iptables -P OUTPUT DROP iptables -P INPUT DROP iptables -P FORWARD DROP iptables -F
iptables -P OUTPUT ACCEPT iptables -P INPUT DROP iptables -P FORWARD DROP
iptables -A INPUT -i eth1 -s $LOOP -j DROP iptables -A FORWARD -i eth1 -s $LOOP -j DROP iptables -A INPUT -i eth1 -d $LOOP -j DROP iptables -A FORWARD -i eth1 -d $LOOP -j DROP
iptables -A FORWARD -p tcp --sport 137:139 -o eth1 -j DROP iptables -A FORWARD -p udp --sport 137:139 -o eth1 -j DROP iptables -A OUTPUT -p tcp --sport 137:139 -o eth1 -j DROP iptables -A OUTPUT -p udp --sport 137:139 -o eth1 -j DROP
iptables -A FORWARD -s ! $PRIVATE -i eth0 -j DROP
iptables -A INPUT -s $LOOP -j ACCEPT iptables -A INPUT -d $LOOP -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p tcp --dport http -j ACCEPT iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT iptables -A FORWARD -i tun+ -j ACCEPT #这两句很重要 iptables -A INPUT -i tap+ -j ACCEPT iptables -A FORWARD -i tap+ -j ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT iptables -A FORWARD -i eth0 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -o eth1 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m state --state NEW -o eth1 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
firewall.sh如下 #!/bin/bash PRIVATE=192.168.0.0/24 LOOP=127.0.0.1 iptables -P OUTPUT DROP iptables -P INPUT DROP iptables -P FORWARD DROP iptables -F
iptables -P OUTPUT ACCEPT iptables -P INPUT DROP iptables -P FORWARD DROP
iptables -A INPUT -i eth0 -s $LOOP -j DROP iptables -A FORWARD -i eth0 -s $LOOP -j DROP iptables -A INPUT -i eth0 -d $LOOP -j DROP iptables -A FORWARD -i eth0 -d $LOOP -j DROP
iptables -A FORWARD -p tcp --sport 137:139 -o eth0 -j DROP iptables -A FORWARD -p udp --sport 137:139 -o eth0 -j DROP iptables -A OUTPUT -p tcp --sport 137:139 -o eth0 -j DROP iptables -A OUTPUT -p udp --sport 137:139 -o eth0 -j DROP
iptables -A FORWARD -s ! $PRIVATE -i eth1 -j DROP
iptables -A INPUT -s $LOOP -j ACCEPT iptables -A INPUT -d $LOOP -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p tcp --dport http -j ACCEPT iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p udp --dport 5000 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT iptables -A FORWARD -i tun+ -j ACCEPT iptables -A INPUT -i tap+ -j ACCEPT iptables -A FORWARD -i tap+ -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -o eth0 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m state --state NEW -o eth0 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT