iptables 例子

iptables_example.sh

#!/bin/bash

accept_net="124.205.206.0/24 124.254.7.0/24 119.161.240.0/24 211.152.0.0/16 10.0.11.17/32 10.0.11.11/32 59.151.16.0/24 10.9.1.0/24"

/sbin/iptables -F
/sbin/iptables -Z
/sbin/iptables -X

/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP

for i in ${accept_net}
do
    /sbin/iptables -A INPUT -s $i -j ACCEPT
    /sbin/iptables -A OUTPUT -d $i -j ACCEPT
done

# lo
/sbin/iptables -A INPUT  -i lo  -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT

# icmp (0 : echo-reply | 8 : echo-request)
/sbin/iptables -A INPUT  -p icmp --icmp-type 0 -j ACCEPT
/sbin/iptables -A OUTPUT -p icmp --icmp-type 0 -j ACCEPT
/sbin/iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
/sbin/iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT

# dns
/sbin/iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT

# ntp
/sbin/iptables -A OUTPUT -p udp --dport 123 -j ACCEPT

# sendmail
/sbin/iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 587 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT

# snmp
/sbin/iptables -A INPUT -p udp --dport 161 -j ACCEPT

/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

/sbin/iptables-save > /etc/sysconfig/iptables