iptables_centos

#!/bin/bash
# check iptables tools
which iptables
if [ $? -ne 0 ]; then
    echo "iptables is not support!"
    exit 1
fi
#----------------------<Set Variable>--------------------
IPT='/sbin/iptables'
IPT_CONF='/etc/sysconfig/iptables'
TIMESTAME=`date "+%Y%m%d%H%M%S"`
IPT_BACKUP_DIR='/etc/sysconfig'
IPT_BACKUP_CONF=${IPT_BACKUP_DIR}/iptables.${TIMESTAME}
SERV_SSH="10022"
NET_TRUES_LIST="
120.194.3.98
172.16.0.0/16
"
# 开放内部端口
NET_INSIDE_PORT="
9090
7890
7891
"
#开放部端口
NET_OPEN_PORT="
9090
7890
7891
"
#-----------------------<Clear Original Rule>------------
$IPT -t filter -F
    #------------------------<Set Default Rule>--------------
    $IPT -P INPUT   DROP
$IPT -P FORWARD DROP
    $IPT -P OUTPUT  ACCEPT
#-----------------------<Set INPUT Rule>-----------------
#CONN
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    $IPT -A INPUT -i lo -j ACCEPT
#SSH
for ip in $NET_TRUES_LIST
    do
        $IPT -A INPUT -s $ip -p tcp -m state --state NEW -m tcp --dport $SERV_SSH -j ACCEPT
done
#内部端口
for port in $NET_INSIDE_PORT
    do
        $IPT -A INPUT -s 172.16.0.0/16 -p tcp -m state --state NEW -m tcp  --dport $port -j ACCEPT
done
#信任IP开放端口 外部端口
for ip in $NET_TRUES_LIST
    do
        for port in $NET_OPEN_PORT
    do
        $IPT -A INPUT -s $ip -p tcp -m state --state NEW -m tcp --dport $port -j ACCEPT
    done
done
##开放端口 全网可访问
#for port in $NET_OPEN_PORT
    #do
    #    $IPT -A INPUT -p tcp -m state --state NEW -m tcp  --dport $port -j ACCEPT
#done
#IMPT
$IPT -A INPUT -s 172.16.0.0/16  -p icmp -j ACCEPT
    $IPT -A INPUT -j DROP
#-----------------------<Set Forward Rule>-----------------
$IPT -A FORWARD -j DROP
    #------------------------<Set nat>------------------------
    #-----------------------<Test Rule>------------------------
    read -t 5 -p "Test firewall rule(Y):" YES
    [ -z $YES ] && YES='Y'
if [ $YES = 'Y' ] ; then
        DAEMON_SCRIPT="`mktemp /tmp/firewall.XXXXXXXX`"
        echo '#!/bin/bash' >> $DAEMON_SCRIPT
    echo "sleep 30 " >> $DAEMON_SCRIPT
        echo "service iptables restart" >> $DAEMON_SCRIPT
    echo "rm -f $DAEMON_SCRIPT" >> $DAEMON_SCRIPT
    . $DAEMON_SCRIPT &
    echo "END"
    exit 0
fi
#-----------------------<Backup Rule>--------------------
read -t 5 -p "Save iptable config and backup(Y):" YES
[ -z $YES ] && YES='n'
    if [ $YES = 'Y' ] ; then
    [ ! -d $IPT_BACKUP_DIR ] && mkdir -p $IPT_BACKUP_DIR
    cp $IPT_CONF $IPT_BACKUP_CONF
    if [ $? -ne 0 ]; then
        exit 1
    fi
fi
#-----------------------<Save Rule>--------------------
service iptables save
#-----------------------<END>--------------------
iptables -L -n --line-number
echo "The End"