阿里云iptables 配置

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

#!/bin/bash # A simple iptables firewall configuration PATH=/sbin:/bin:/usr/sbin:/usr/bin; export PATH #flush/erase original rules iptables -F #清除所有已制定的rule iptables -X #清除用户自定义的chain/table iptables -Z #将所有的chain的计数和流量统计归零 #Accept localhost connetting, no matter what it is iptables -A INPUT -i lo -j ACCEPT #Accept any response package which is initiated from inside iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #block most common network attacks(recon packets and syn-flood attack) iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP #open ports for different services #必须开启22端口,以便于通过ssh连接服务器 iptables -A INPUT -p tcp --dport 22 -j ACCEPT #SSH #WEB服务通常还需开启 80 和 443 iptables -A INPUT -p tcp --dport 80 -j ACCEPT #HTTP iptables -A INPUT -p tcp --dport 443 -j ACCEPT #HTTPS #如下端口根据对外开放服务自行决定，如果需开启，请删除开头的#号 #iptables -A INPUT -p tcp --dport 3306 -j ACCEPT #MYSQL #iptables -A INPUT -p tcp --dport 25 -j ACCEPT #SMTP #iptables -A INPUT -p tcp --dport 465 -j ACCEPT #Secure SMTP #iptables -A INPUT -p tcp --dport 110 -j ACCEPT #POP3 #iptables -A INPUT -p tcp --dport 995 -j ACCEPT #Secure POP #常用的安全防护策略，如不需要，去哪个在 #ICMP configuration #To prevent ICMP DDOS,we do not allow ICMP type 8(echo-request) or limit this request with 1/second #some ICMP requests are allowed. icmp_type="0 3 4 8 11 12 14 16 18" for ticmp in $icmp_type do   iptables -A INPUT -p icmp --icmp-type $ticmp -j ACCEPT done #必须的默认策略：default policies iptables -P OUTPUT ACCEPT iptables -P INPUT DROP #保存以上配置为系统默认配置save to /etc/sysconfig/iptables /etc/init.d/iptables save #重启防护墙 /etc/init.d/iptables restart