iptables basics

原文地址：http://www.brichet.be/?page_id=73

 

iptables basics

#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

# Init table FILTER
iptables -t filter -F #Flush table
iptables -t filter -X #Delete personal chains
iptables -t filter -Z #Idem
iptables -t filter -P INPUT DROP #Default Rule
iptables -t filter -P FORWARD DROP #Default Rule
iptables -t filter -P OUTPUT ACCEPT #Default Rule

# Init table NAT
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P POSTROUTING ACCEPT

# Init table MANGLE
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT

# Accept everything on localhost
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

# Allow everything from local network
iptables -t filter -A INPUT -s 192.168.25.0/24 -j ACCEPT

# Allow navigation from linux box
iptables -t filter -A INPUT -i ppp0 -m state –state ESTABLISHED -j ACCEPT
iptables -t filter -A OUTPUT -o ppp0 -m state –state NEW,ESTABLISHED -j ACCEPT

# NAT local network to internet
iptables -t filter -A FORWARD -i ppp0 -o eth0 -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -o ppp0 -j ACCEPT
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# Allow SSH on port 443
iptables -t filter -I INPUT -p tcp –dport 443 -j ACCEPT

# Enable routing
echo 1 > /proc/sys/net/ipv4/ip_forward