iptables_ubuntu

#!/bin/bash

# 检查用户是否为root，因为设置防火墙需要root权限
if [ "$(id -u)" != "0" ]; then
    echo "请以root用户身份运行此脚本。"
    exit 1
fi
# check iptables tools
which iptables
if [ $? -ne 0 ]; then
    echo "iptables is not support!"
    exit 1
fi

## 安装iptables（如果尚未安装）
#apt-get update
#apt-get install -y iptables

IPT='/sbin/iptables'
IPT6='/sbin/ip6tables'
IPT_CONF='/etc/sysconfig/iptables'
TIMESTAME=`date "+%Y%m%d%H%M%S"`
IPT_BACKUP_DIR='/etc/sysconfig'
IPT_BACKUP_CONF=${IPT_BACKUP_DIR}/iptables.${TIMESTAME}
SERV_SSH="10022"
# 内部网络
NET_TRUES_LIST="
172.16.0.0/12
10.0.0.0/8
192.168.0.0/24
127.0.0.1/8
103.206.191.172
154.91.196.75/24
"

## 对信任IP开放端口
#NET_OPEN_PORT="
#10069
#10063
#"

# 对外全开端口
NAT_OPEN_PORT="
80
443
"

# 清除现有规则，但保留Docker链
${IPT} -F INPUT
${IPT} -F FORWARD
${IPT} -F OUTPUT
${IPT6} -F INPUT
${IPT6} -F FORWARD
${IPT6} -F OUTPUT

# 设置默认策略
${IPT} -P INPUT DROP
${IPT} -P FORWARD DROP
${IPT} -P OUTPUT DROP
${IPT6} -P INPUT DROP
${IPT6} -P FORWARD DROP
${IPT6} -P OUTPUT DROP

#iptables -P INPUT ACCEPT
#iptables -P FORWARD ACCEPT
#iptables -P OUTPUT ACCEPT

# 允许来自本地回环接口的流量
${IPT} -A INPUT -i lo -j ACCEPT

# 允许已建立的连接和相关连接
${IPT} -A INPUT   -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
${IPT} -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
${IPT} -A OUTPUT  -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# SSH
$IPT -A INPUT -p tcp -m state --state NEW -m tcp --dport $SERV_SSH -j ACCEPT

# 开放信任IP全部端口
for ip in $NET_TRUES_LIST
do
    ${IPT} -A INPUT   -s $ip  -j ACCEPT
    ${IPT} -A FORWARD -s $ip  -j ACCEPT
    ${IPT} -A OUTPUT  -d $ip  -j ACCEPT
done

# 域名DNS解析
${IPT} -A INPUT -p udp --dport 53 -j ACCEPT
${IPT} -A INPUT -p tcp --dport 53 -j ACCEPT

# 开放外网全部端口
for port in $NAT_OPEN_PORT
do
    ${IPT} -A INPUT   -p tcp -m state --state NEW -m tcp --dport $port -j ACCEPT
    ${IPT} -A FORWARD -p tcp -m state --state NEW -m tcp --dport $port -j ACCEPT
done

#ICMP
$IPT -A INPUT -p icmp -j ACCEPT

# 保留Docker链的规则
${IPT} -A INPUT -j DOCKER-USER

# 保存iptables规则
iptables-save > ${IPT_BACKUP_CONF}

# 显示当前iptables规则
${IPT} -L -n --line-number