typing & confusion with variables
5. IPTABLES=/sbin/iptables
6.  
7. # Flush active rules and custom tables
8. $IPTABLES --flush
9. $IPTABLES --delete-chain
10.  
11. # set the defaults so that by-default incoming packets are dropped, unless explicitly allowed;
12. # for a desktop workstation, we'll let lots of (unpredictable) outgoing packets go freely.
13. $IPTABLES -P INPUT DROP
14. $IPTABLES -P FORWARD DROP
15. $IPTABLES -P OUTPUT ACCEPT
16.  
17. # INBOUND POLICY
18. # ==============
19. # of course, accepting loopback is a good idea
20. $IPTABLES -A INPUT -i lo -j ACCEPT
21.  
22. # we will permit ping, but rate-limit type 8 to prevent DoS-attack
23. $IPTABLES -A INPUT -p icmp --icmp-type 0 -j ACCEPT
24. $IPTABLES -A INPUT -p icmp --icmp-type 3 -j ACCEPT
25. $IPTABLES -A INPUT -p icmp --icmp-type 11 -j ACCEPT
26. $IPTABLES -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
27.  
28. #   (Applies to packets entering our network interface from the network,
29. #   and addressed to this host.)
30.  
31. $IPTABLES -A INPUT -m state --state INVALID -j DROP
32. $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
33.  
34. # ftp incoming
35. $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 20 -j ACCEPT
36. $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 21 -j ACCEPT
37.  
38. # ssh incoming, including non-standard port (if needed)
39. $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
40. #$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 222 -j ACCEPT
41.  
42. # web serving, let's allow it!
43. $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 80 -j ACCEPT
44.  
45. # secure web serving, let's allow it!
46. $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT
47.  
48. # amanda tape-backups; we reach out and tape things from this machine
49. $IPTABLES -A INPUT -p udp -m state --state NEW -m udp --dport 10080 -j ACCEPT
50. $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 10082 -j ACCEPT
51. $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 10083 -j ACCEPT
52.  
53. # nagios (5666); monitor time (123), allow snmp (161)
54. $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 5666 -j ACCEPT
55. $IPTABLES -A INPUT -p udp -m udp --dport 123 -j ACCEPT
56. $IPTABLES -A INPUT -p udp -m udp --dport 161 -j ACCEPT
57.  
58.  
59. # OUTBOUND POLICY
60. # ===============
61. # of course, accepting loopback is a good idea
62. $IPTABLES -A OUTPUT -o lo -j ACCEPT
63.  
64. #   (Applies to packets sent to the network interface from local processes)
65.  
66. $IPTABLES -A OUTPUT -j ACCEPT

根据自己的服务器的具体环境作适当修改，然后把上面的代码保存到/etc/iptables.bak。
运行脚本：

1. sh /etc/iptables.bak

查看规则：

1. iptables -L

保存规则：

1. service iptables save