linux 防火墙配置

#flush all policy
iptables -F
iptables -X
iptables -Z
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
# Enable ip forward
#module
modprobe ip_conntrack_ftp
modprobe ip_conntrack_tftp
modprobe ip_nat_ftp
modprobe ip_nat_tftp
#Default policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -p FORWARD ACCEPT


#Enable lo interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -O lo -j ACCEPT


# DNS lookup
iptables -A INPUT -i eth0  -p udp 53 -j ACCEPT
iptables -A OUTPUT -O eth0 -p udp 53 -j ACCEPT


# SSH Server
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -s 192.168.1.0/24 -p tcp --sport 22 -j ACCEPT


#SSH Client
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -s 192.168.1.0/24 -p tcp --sport 22 -j ACCEPT


#icmp request
iptables -A INPUT -s 192.168.1.0/24 -p icmp --icmp-type 8 -j ACCEPT
iptables -A OUTPUT -s 192.168.1.0/24 -p icmp --icmp-type 0 -j ACCEPT


#ftp server
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 21 -j ACCEPT
iptables -A OUTPUT -s 192.168.1.0/24 -p tcp --sport 21 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


#SNAT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source 1.1.1.1


#DNAT
iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 80 -j SNAT --to-dest 192.1686.0.254