五个顶级Linux安全工具(5)

#!/bin/bash
# example iptables script
# flush the old rules
iptables -F
# set the default policy of the chain to accept
iptables -P INPUT ACCEPT
# create a new table for logging and discarding
# unwanted packets
iptables -N LOGDROP
# use rate limiting on the logging, and
# add a prefix of 'filter: '
iptables -A LOGDROP -m limit -j LOG
 ↪--log-prefix "filter: "
# drop unwanted TCP connections with a
# TCP ReSeT packet
iptables -A LOGDROP -p tcp -j REJECT
 ↪--reject-with tcp-reset
# drop other packets by sending an ICMP
# port unreachable in response
iptables -A LOGDROP -j REJECT
 ↪--reject-with icmp-port-unreachable
# now drop the packet
iptables -A LOGDROP -j DROP
#allow anything on the local interface
iptables -A INPUT -i lo -j RETURN
# allow packets that are related to
# an on-going conversation
iptables -A INPUT -p tcp -m conntrack
 ↪--ctstate RELATED,ESTABLISHED -j
RETURN
iptables -A INPUT -p udp -m conntrack
 ↪--ctstate RELATED,ESTABLISHED -j
RETURN
# allow SSH traffic
iptables -A INPUT -p tcp -m tcp
 ↪--dport 22 -j RETURN
# allow HTTP and HTTPS traffic
iptables -A INPUT -p tcp -m tcp
 ↪--dport 443 -j RETURN
iptables -A INPUT -p tcp -m tcp
 ↪--dport 80 -j RETURN
# accept the following ICMP types -
# echo, echo reply, source quench,
ttl exceeded,
# destination unreachable - and drop the rest
iptables -A INPUT -p icmp -m icmp
 ↪--icmp-type 0 -j RETURN
iptables -A INPUT -p icmp -m icmp
 ↪--icmp-type 3 -j RETURN
iptables -A INPUT -p icmp -m icmp
 ↪--icmp-type 4 -j RETURN
iptables -A INPUT -p icmp -m icmp
 ↪--icmp-type 8 -j RETURN
iptables -A INPUT -p icmp -m icmp
 ↪--icmp-type 11 -j RETURN
# if we haven't accepted it, drop and log it.
iptables -A INPUT -j LOGDROP

Nov 22 06:24:00 localhost kernel: filter: IN=eth0
OUT=MAC=00:0a:e6:4e:6d:49:00:14:6c:67:cc:9a:08:00
SRC=192.168.50.40 DST=192.168.0.8 LEN=402
TOS=0x00 PREC=0x00 TTL=47 ID=3345 PROTO=UDP
SPT=30766 DPT=1026 LEN=382