请大家帮我看一下我写的这个iptables有没有问题

mdjhaitao

#!/bin/bash

# This is a script

# Edit by liuhaitao

# establish static firewall

# Load connection-tracking modules
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc

# Disable response to broadcasts.
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Don't accept source routed packets.
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route

# Disable ICMP redirect acceptance.
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects

# Enable bad error message protection
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

# Log spoofed packets, source routed packets, redirect packets
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -F

iptables -X

iptables -t nat -F

iptables -t nat -X

iptables -P INPUT DROP

iptables -A INPUT -i lo -j ACCEPT
# SYN-Flooding Protection
iptables -N syn-flood
iptables -A INPUT -i eth1 -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -j DROP
#WEB
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 0/0 --sport 80 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -d 0/0 --dport 80 -j ACCEPT

#DNS
iptables -A INPUT -i eth1 -p udp -s 0/0 --sport 53 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -p udp -d 0/0 --dport 53 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 0/0 --sport 53 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -d 0/0 --dport 53 -j ACCEPT
#FTP
iptables -A INPUT -i eth1 -p tcp --sport 21 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 21 -j ACCEPT

iptables -A INPUT -i eth1 -p udp --sport 20 -j ACCEPT
iptables -A INPUT -i eth1 -p udp --dport 20 -j ACCEPT
#SSH
iptables -A INPUT -i eth1 -p tcp -s 192.168.0.0/24 --dport 22 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.0.0/24 --dport 2222 -j ACCEPT

#PING
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT



有人说不知道我写的是什么目的.我要在一个开放WEB和FTP的服务器上架这个防火墙
大家帮我看一下

Yuri

内容我没细看.
把
echo 1 > /proc/sys/net/ipv4/ip_forward
放到最后.设置完策略之后在放闸.

mdjhaitao

我没明白你说的意思.
那只不过是记录嘛..