iptables小脚本

 

  #!/bin/bash
IPNET=172.16.0.0/16
IP=172.16.21.1
PORTS="22,80,443,3000,199,3306,873,25,110"
LIM="-m limit --limit 25/minute --limit-burst 100 -j ACCEPT"
ICMP="-p icmp --icmp-type"
TCP="-p tcp -m multiport"
INPUT="iptables -A INPUT"
OUTPUT="iptables -A OUTPUT"
DEFAULT="iptables -P"
AC="-m state --state NEW,ESTABLISHED -j ACCEPT"
BC="-m state --state ESTABLISHED -j ACCEPT"


$DEFAULT INPUT DROP
$DEFAULT OUTPUT DROP
$DEFAULT FORWARD DROP

$INPUT -s $IPNET $TCP --dports $PORTS $AC
$OUTPUT -d $IPNET $TCP --sports $PORTS $BC

$OUTPUT $ICMP echo-request $LIM
$INPUT $ICMP echo-reply $LIM
$OUTPUT $ICMP echo-reply $LIM
$INPUT $ICMP echo-request $LIM