iptables --- auto script

来源：互联网发布：python检测sql注入编辑：程序博客网时间：2024/06/08 02:04
#!/bin/bash## configuration iptables# ///////////////////////////////////////////////////////////# Author:   nixawk# Webpage:  http://blog.csdn.net/nixawk# Date:     Dec  9 05:59:16 EST 2014# ///////////////////////////////////////////////////////////# ============================================================# Initialize all settings (iptables, srcip, dstip, and so on)# ============================================================# Check current user permision.if [[ "$UID" -ne 0 ]];then    echo "[-] Must be root to execute it."fi# Get iptables pathIPTSBIN="$(which iptables)"INTERFACE="eth0"if [[ -e "$IPTSBIN" ]];then    echo "$IPTSBIN"else        echo "[-] could not find iptables"    exit 1fi# Get source ip (TCP data out, from localhost)SRCIP=`ip addr show $INTERFACE | grep "inet " |awk -F " " '{print $2}' | awk -F "/" '{print $1}'`# Get destination ip (TCP data out, from localhost)DSTIP="0.0.0.0/0"## ============================================================# set default filter policy to [DROP]# ============================================================function filter_default_policy {    echo "[+] iptable filter: from [ACCEPT] to [DROP]"    $IPTSBIN -t filter -P INPUT DROP    $IPTSBIN -t filter -P OUTPUT DROP    $IPTSBIN -t filter -P FORWARD DROP}# # ============================================================# TCP Filter (data otside or inside)# ============================================================function filter_tcp_out {    local proto="TCP"    echo "[+] ----> filter $proto outside"    while [ -n "$1" ];    do        rule="$IPTSBIN -t filter -A OUTPUT --proto ${proto} --source ${SRCIP} --destination ${DSTIP} --destination-port ${1} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT"        echo "$rule"        `$rule`   # execute command        shift            done            }function filter_tcp_in {    local proto="tcp"        echo "[+] ----> filter $proto inside"    while [ -n "$1" ];    do        rule="$IPTSBIN -t filter -A INPUT --proto ${proto} --source ${DSTIP} --destination ${SRCIP} --source-port ${1} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT"        echo $rule        `$rule`        shift            done            }## ===========================================================# UDP Filter (UDP data outside or inside)# ===========================================================function filter_udp_out {    local proto="udp"    echo "[+] ----> filter $proto outside "     while [ -n "$1" ];    do        rule="$IPTSBIN -t filter -A OUTPUT --proto ${proto} --source ${SRCIP} --destination ${DSTIP} --destination-port ${1} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT"        echo $rule | bash -x        shift    done    }function filter_udp_in {    local proto="udp"    echo "[+] ----> filter $proto inside "    while [ -n "$1" ];    do        rule="$IPTSBIN -t filter -A INPUT --proto ${proto} --source ${DSTIP} --destination ${SRCIP} --source-port ${1} -m state --state ESTABLISHED,RELATED -j ACCEPT"        echo $rule | bash -x        shift    done    }## ===========================================================# ICMP Filter # ===========================================================function filter_icmp_out {    local proto="icmp"    echo "[+] ----> filter $proto outside"    # DROP ICMP REPLY FROM LOCALHOST    rule="$IPTSBIN -t filter -A OUTPUT --proto ${proto} --source ${SRCIP} --destination ${DSTIP} --icmp-type echo-request -j ACCEPT"    echo $rule | bash -x} function filter_icmp_in {    local proto="icmp"        echo "[+] ----> filter $proto inside"    # ALLOW ICMP REQUEST     rule="$IPTSBIN -t filter -A INPUT --proto ${proto} --source ${DSTIP} --destination ${SRCIP} --icmp-type echo-reply -j ACCEPT"    echo $rule | bash -x }## ============================================================# Flush IPTABLES Rules# ============================================================function flush_rules {    $IPTSBIN -t filter -P INPUT ACCEPT    $IPTSBIN -t filter -P OUTPUT ACCEPT    $IPTSBIN -t filter -P FORWARDD ACCEPT    rule="$IPTSBIN -t filter -F"    echo "$rule" | bash -x}## ============================================================# List IPTABLES Rules# ============================================================function list_rules {    rule="$IPTSBIN -L -n -v"    echo "$rule" | bash -x}## =============================# Main # +============================flush_rules                           # flush iptables rules, default rules action is ACCEPT.filter_default_policy                 # Translate [ACCEPT] to [DROP]                                      # ------------------------filter_tcp_out 25 80 110 443 8080     # filter TCP DATA OUTSIDE, PORT 80/...filter_tcp_in 25 80 110 443 8080      # filter TCP DATA INSIDE,                                       # ------------------------                                         # ------------------------filter_udp_out 53                     # filter UDP outsidefilter_udp_in 53                      #                                      # ------------------------                                      # ------------------------filter_icmp_out                       # filter icmp outsidefilter_icmp_in                        # filter icmp inside                                      # ------------------------list_rules                            # list current rules
0 0