I write a shell for iptables configuration but failed.
It"s really strange here.
My shell
-sharp!/bin/bash
-sharp
-sharp The interface that connect Internet
EXTIF="ppp0"
-sharp the inside interface. if you don"t have this one
-sharp and you must let this be black ex> INIF=""
INIF="eth0"
INNET="192.168.1.0/24" -sharp This is for NAT"s network
IPTABLES="/sbin/iptables"
-sharpflush/erase original rules
$IPTABLES -F -sharprule
$IPTABLES -X -sharpchain/table
$IPTABLES -Z -sharpchain
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -t nat -Z
-sharpdefault policies
$IPTABLES -t filter -P OUTPUT DROP
$IPTABLES -t filter -P INPUT DROP
$IPTABLES -t filter -P FORWARD DROP
-sharpAccept localhost connetting, no matter what it is
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
-sharpAccept any response package which is initiated from inside
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-sharpDrop invalid package
$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP
-sharpblock most common network attacks(recon packets and syn-flood attack)
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
-sharpopen ports for different services
-sharpSSH
$IPTABLES -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT
-sharpHTTP
$IPTABLES -A INPUT -p tcp --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m tcp --dport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
-sharpHTTPS
$IPTABLES -A INPUT -p tcp --sport 443 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m tcp --dport 443 -m state --state RELATED,ESTABLISHED -j ACCEPT
-sharpDNS
$IPTABLES -A INPUT -p tcp -m tcp --sport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p udp -m tcp --sport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m tcp --dport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p udp -m tcp --dport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT
-sharpDHCP
$IPTABLES -A INPUT -p udp -m udp --sport 67 --dport 68 -m state --state RELATED,ESTABLISHED -j ACCEPT
-sharp8080
-sharp$IPTABLES -A INPUT -p tcp -m tcp --sport 8080 -m state --state RELATED,ESTABLISHED -j ACCEPT
-sharp$IPTABLES -A INPUT -p tcp --dport 25 -j ACCEPT -sharpSMTP
-sharp$IPTABLES -A INPUT -p tcp --dport 465 -j ACCEPT -sharpSecure SMTP
-sharp$IPTABLES -A INPUT -p tcp --dport 110 -j ACCEPT -sharpPOP3
-sharp$IPTABLES -A INPUT -p tcp --dport 995 -j ACCEPT -sharpSecure POP
-sharpICMP configuration
-sharpTo prevent ICMP DDOS,we do not allow ICMP type 8(echo-request) or limit this request with 1/second
-sharpsome ICMP requests are allowed.
icmp_type="0 3 4 11 12 14 16 18"
for ticmp in $icmp_type
do
$IPTABLES -A INPUT -p icmp --icmp-type $ticmp -j ACCEPT
done
-sharp$IPTABLES -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
$IPTABLES -A OUTPUT -p icmp -j ACCEPT
-sharpFORWARD table
$IPTABLES -A FORWARD -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
$IPTABLES -A FORWARD -f -m limit --limit 100/sec --limit-burst 100 -j ACCEPT
$IPTABLES -A FORWARD -p icmp -m limit --limit 1/sec --limit-burst 10 -j ACCEPT
$IPTABLES -A FORWARD -m state --state INVALID -j DROP
-sharpmangle chain
$IPTABLES -A PREROUTING -s 10.0.0.0/8 -i eth0 -j DROP
$IPTABLES -A PREROUTING -s 172.16.0.0/12 -i eth0 -j DROP
$IPTABLES -A PREROUTING -s 192.168.0.0/16 -i eth0 -j DROP
-sharpsave
$IPTABLES-save
error log
: not foundh: 5: iptables7.sh:
: not foundh: 11: iptables7.sh:
: not foundh: 13: iptables7.sh: / sbin/iptables
: not foundh: 14: iptables7.sh: / sbin/iptables
: not foundh: 15: iptables7.sh: / sbin/iptables
: not foundh: 16: iptables7.sh: / sbin/iptables
: not foundh: 17: iptables7.sh: / sbin/iptables
: not foundh: 18: iptables7.sh: / sbin/iptables
: not foundh: 19: iptables7 .sh:
: not foundh: 20: iptables7.sh:
: not foundh: 21: iptables7.sh:
: not foundh: 22: iptables7.sh:
: not foundh: 24: iptables7.sh: / sbin/iptables
: not foundh: 25: iptables7.sh: / sbin/iptables
: not foundh: 26: iptables7.sh: / sbin/iptables
: not foundh: 27: iptables7.sh:
: not foundh: 28: iptables7.sh:
: not foundh: 30: iptables7.sh: / sbin/iptables
: Not foundh: 31: iptables7.sh: / sbin/iptables
: not foundh: 32: iptables7.sh:
: not foundh: 34: iptables7.sh: / sbin/iptables
: not foundh: 35: iptables7.sh: / sbin/iptables
: not foundh: 36: iptables7.sh:
: not foundh: 38: iptables7.sh: / sbin/iptables
: not foundh: 39: iptables7.sh: / sbin/iptables
: not foundh: 40: iptables7.sh:
: not foundh: 42: iptables7.sh: / sbin / iptables
: not foundh: 43: iptables7.sh: / sbin/iptables
: not foundh: 44: iptables7.sh: / sbin/iptables
: not foundh: 45: iptables7.sh:
: not foundh: 46: iptables7.sh:
: not foundh: 49: iptables7.sh: / sbin/iptables
: not foundh: 50: iptables7.sh: / sbin/iptables
: not foundh: 51: iptables7.sh:
: not foundh: 53: iptables7.sh: / sbin/iptables
: not foundh: 54: iptables7.sh: / sbin/iptables
: not foundh: 55: iptables7.sh:
: not foundh: 56: iptables7.sh:
: not foundh: 58: iptables7.sh: / sbin/iptables
: not foundh: 59: iptables7.sh: / sbin/iptables
: not foundh: 60: iptables7.sh:
: not foundh: 62: iptables7.sh: / sbin/iptables
: not foundh: 63: iptables7.sh: / sbin/iptables
: not foundh: 64: iptables7.sh: / sbin/iptables
: not foundh: 65: iptables7 .sh: / sbin/iptables
: not foundh: 66: iptables7.sh:
: not foundh: 68: iptables7.sh: / sbin/iptables
: not foundh: 69: iptables7.sh:
: not foundh: 70: iptables7.sh:
: not foundh: 73: iptables7.sh:
: not foundh: 74: iptables7.sh:
: not foundh: 79: iptables7.sh:
: not foundh: 80: iptables7.sh:
iptables7.sh: 86: iptables7.sh: Syntax error: word unexpected (expecting "do")
We can find iptables in sbin directory.And then I can"t understand the last message:there is true "do" on it.Why does it still expert a "do"?
Any help will be appreciated.
Thanks.
PS:
more datails
If I use "ipatbles" instead of parameter "IPTABLES", the six rules following can be executed.
iptables -F
iptables -X
iptables -Z
iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
but others still failed again.
< hr > I get this
But I think this is more inportant
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP6_NF_IPTABLES=m
I don"t know how to active it.
Thank you again.
