Fedora core 2服务器平台安全设置揭密2(1)

#!/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin

EXTIF=”eth0”

EXTIFIPADDR=”219.150.46.98”

INIF=”eth1”

INNET="192.168.1.0/24"

echo "1" >/proc/sys/net/ipv4/ip_forward

echo "1" > /proc/sys/net/ipv4/tcp_syncookies

/sbin/depmod –a

modprobe ip_tables
modprobe iptable_nat
modprobe ip_nat_ftp
modprobe ip_nat_irc
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc

iptables -F
iptables -X
iptables –Z
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING　ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT　ACCEPT

iptables –A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT

iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

iptables -A INPUT -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT

iptables –A OUTPUT-p icmp --icmp-type echo-request –j ACCEPT
iptables –A INPUT –p icmp --icmp-type echo-reply –j ACCEPT

iptables -t nat -A POSTROUTING –p all -s $INNET -o $EXTIF -j SNAT --to $EXTIFIPADDR

iptables –t nat –A PREROUTING –p tcp –i $EXTIF --dport 80 –j DNAT --to 192.168.1.10:80