谁分享一下你的iptables规则

gdtv

好像很少人讨论iptables啊，难道大家都开防火墙，都裸奔？

cpuer

原帖由 gdtv 于 2009-7-19 11:42 发表
好像很少人讨论iptables啊，难道大家都开防火墙，都裸奔？

这个问题不简单，需要高手来指导，freebsd对这个熟悉不？

gdtv

老大，我现在就问你的，你的linode VPS不开防火墙？

cpuer

原帖由 gdtv 于 2009-7-19 11:59 发表
老大，我现在就问你的，你的linode VPS不开防火墙？

开了，但是只做了非常基础的设置

gdtv

期待其他人分享

cpuer

原帖由 gdtv 于 2009-7-19 12:25 发表
期待其他人分享

可以参考下这里：http://www.linuxhomenetworking.c ... alls_Using_iptables

Turing

centos默认是关闭大部分端口的

gdtv

太复杂了，看不懂

gdtv

分享我找到的一个
下面的规则是禁止ping的，请问怎样修改成允许ping？

1. *filter
   
2. :INPUT DROP [0:0]
   
3. :FORWARD DROP [0:0]
   
4. :OUTPUT ACCEPT [0:0]
   
5. 
   
6. -N LnD
   
7. 
   
8. -A LnD -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP drop] " --log-level=info
   
9. -A LnD -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP drop] " --log-level=info
   
10. -A LnD -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP drop] " --log-level=info
    
11. -A LnD -f -m limit --limit 1/s -j LOG --log-prefix "[FRAG drop] " --log-level=info
    
12. -A LnD -j DROP
    
13. 
    
14. #
    
15. # This custom chain logs, then REJECTs packets.
    
16. #
    
17. -N LnR
    
18. 
    
19. -A LnR -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP reject] " --log-level=info
    
20. -A LnR -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP reject] " --log-level=info
    
21. -A LnR -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP reject] " --log-level=info
    
22. -A LnR -f -m limit --limit 1/s -j LOG --log-prefix "[FRAG reject] " --log-level=info
    
23. -A LnR -j REJECT
    
24. 
    
25. #
    
26. # This chain logs, then DROPs "Xmas" and Null packets which might
    
27. # indicate a port-scan attempt
    
28. #
    
29. -N ScanD
    
30. 
    
31. -A ScanD -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP Scan?] "
    
32. -A ScanD -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP Scan?] "
    
33. -A ScanD -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP Scan?] "
    
34. -A ScanD -f -m limit --limit 1/s -j LOG --log-prefix "[FRAG Scan?] "
    
35. -A ScanD -j DROP
    
36. 
    
37. #
    
38. # This chain limits the number of new incoming connections to
    
39. #  prevent DDoS attacks
    
40. #
    
41. -N DDoS
    
42. 
    
43. -A DDoS -m limit --limit 1/s --limit-burst 10 -j RETURN
    
44. -A DDoS -j LOG --log-prefix "[DOS Attack/SYN Scan?] "
    
45. -A DDoS -j DROP
    
46. 
    
47. -A INPUT -i lo -j ACCEPT
    
48. -A OUTPUT -o lo -j ACCEPT
    
49. 
    
50. -A OUTPUT -m state --state NEW,ESTABLISHED -j ACCEPT
    
51. 
    
52. #
    
53. # Disallow packets frequently used by port-scanners
    
54. #
    
55. 
    
56. -A INPUT -p tcp --tcp-flags ALL NONE -j ScanD
    
57. 
    
58. 
    
59. -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j ScanD
    
60. 
    
61. 
    
62. -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j ScanD
    
63. 
    
64. -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j ScanD
    
65. 
    
66. 
    
67. -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j ScanD
    
68. 
    
69. -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j ScanD
    
70. 
    
71. -A INPUT -p tcp --tcp-flags ACK,URG URG -j ScanD
    
72. 
    
73. -A INPUT -p tcp --tcp-flags SYN,RST,ACK SYN -j DDoS
    
74. 
    
75. -A INPUT -p ICMP --icmp-type 4 -s 0.0.0.0/0 -j ACCEPT
    
76. 
    
77. -A INPUT -p ICMP --icmp-type 12 -s 0.0.0.0/0 -j ACCEPT
    
78. 
    
79. -A INPUT -p ICMP --icmp-type 3 -s 0.0.0.0/0 -j ACCEPT
    
80. 
    
81. -A INPUT -p ICMP --icmp-type 11 -s 0.0.0.0/0 -j ACCEPT
    
82. 
    
83. #
    
84. # (0 | 8) Allow OUTPUT pings to anywhere.
    
85. #
    
86. 
    
87. -A INPUT -p ICMP --icmp-type 0 -s 0.0.0.0/0 -j ACCEPT
    
88. 
    
89. #
    
90. # AUTH (113) - Allowing your outgoing AUTH requests as a client
    
91. #
    
92. 
    
93. -A OUTPUT -p tcp --sport 1024: --dport 113 -d 0.0.0.0/0 -j ACCEPT
    
94. 
    
95. -A INPUT -p tcp -m state --state ESTABLISHED,RELATED --sport 113 --dport 1024: -s 0.0.0.0/0 -j ACCEPT
    
96. 
    
97. #
    
98. # http client
    
99. #
    
100. -A INPUT -p tcp -m multiport --sports http,https,webcache -m tcp --dport 1024: -m state --state ESTABLISHED -j ACCEPT
     
101. 
     
102. #
     
103. # http server
     
104. #
     
105. -A INPUT -p tcp -m tcp --sport 1024: -m multiport --dports http,https,webcache -m state --state NEW,ESTABLISHED -j ACCEPT
     
106. -A INPUT -p tcp -m tcp --sport 1024: -m multiport --dports ftp,ftp-data -m state --state NEW,ESTABLISHED -j ACCEPT
     
107. -A INPUT -p tcp -m tcp --sport 1024: --dport 1024: -m state --state NEW,ESTABLISHED -j ACCEPT
     
108. 
     
109. -A INPUT -p udp --sport 53 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
     
110. 
     
111. -A INPUT -p tcp -m state --state ESTABLISHED,RELATED --sport 53 --dport 1024: -j ACCEPT
     
112. 
     
113. -A INPUT -s 0.0.0.0/0 -p udp -m udp --sport 123 -j ACCEPT
     
114. 
     
115. -A INPUT -p tcp -m multiport --sports smtp,22 -m state --state ESTABLISHED -j ACCEPT
     
116. 
     
117. -A INPUT -p tcp -m tcp --dport 22 -m state --state INVALID,NEW -j LOG --log-prefix "iptables(ssh connection): "
     
118. -A INPUT -s 0.0.0.0/0 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
     
119. 
     
120. -A INPUT -s 0.0.0.0/0 -p tcp -m tcp --dport 9878 -m state --state NEW,ESTABLISHED -j ACCEPT
     
121. 
     
122. 
     
123. COMMIT
     
124. 
     
125. *nat
     
126. :PREROUTING ACCEPT [0:0]
     
127. :OUTPUT ACCEPT [0:0]
     
128. :POSTROUTING ACCEPT [0:0]
     
129. COMMIT
     
130. 
     
131. 
     
132. *mangle
     
133. :PREROUTING ACCEPT [0:0]
     
134. :OUTPUT ACCEPT [0:0]
     
135. :INPUT ACCEPT [0:0]
     
136. :FORWARD ACCEPT [0:0]
     
137. :POSTROUTING ACCEPT [0:0]
     
138. COMMIT

复制代码

来自 http://blog.19lou.com/10606184/viewspace-1155044

cpuer

原帖由 gdtv 于 2009-7-19 12:41 发表
太复杂了，看不懂

慢慢看，慢慢理解，很多东西我也看不懂。