共享一个iptables的配置

#!/bin/sh
# Stop iptables service first
service iptables stop
#for test
# Load FTP Kernel modules
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp

# Inital chains default policy
/sbin/iptables -F -t filter
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT

# Enable Native Network Transfer
/sbin/iptables -A INPUT -i lo -j ACCEPT

# Accept Established Connections
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# ICMP Control
/sbin/iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT

# WWW Service
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

# FTP Service
#/sbin/iptables -A INPUT -p tcp --dport 21 -j ACCEPT

# SSH Service
/sbin/iptables -A INPUT -p tcp --dport 你的SSH端口 -j ACCEPT

#INET Control
#/sbin/iptables -A INPUT -s 192.168.222.0/24 -j ACCEPT

# Nagios Service
#/sbin/iptables -A INPUT -s 61.160.248.8 -p tcp --dport 5666 -j ACCEPT
# SNMP Service
#/sbin/iptables -A INPUT -s 61.160.248.8 -p udp --dport 161 -j ACCEPT
##/sbin/iptables -A INPUT -s 60.28.208.0/24 -p udp --dport 161 -j ACCEPT


# drop bad scran
/sbin/iptables -A INPUT  -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
/sbin/iptables -A INPUT  -p tcp --tcp-flags ALL ALL -j DROP
/sbin/iptables -A INPUT  -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
/sbin/iptables -A INPUT  -p tcp --tcp-flags ALL NONE -j DROP
/sbin/iptables -A INPUT  -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
/sbin/iptables -A INPUT  -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP


#sync flood
iptables -N synfoold
iptables -A synfoold -p tcp --syn -m limit --limit 1/s --limit-burst 4 -j RETURN
#4/s
iptables -A synfoold -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp -m state --state NEW -j synfoold
#drop soso
/sbin/iptables -I INPUT -s 124.115.0.0/24 -j DROP
/sbin/iptables -I INPUT -s 124.115.4.0/24 -j DROP
#Drop some user
#/sbin/iptables -I INPUT -s 220.117.188.213 -j DROP
#save rules
/etc/init.d/iptables save