设置Linux防火墙

设置 Linux 服务器防火墙脚本，Web_iptables.sh

1. 通过内网可访问服务器所有开放端口
2. 给跳板机开放sshd端口连接服务器
3. 信任ip 所有端口均开放
4. 开放部分端口供外部访问

#!/bin/bash

#Intranet_network=`ifconfig eth1 |grep "inet addr"|awk -F: '{print $2}'|awk '{print $1}'|awk -F "." '{print $1}'`
#取得本机内网IP
function getLocalInnerIP()
{
        ifconfig | grep 'inet addr:' | awk -F"inet addr:" '{print $2}'  | awk '{print $1}' | while read theIP; do
            A=$(echo $theIP | cut -d '.' -f1)
            B=$(echo $theIP | cut -d '.' -f2)
            C=$(echo $theIP | cut -d '.' -f3)
            D=$(echo $theIP | cut -d '.' -f4)
            int_ip=$(($A<<|$B<<|$C<<|$D))
            #10.0.0.0()~10.255.255.255()
            if [ "${int_ip}" -ge  -a "${int_ip}" -le  ]; then
                echo $theIP
            elif [ "${int_ip}" -ge  -a "${int_ip}" -le  ]; then     #172.16.0.0()~172.31.255.255()
                echo $theIP
            elif [ "${int_ip}" -ge  -a "${int_ip}" -le  ]; then   #192.168.0.0()~192.168.255.255()
                echo $theIP
            fi
        done
}
innerIP=`getLocalInnerIP`
Intranet_network=`echo $innerIP|awk -F "." '{print $1}'`

IPT=/sbin/iptables

#tiaobanji
#TIAOBANJI="218.17.152.189 113.107.167.90 58.253.68.90"
TIAOBANJI=""

#trust ip
ETL1=219.129.216.224
LAN_IP=$Intranet_network.0.0./255.0.0.0

#guangzhou idc ip
yw1=43.230.88.130

#NAGIOS_IP=121.10.141.196
TRUST_IP="$LAN_IP $ETL1 $yw1 121.10.141.196"

# Delete Any Existing Chains In Filter Table
$IPT -F -t filter
$IPT -X -t filter
$IPT -Z -t filter

### Allow TRUST IP (LAN_IP ETL1 ETL2 GM1 GM2 ACCPET)
for TURST in $TRUST_IP
do
        $IPT -A INPUT -s $TURST -j ACCEPT
done

#tiaobanji
for TBJ in $TIAOBANJI
do
        $IPT -A INPUT -s $TBJ -p tcp --dport  -j ACCEPT
done

# localhost
$IPT -A INPUT -p icmp -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

### The ALL network for open ports
$IPT  -A INPUT  -p tcp -m multiport --dports ,, -j ACCEPT
$IPT  -A INPUT  -p tcp -m multiport --dports ,,,, -j ACCEPT
$IPT  -A INPUT  -p tcp -m multiport --dports ,,,, -j ACCEPT

### The zabbix server
$IPT -A INPUT -s 113.107.166.246 -p tcp --dport  -j ACCEPT

# Setting Default Policies, just accept output, drop any other
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP

### save iptables
/etc/init.d/iptables save

exit

Web_iptables.sh

#!/bin/bash
IPT=/sbin/iptables

$IPT -F
$IPT -P INPUT ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p icmp -j ACCEPT
$IPT -A INPUT -s 120.25.153.31 -j ACCEPT
$IPT -A INPUT -p tcp --dport  -j ACCEPT
$IPT -A INPUT -p tcp --dport : -j ACCEPT
$IPT -A INPUT -s 120.25.153.31 -p tcp --dport  -j ACCEPT
$IPT -A INPUT -s 183.14.0.0/ -p tcp --dport  -j ACCEPT
$IPT -A INPUT -s 183.14.1.0/ -p tcp --dport  -j ACCEPT
$IPT -A INPUT -s 120.25.153.32 -j DROP
$IPT -A INPUT -j DROP

iptables.sh