#!/bin/bash
modprobe iptable_nat
modprobe ip_nat_ftp
modprobe ip_nat_irc
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc
modprobe ipt_limit
iptables -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
#iptables -Z
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -N syn-flood
iptables -A INPUT -i eth0 -p tcp –syn -j syn-flood
iptables -A syn-flood -m limit –limit 1/s –limit-burst 4 -j RETURN
iptables -A syn-flood -j DROP
#禁止ssh端口
iptables -A INPUT -s 203.212.0.0/16 -p tcp –dport 22 -j ACCEPT
iptables -A INPUT -p tcp –dport 22 -j DROP
#禁止icmp端口
#iptables -A INPUT -i eth0 -s 203.212.0.178/32 -p icmp -m icmp –icmp-type 8 -j ACCEPT
iptables -A INPUT -i eth0 -p icmp -m icmp –icmp-type 8 -j DROP
#打开端口80 53 111 25 5666 22
iptables -A INPUT -i eth0 -p tcp -d 0/0 –dport 80
iptables -A INPUT -p tcp -m multiport –dport 111,25,53,5666,139 -j ACCEPT
# 保存
iptables-save > /etc/sysconfig/iptables
