| |
1 #! /bin/sh
2
3 trusthost='192.168.10.100'
4 myhost='192.168.20.200'
5 any='0.0.0.0/0'
6
7 ##############
8 #Flush & Reset
9 ##############
10 iptables -F
11 iptables -X
12 ##############
13 #Deafult Rule
14 ##############
15 iptables -P INPUT DROP
16 iptables -P FORWARD DROP
17 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
18
19 #########
20 #loopback
21 #########
22 iptables -A INPUT -i lo -j ACCEPT
23 iptables -A OUTPUT -o lo -j ACCEPT
24 #######################
25 #ICMP trusthost->myhost
26 #######################
27 iptables -A INPUT -p icmp --icmp-type echo-request -s $trusthost -d $myhost -j ACCEPT
28 iptables -A OUTPUT -p icmp --icmp-type echo-reply -s $myhost -d $trusthost -j ACCEPT
29 #######################
30 #ICMP myhost->trusthost
31 #######################\
32 iptables -A OUTPUT -p icmp --icmp-type echo-request -s $myhost -d $trusthost -j ACCEPT
33 iptables -A INPUT -p icmp --icmp-type echo-reply -s $trusthost -d $myhost -j ACCEPT
34 #######################
35 #ssh trusthost-> myhost
36 #######################
37 iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
38 iptables -A INPUT -p tcp -m state --state NEW,ESTABLISHED,RELATED -s $trusthost -d $myhost --dport 22 -j ACCEPT
39 iptables -A OUTPUT -p tcp -s $myhost --sport 22 -d $trusthost -j ACCEPT
40 #################
41 #www ANY-> myhost
42 #################
43 iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
44 iptables -A INPUT -p tcp -m state --state NEW,ESTABLISHED,RELATED -s $any -d $myhost --dport 80 -j ACCEPT
45 iptables -A OUTPUT -p tcp -s $myhost --sport 80 -d $any -j ACCEPT
46
47 #################
48 #mangle table
49 #################
50 #Sample for TOS
51 iptables -A PREROUTING -t mangle -p tcp --sport 22 -j TOS --set-tos Minimize-Delay
52 iptables -A PREROUTING -t mangle -p tcp --sport 80 -j TOS --set-tos Maximize-Throughput
53 #Sample for DSCP,ECN,MARK
54 #iptables -A PREROUTING -t mangle -p tcp --sport 80 -j DSCP --set-dscp-class EF
55 #iptables -A PREROUTING -t mangle -p tcp --sport 80 -j ECN --ecn-tcp-remove
56 #iptables -A PREROUTING -t mangle -p tcp --sport 80 -j MARK --set-mark 15
57
58 #########
59 #logging
60 #########
61 iptables -N LOGGING
62 iptables -A LOGGING -j LOG --log-level warning --log-prefix "DROP:" -m limit
63 iptables -A LOGGING -j DROP
64 iptables -A INPUT -j LOGGING |
|