软防火墙?脚本一段,cpanel Plesk DirectAdmin 也适用

winder · 发表于 2011-5-3 17:36:35

刚到处晃悠发现的,求加分
1) Download the script to your server. We provide pre-configured variants of the script to just work "out of the box" on your VPS. Choose the appropriate script and run the following command as root.
# no panel ports
wget -O /etc/init.d/firewall http://vpsinfo.nixhost.net/firewall.vps

# cpanel specific ports opened
wget -O /etc/init.d/firewall http://vpsinfo.nixhost.net/firewall.cpanel.vps

# DirectAdmin specific ports opened
wget -O /etc/init.d/firewall http://vpsinfo.nixhost.net/firewall.directadmin.vps

# Plesk specific ports opened
wget -O /etc/init.d/firewall http://vpsinfo.nixhost.net/firewall.psa.vps

This is where the security concious will not take our word for anything and thoroughly read the script first. Go ahead, we'll wait.

2) Make it executable

chmod +x /etc/init.d/firewall

3) Configure it to start at boot

/sbin/chkconfig firewall on

4) Start it.

/sbin/service firewall start
or
/etc/init.d/firewall start

5) See the rules

/sbin/service firewall status

#!/bin/bash
#
# firewall This shell script takes care of setting up a firewall for a virtuosso based VPS
# (no stateful rules/connection tracking or logging.
# Borrows heavily from a script by Dmitry Konstantinov of sw-soft
#
#
# chkconfig: 2345 18 92
# description: setup firewall configuration
IPTABLES="/sbin/iptables"
SERVER_IPS=`/sbin/ifconfig | grep inet | cut -d : -f 2 | cut -d \ -f 1 | grep -v 127.0.0.1`
FWIN="${IPTABLES} -A INPUT"
FWOUT="${IPTABLES} -A OUTPUT"
OK="-j ACCEPT"
NO="-j DROP"
# Flush tables and change default policy to DROP
function initialize() {
local TABLE="${1}"
${IPTABLES} -F ${TABLE}
${IPTABLES} -P ${TABLE} DROP
}
# Flush tables and change default policy to ACCEPT
function stop() {
local TABLE="${1}"
${IPTABLES} -F ${TABLE}
${IPTABLES} -P ${TABLE} ACCEPT
}
# Verify call switch
case "$1" in
start|restart)
initialize INPUT
initialize OUTPUT
initialize FORWARD
# INPUT
# 1) loopback
${FWIN} -i lo ${OK}
${FWIN} -d 127.0.0.0/8 ${NO}
# 2) We allow incoming SSH connections and answers to
# our own SSH connections:
for OURIP in ${SERVER_IPS}; do
${FWIN} -p tcp -d ${OURIP} --dport 22 ${OK}
${FWIN} -p tcp --sport 22 -d ${OURIP} "!" --syn ${OK}
done
# 3) We allow incoming DNS queries as well as answers to our
# DNS queries.
for OURIP in ${SERVER_IPS}; do
${FWIN} -p tcp -d ${OURIP} --dport 53 ${OK}
${FWIN} -p udp -d ${OURIP} --dport 53 ${OK}
${FWIN} -p tcp --sport 53 -d ${OURIP} --dport 1024: "!" --syn ${OK}
${FWIN} -p udp --sport 53 -d ${OURIP} --dport 1024: ${OK}
done
# 4) We allow access to our SMTP server, as well as answers
# to our SMTP connections and, temporarily, identd stuff:
for OURIP in ${SERVER_IPS}; do
${FWIN} -p tcp -d ${OURIP} --dport 25 ${OK}
${FWIN} -p tcp --sport 25 -d ${OURIP} --dport 1024: "!" --syn ${OK}
${FWIN} -p tcp --sport 1024: -d ${OURIP} --dport 113 ${OK}
#${FWIN} -p udp --sport 1024: -d ${OURIP} --dport 113 ${OK}
${FWIN} -p tcp --sport 113 -d ${OURIP} --dport 1024: "!" --syn ${OK}
#${FWIN} -p udp --sport 113 -d ${OURIP} --dport 1024: ${OK}
done
# 5) We also allow access to our POP/sPOP server.
for OURIP in ${SERVER_IPS}; do
${FWIN} -p tcp -d ${OURIP} --dport 110 ${OK}
${FWIN} -p tcp -d ${OURIP} --dport 995 ${OK}
done
# 6) and to IMAP/IMAPs
for OURIP in ${SERVER_IPS}; do
${FWIN} -p tcp -d ${OURIP} --dport 143 ${OK}
${FWIN} -p tcp -d ${OURIP} --dport 993 ${OK}
done
# 7) we would like to be able to use lynx ;)
for OURIP in ${SERVER_IPS}; do
${FWIN} -p tcp --sport 80 -d ${OURIP} --dport 1024: "!" --syn ${OK}
done
# 8) We allow incoming echo replies/requests from everywhere:
for OURIP in ${SERVER_IPS}; do
${FWIN} -p icmp -d ${OURIP} --icmp-type 0 ${OK}
${FWIN} -p icmp -d ${OURIP} --icmp-type 3 ${OK}
${FWIN} -p icmp -d ${OURIP} --icmp-type 8 ${OK}
${FWIN} -p icmp -d ${OURIP} --icmp-type 11 ${OK}
done
# 9) We also would like to allow access to our web server:
for OURIP in ${SERVER_IPS}; do
${FWIN} -p tcp -d ${OURIP} --dport 80 ${OK}
${FWIN} -p tcp -d ${OURIP} --dport 443 ${OK}
done
# 10) people are still crazy enough to use ftp
for OURIP in ${SERVER_IPS}; do
for PORT in 20 21; do
${FWIN} -p tcp -d ${OURIP} --dport ${PORT} ${OK}
${FWIN} -p tcp --sport ${PORT} -d ${OURIP} --dport 1024: "!" --syn ${OK}
${FWIN} -p udp -d ${OURIP} --dport ${PORT} ${OK}
${FWIN} -p udp --sport ${PORT} -d ${OURIP} --dport 1024: ${OK}
done
done
# allow answers on high ports
${FWIN} -p tcp -m tcp --dport 1024:65535 ! --tcp-flags SYN,RST,ACK SYN -j ACCEPT
${FWIN} -p udp -m udp --dport 1024:65535 -j ACCEPT
# passive ftp
# configure ftp server to allow passive ftp on ports outside of
# the local range. Check local range with
# cat /proc/sys/net/ipv4/ip_local_port_range
#
# for pure-ftpd, use --passiveportrange 61001:65535 in
# /etc/sysconfig/pure-ftpd
#
# for proftpd use PassivePorts 61001 65535
# in /etc/proftpd.conf
#
#${FWIN} -p tcp -m tcp --dport 61001:65535 ${OK}
# Everything else is denied by default - policy is DROP.
# OUTPUT
# 1) Loopback packets.
${FWOUT} -o lo ${OK}
${FWOUT} -s 127.0.0.0/8 ${NO}
# 2) We allow all outgoing traffic:
for OURIP in ${SERVER_IPS}; do
${FWOUT} -s ${OURIP} ${OK}
done
;;
stop)
# turn off the firewall, flush all rules
echo "Flushing rulesets.."
stop INPUT
stop OUTPUT
stop FORWARD
;;
status)
# display the current status - both firewall rules and masquerading
# connections
# list rules. -n avoids DNS lookups
$IPTABLES -nL
;;
*)
echo "Usage: firewall {start|stop|restart|status}"
exit 1
esac
exit 0

复制代码

[ 本帖最后由 winder 于 2011-5-3 17:46 编辑 ]

ATOM · 发表于 2011-5-3 17:42:53

cenots的导入防火墙规则的？

dreams777 · 发表于 2011-5-3 17:45:40

偶现在不敢弄了，上次我弄了一个，把我弄的啪唧啪唧的。

winder · 发表于 2011-5-3 17:46:05

原帖由 ATOM 于 2011-5-3 17:42 发表
cenots的导入防火墙规则的？

编辑了下.重新看

walkman660 · 发表于 2011-5-3 18:03:19

头晕

稀飯 · 发表于 2011-5-3 18:18:26

我回铁是因为我蛋铜

只看该作者 · 发表于 2011-5-3 18:24:32

提示: 作者被禁止或删除内容自动屏蔽

DSN · 发表于 2011-5-3 18:45:13

具体啥作用？

gxfsasd · 发表于 2011-5-3 18:56:34

最怕脚本错误

winder · 发表于 2011-5-3 22:13:27

原帖由 DSN 于 2011-5-3 18:45 发表
具体啥作用？

具体已经更新上去了

		自动登录	找回密码
密码			注册

i65u 该用户已被删除	7^# 发表于 2011-5-3 18:24:32 \| 只看该作者提示: 作者被禁止或删除内容自动屏蔽
i65u 该用户已被删除
	回复支持反对举报

软防火墙?脚本一段,cpanel Plesk DirectAdmin 也适用

浏览过的版块