＋设为首页 ＋添加到收藏夹
# delete all rules. $iptables -f $iptables -t nat -f $iptables -t mangle -f # delete all (non-builtin) user-defined chains. $iptables -x $iptables -t nat -x $iptables -t mangle -x # zero all packet and byte counters. $iptables -z $iptables -t nat -z $iptables -t mangle -z echo -n "." echo " done!"}
echo -n "setting default policies to $@ .." $iptables -p input "$@" echo -n "." $iptables -p forward "$@" echo -n "." $iptables -p output "$@" echo -n "." echo " done!"} 【程序编程相关:从好友"借"QQ谈个人信息安全防范!】
set_policies() { 【推荐阅读:WINDOWS系统下木马程序的设计与实现】
flush_rulesets set_policies accept 【扩展信息:网易的客户MM真不错~~~~~~~~】
firewall_stop() {
echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -a postrouting -s $lan -d 0/0 -j masquerade iptables -t nat -a postrouting -s $serverpool -d 0/0 -j masquerade
echo echo "`date` - firewall disabled on $hostname"}
load_modules() { #$modprobe ip_tables #$modprobe ip_conntrack #$modprobe iptable_nat #$modprobe ipt_masquerade :}
firewall_start() {
echo echo -n "restarting syslogd daemon .."
/bin/kill -hup `cat /var/run/syslogd.pid 1>/dev/null` 2>/dev/null
echo ". done!"
# firewall initialization load_modules echo -n "firewall initialization ..."
#-------- general policies --------# # turning on ip forwarding (router mode) echo 1 > /proc/sys/net/ipv4/ip_forward # ip spoofing protection (i.e. source address verification). echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter # enable protection against syn flood attacks. echo 1 > /proc/sys/net/ipv4/tcp_syncookies # ignore all icmp echo requests (i.e. disable ping). # leave it off, make the sysadm life easier!!! # echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all # ignore icmp echo requests to broadcast/multicast addresses only. echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # log packets with impossible addresses. echo 1 > /proc/sys/net/ipv4/conf/all/log_martians # dont log invalid responses to broadcast frames, they just clutter the logs. echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses # dont accept source routed packets. echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route # setting max number of tracked connections echo "65536" > /proc/sys/net/ipv4/ip_conntrack_max
echo ". done!"
flush_rulesets set_policies drop
#----- general policies end -----#
echo -n "creating logging chains .."
... 下一页