User talk:Udiab: Difference between revisions

Latest revision as of 14:19, 10 May 2011

安装Fedora-14

在此处获得Fedora-14安装的鏡像文件。

在计算机安装Fedora-14-x86_64-DVD.iso的鏡像文件过程中，当勾选默认配置时能够顺利完成安装；当选择全部的安装包时系统提示有三个连接文件存在依赖关系无法完成最终的安装（其所需安装磁盘容量至少28.5GB）；

fedora 14管理配置

第一部分	第二部分	第三部分
Linux网络系统基本管理	Linux网络服务管理	Linux安全快速的远程访问管理
Linux系统基本配置; DHCP实现ip地址自动分配; NIS网络信息服务。	Linux网络服务应用; Samba+NFS文件服务; BIND提供域名解析服务;\|Apache提供网站服务;\|Vsftp提供文件传输服务;\|Sendmail邮件服务等。	Linux实现软路由; Iptables网络防火墙; Squid代理服务器配置;\|Linux实现VPN服务器; SSH实现Linux安全的访问和数据传输。

配置Fedora-14系统

VM虚拟机CPU饱和后不允许溢出运行;

解决root用户直接登入问题

su -

密码：

输入命令:gedit /etc/pam.d/gdm&

在文本编辑器中注释掉"auth required pam_succeed_if.so user!=root quiet"这一行(在这一行前面加上"#"注释,即改成#auth required pam_succeed_if.so user!=root quiet)

保存后继续输入命令:gedit /etc/pam.d/gdm-password&

同样地注释掉"auth required pam_succeed_if.so user!=root quiet"这一行。

保存后退出

现在就能使用root用户登录了

安装f-prot

(download_http://www.f-prot.com/download/home_user/)

cd /usr/local/src

tar zxvf fp-Linux-x86_64-ws.tar.gz

cd f-prot

./install-f-prot.pl

选用默认的安装目录/usr/local/bin

选用默认的安装手册目录/usr/share/man/man8

all done!

全盘扫描

fpscan -a

扫描结果

files:88552

skipped files:0

files with errors:2

Running time:06:28

配置DNS服务器

rpm -ivh bind-9.7.2-2.P2.fc14.x86_64.rpm

service named start

查看主机名称

#honstname

设置随机启动named服务：chkconfig --level 35 named on

配置主机名：

vi /etc/sysconfig/network

NETWORKING=yes

HOSTNAME=example.com.cn

GATEWAY=192.168.1.5

完成本地域名解析

vi /etc/hosts

192.168.122.192 example.com.cn example # Added by NetworkManager

127.0.0.1 localhost.localdomain localhost localhost4

::1 example.com.cn example localhost6.localdomain6 localhost6

查看etc/host.conf文件

vi /etc/host.conf

multi on

order hosts,bind

配置网卡:

vi /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE="eth0"

BOOTPROTO="none"

DEFROUTE="yes"

DNS1="192.168.122.192"

DOMAIN="com.cn"

GATEWAY="192.168.1.5"

HWADDR="00:16:96:16:3A:14"

IPADDR="192.168.122.192"

IPV4_FAILURE_FATAL="yes"

IPV6INIT="no"

NAME="System eth0"

NM_CONTROLLED="yes"

PREFIX="24"

TYPE="Ethernet"

UUID="5fb06bd0-0bb0-7ffd-45f1-d6edd65f3e03"

NETMASK=255.255.255.0

USERCTL=no

DNS2=192.168.1.5

配置本机DNS解析文件(系统>>管理>>网络>>DNS)

vi /etc/resolv.conf

# Generated by NetworkManager

search com.cn

nameserver 192.168.122.192 //配置本机主域名服务器IP

nameserver 192.168.1.5 //配置外网域名服务器IP

配置named主文件

cp /etc/named.conf /home/patriotserver/下载

vi /etc/named.conf

//

// named.conf

//

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

//

// See /usr/share/doc/bind*/sample/ for example named configuration files.

//

options {

listen-on port 53 { any; }

listen-on-v6 port 53 { ::1; };

directory "/var/named";

dump-file "var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

query-source port 53;

query-source-v6 port 53;

allow-query { any; };

allow-query-cache { any;};

recursion yes;

recursive-clients 10000;

dnssec-enable yes;

dnssec-validation yes;

dnssec-lookaside auto;

/* path to ISC DLV key*/

bindkeys-file "/etc/named/dynamic";

};

logging { channel default_debug { file "data/named.run"; severity dynamic;

};

zone "." IN {

type hint;

file "named.ca";

};

include "/etc/named.rfc1912.zones";

include "/etc/named.root.key";

配置定义文件vi /etc/named.rfc1912.zones添加如下文件连接:

zone "explame.com.cn" IN {

type master;

file "example.com.cn.zone";

allow-update { none; };

};

zone "122.168.192.in-addr.arpa" IN {

type master;

file "192.168.122.arpa";

allow-update { none; };

};

配置正向解析文件(添加邮件域名＠example.com.cn其中MX越小域名越优先)：

cd /var/named

cp named.localhost example.com.cn.zone

vi example.com.cn.zone

$TTL 1D

@ IN SOA example.com.cn. root.example.com.cn. (

42 ; serial

1D ; refresh

1H ; retry

3H ) ; minimum

example.com.cn. IN NS example.com.cn.

IN A 192.168.122.192

IN AAAA 0000:0000:0000:0000:0000:0000:c0a8:7ac0

@ IN MX 5 example.com.cn.

www IN A 192.168.122.192

www IN AAAA 0000:0000:0000:0000:0000:0000:c0a8:7ac0

配置反向解析文件：/var/named/192.168.122.arpa

cp named.loopback 192.168.122.arpa

vi 192.168.122.arpa

$TTL 1D

122.168.192.in-addr.arpa. IN SOA example.com.cn. root.example.com.cn. (

42 ; serial

1D ; refresh

1H ; retry

1W ; expire

3H ) ; minimum

122.168.192.in-addr.arpa. IN NS example.com.cn.

IN A 192.168.122.192

IN AAAA 0000:0000:0000:0000:0000:0000:c0a8:7ac0

192 IN PTR www.example.com.cn.

修改文件所属组：

cd /var/named

chgrp named example.com.cn.zone

chgrp named 192.168.122.arpa

设置文件权限:

chmod 644 /etc/named.conf

chmod 644 /etc/named.rfc1912.zones

chmod 644 /var/named/example.com.cn.zone

chmod 644 /var/named/192.168.122.arpa

重新载入DNS域名解析:

service named reload

测试nslookup

安装mysql

rpm -ivh perl-DBD-Mysql-4.017-1.fc14.x86_64.rpm

rpm -ivh mysql-libs-5.1.51-2.fc14.x86_64.rpm

rpm -ivh mysql-5.1.51-2.fc14.x86_64.rpm

rpm -ivh mysql-server-5.1.52-1.fc14.x86_64.rpm

设置MySQL启动

service mysqld start

cd /usr ; /usr/bin/mysqld_safe &

cd /usr/mysql-test ; perl mysql-test-run.pl

please report any problems with the /usr/bin/mysqlbug script!

正在启动mysqld:[确定]

创建用户密码：

/usr/bin/mysqladmin -u root password ******

设置mysql开机自启动

ntsysv选择mysqld确定

创建数据库 mysql -u root -p ******

mysql> create database mediawiki;

增加一个用户mediawiki去管理mediawiki数据库

mysql> grant select,insert,update,delete on mediawiki.* to mediawiki@localhost identified by "password";

配置Apache服务器

配置mediawiki

cd /var/www/html

tar zxvf mediawiki-1.16.0.tar.gz

chmod 711 mediawiki-1.16.0

cd mediawiki-1.16.0

chmod a+w config

开放图片上传功能

chmod 777 images

改变组别和所有者

cd ..

chown -hR 1000:1000 mediawiki-1.16.0

配置apache服务器

service httpd start

设置开机自启动Apache

ntsysv

配置文件说明如下：

cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.bak

gedit /etc/httpd/conf/httpd.conf

修改前的旧文件语句

TimeOut 60

KeepAlive Off

#ExtendedStatus on

#ServerName www.example.com:80

UseCanonicalName Off

修改后语句

TimeOut 300

KeepAlive On

ExtendedStatus Off

ServerName www.example.com.cn:80

UseCanonicalName On

添加根文档目录的访问权限:

Options MultiViews Indexes Includes FollowSymLinks

AllowOverride FileInfo AuthConfig Limit

Order allow,deny

Allow from all

</Limit>

Order deny,allow

Deny from all

</LimitExcept>

</Directory>

添加如下注释:

ServerAdmin root@localhost

DocumentRoot /var/www/html/mediawiki-1.16.0

ServerName www.example.com.cn

DirectoryIndex index.php index.html index.htm index.shtml

Loglevel debug

HostNameLookups off

</VirtualHost>

重启Apache服务

service httpd restart

设置httpd_rw写权限

setsebool allow_polyinstantiation on

setsebool samba_export_all_rw on

setsebool samba_export_all_ro on

setsebool httpd_unified on

setsebool httpd_enable_homedirs on

setsebool httpd_read_user_content on

添加(add:)

vi /etc/rc.d/rc.local

setsebool allow_polyinstantiation on

setsebool samba_export_all_rw on

setsebool samba_export_all_ro on

setsebool httpd_unified on

setsebool httpd_enable_homedirs on

setsebool httpd_read_user_content on

查看

getsebool -a|grep http

点击firefox

http://192.168.122.192

或

http://www.example.com.cn

配置mediawiki选项

修改文件/var/www/html/mediawiki/LocalSettings.php

更改网站左上角的logo为图片文件wiki-indexed.png

在LocalSettings.php中间加入

## Set $wgLogo to the URL path to your own logo image.

$wgLogo = "${wgScriptPath}/skins/monobook/wiki-indexed.png";

编辑重定向mediawiki首页

http://www.example.com.cn/index.php/MediaWiki:Mainpage

配置DHCP服务器

下载DHCP安装包ftp://58.49.171.28/download/

dhcp-4.2.0-19.P2.fc14.x86_64.rpm

在系统工具>>终端

rpm -ivh dhcp-4.2.0-19.P2.fc14.x86_64.rpm

查看DHCP配置文件的模板

#cat /usr/share/doc/dhcp-4.2.0/dhcpd.conf.sample

通过cp把模板模板文件copy过来并且命名为“dhcpd.conf”

cp /usr/share/doc/dhcp-4.2.0/dhcpd.conf.sample /etc/dhcp/dhcpd.conf

更改DHCP配置文件

vi /etc/dhcp/dhcpd.conf

配置DHCP租约文件(dhcpd.leases)

第一次启动时dhcpd.leases是一个空文件位置在var/lib/dhcpd/dhcpd.leases显示分配客户机IP对应的MAC信息

启动dhcp服务器并指定ip地址分配的网络接口(eth1)

vi /etc/sysconfig/dhcpd

# command line options here

DHCPDARGS=eth1

:w //保存文档

启动dhcp

service dhcpd start

使DHCP随服务器自启动

chkconfig --level 35 dhcpd on

使用PS命令检查dhcpd进程：

ps -ef | grep dhcpd

使用netstat检查dhcpd运行端口：

netstat -nutap | grep dhcpd

配置mail邮件服务器

配置samba文件服务器

安装samba客户端

rpm -ivh samba-common-3.5.5-68.fc14.1.x86_64.rpm

rpm -ivh samba-client-3.5.5-68.fc14.1.x86_64.rpm

查看共享资源

smbclient -L 192.168.1.254

访问共享资源(使用root账户防止访问本地文件夹受限)

smbclient //192.168.1.254/public -u usename

<smb:\>dir

<smb:\>cd video

<smb:\>get RealPlayer11GOLD.rpm

配置FTP服务器

配置Redhat集群应用

配置防火墙firewall

<1>更新防火墙iptables-1.4.10

下载最新的iptables版本（www.netfilter.org）

scp root@192.168.1.5:/root/iptables-1.4.10.tar.bz2

mv /root/iptables-1.4.10.tar.bz2 /usr/local/src/

cd /usr/local/src/

tar jxvf iptables-1.4.10.tar.bz2

cd iptables-1.4.10

./configure

make

make install

<2>将iptables服务停止

[root@linux-test root] # service iptables stop

[root@linux-test root]# service ip6tables stop

用/usr/local/sbin/iptables新文件替换/sbin/iptables（这个是老版本的连接位置）

并同时替换ip6tables、ip6tables-restore、ip6tables-save、iptables、iptables-restore和iptables-save

[root@linux-test root] # cp /usr/local/sbin/iptables /sbin/iptables

iptables就升级完成了，使用下列命令查看

[root@linux-test root]# iptables -V

iptables v1.4.10

[root@linux-test root]# service iptables restart

<3>使用snort.sh脚本在开机时自动开启防火墙设置(使用合理规则时可实现基于端口的Windows server 2008平台虚拟机web页面穿越防火墙与局域网直接联系，或使用主机代理连接至Internet。开发web不在受平台限制)

# touch /etc/rc.d/snort.sh

# echo "/etc/rc.d/snort.sh">>/etc/rc.d/rc.local

将snort.sh防火墙脚本放在/etc/rc.d目录中

添加snort.sh文件的可执行权限

# chmod u+x /etc/rc.d/snort.sh

# echo "1" >/proc/sys/net/ipv4/ip_forward

或是修改/etc/sysctl.conf把net.ipv4.ip_forward = 0改为= 1

当启用ipv6防火墙时启用ipv6_forwarding路由转发设置

修改/etc/sysctl.conf在注释#Controls IP packet forwarding下面添加（add:）

net.ipv6.conf.all.forwarding = 1

save sysctl.conf保存文件并启用/etc/sysctl.conf文件中的变量variable

sysctl -p /etc/sysctl.conf

检查路由转发功能设置

nano /proc/sys/net/ipv6/conf/all/forwarding

或是修改echo "1" >/proc/sys/net/ipv6/conf/all/forwarding

以下为Basic_Firewall防火墙脚本snort.sh内容：# gedit /etc/rc.d/snort.sh

#!/bin/bash

echo "1" >/proc/sys/net/ipv4/ip_forward

echo "1" >/proc/sys/net/ipv6/conf/all/forwarding

inet_iface="ppp0"

inet_ip="192.168.122.2"

lan_iface="eth1"

lan_ip="192.168.1.5"

lan_ip_range="192.168.1.0/24"

dns1="202.103.24.68"

dns2="202.103.44.150"

ntp="122.226.192.4"

ipt="/sbin/iptables"

ip6t="/sbin/ip6tables"

/sbin/depmod -a

/sbin/modprobe ipt_MASQUERADE

/sbin/modprobe ip_tables

/sbin/modprobe ip_conntrack

/sbin/modprobe ip_conntrack_ftp

/sbin/modprobe ip_conntrack_irc

/sbin/modprobe iptable_nat

/sbin/modprobe ip_nat_ftp

/sbin/modprobe ipt_connlimit

/sbin/modprobe ipt_limit

/sbin/modprobe ipt_LOG

$ipt -P INPUT DROP

$ipt -P FORWARD DROP

$ipt -P OUTPUT ACCEPT

$ipt -t nat -P PREROUTING ACCEPT

$ipt -t nat -P POSTROUTING ACCEPT

$ipt -t nat -P OUTPUT ACCEPT

for TABLE in filter nat mangle ; do

$ipt -t $TABLE -F

$ipt -t $TABLE -X

done

$ipt -t filter -A INPUT -s $lan_ip_range -i $inet_iface -j DROP

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i $inet_iface -j DROP

$ipt -t filter -A INPUT -s 192.168.0.0/16 -i $inet_iface -j DROP

$ipt -t filter -A INPUT -s 10.0.0.0/8 -i $inet_iface -j DROP

$ipt -t filter -A INPUT -s 172.16.0.0/16 -i $inet_iface -j DROP

$ipt -t filter -A INPUT -s 127.0.0.0/8 -i $inet_iface -j DROP

$ipt -t filter -A INPUT -p udp -i $lan_iface --dport 67 --sport 68 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 0:19 -j DROP

$ipt -t filter -A INPUT -p udp --dport 0:19 -j DROP

$ipt -t filter -A INPUT -i $inet_iface -p tcp --dport 22 -j DROP

$ipt -t filter -A INPUT -d 127.0.0.1 -p tcp --dport 22 -j DROP

$ipt -t filter -A INPUT -s $lan_ip -p tcp --dport 22 -j DROP

$ipt -t filter -A INPUT -d 192.168.122.1 -p tcp --dport 22 -j DROP

$ipt -t filter -A INPUT -d $inet_ip -p tcp --dport 22 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 23:24 -j DROP

$ipt -t filter -A INPUT -p udp --dport 21:52 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 26:52 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 54:66 -j DROP

$ipt -t filter -A INPUT -p udp --dport 54:66 -j DROP

$ipt -t filter -A INPUT -i $inet_iface -p tcp --dport 67 -j DROP

$ipt -t filter -A INPUT -i $inet_iface -p udp --dport 67:69 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 68:79 -j DROP

$ipt -t filter -A INPUT -p udp --dport 70:79 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 81:109 -j DROP

$ipt -t filter -A INPUT -p udp --dport 81:109 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 112 -j DROP

$ipt -t filter -A INPUT -p udp --dport 112 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 114:138 -j DROP

$ipt -t filter -A INPUT -p udp --dport 114:122 -j DROP

$ipt -t filter -A INPUT -p udp --dport 124:136 -j DROP

$ipt -t filter -A INPUT -i $inet_iface -p udp --dport 137:138 -j DROP

$ipt -t filter -A INPUT -i $inet_iface -p tcp --dport 139 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 140:142 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 144:442 -j DROP

$ipt -t filter -A INPUT -p udp --dport 139:442 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 444 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 446:1722 -j DROP

$ipt -t filter -A INPUT -p udp --dport 444:1193 -j DROP

$ipt -t filter -A INPUT -p udp --dport 1195:1862 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 1724:1862 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 31790 -j DROP

$ipt -t filter -A INPUT -p udp --dport 31790 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 31789 -j DROP

$ipt -t filter -A INPUT -p udp --dport 31789 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 31340 -j DROP

$ipt -t filter -A INPUT -p udp --dport 31340 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 31339 -j DROP

$ipt -t filter -A INPUT -p udp --dport 31339 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 31338 -j DROP

$ipt -t filter -A INPUT -p udp --dport 31338 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 31337 -j DROP

$ipt -t filter -A INPUT -p udp --dport 31337 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 31335 -j DROP

$ipt -t filter -A INPUT -p udp --dport 31335 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 30100 -j DROP

$ipt -t filter -A INPUT -p udp --dport 30100 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 27665 -j DROP

$ipt -t filter -A INPUT -p udp --dport 27665 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 27444 -j DROP

$ipt -t filter -A INPUT -p udp --dport 27444 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 27374 -j DROP

$ipt -t filter -A INPUT -p udp --dport 27374 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 23445 -j DROP

$ipt -t filter -A INPUT -p udp --dport 23445 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 23444 -j DROP

$ipt -t filter -A INPUT -p udp --dport 23444 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 19191 -j DROP

$ipt -t filter -A INPUT -p udp --dport 19191 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 14704 -j DROP

$ipt -t filter -A INPUT -p udp --dport 14704 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 10000 -j DROP

$ipt -t filter -A INPUT -p udp --dport 10000 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 9704 -j DROP

$ipt -t filter -A INPUT -p udp --dport 9704 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 9393 -j DROP

$ipt -t filter -A INPUT -p udp --dport 9393 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 8102 -j DROP

$ipt -t filter -A INPUT -p udp --dport 8102 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 8011 -j DROP

$ipt -t filter -A INPUT -p udp --dport 8011 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 7626 -j DROP

$ipt -t filter -A INPUT -p udp --dport 7626 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 7306 -j DROP

$ipt -t filter -A INPUT -p udp --dport 7306 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 6667 -j DROP

$ipt -t filter -A INPUT -p udp --dport 6667 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 6346 -j DROP

$ipt -t filter -A INPUT -p udp --dport 6346 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 6267 -j DROP

$ipt -t filter -A INPUT -p udp --dport 6267 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 6129 -j DROP

$ipt -t filter -A INPUT -p udp --dport 6129 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 6000 -j DROP

$ipt -t filter -A INPUT -p udp --dport 6000 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 5900 -j DROP

$ipt -t filter -A INPUT -p udp --dport 5900 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 5800 -j DROP

$ipt -t filter -A INPUT -p udp --dport 5800 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 5554 -j DROP

$ipt -t filter -A INPUT -p udp --dport 5554 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 5400 -j DROP

$ipt -t filter -A INPUT -p udp --dport 5400 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 5168 -j DROP

$ipt -t filter -A INPUT -p udp --dport 5168 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 5100 -j DROP

$ipt -t filter -A INPUT -p udp --dport 5100 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 5000 -j DROP

$ipt -t filter -A INPUT -p udp --dport 5000 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 4500 -j DROP

$ipt -t filter -A INPUT -p udp --dport 4500 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 4444 -j DROP

$ipt -t filter -A INPUT -p udp --dport 4444 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 3389 -j DROP

$ipt -t filter -A INPUT -p udp --dport 3389 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 3306 -j DROP

$ipt -t filter -A INPUT -p udp --dport 3306 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 3150 -j DROP

$ipt -t filter -A INPUT -p udp --dport 3150 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 3127 -j DROP

$ipt -t filter -A INPUT -p udp --dport 3127 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 3000 -j DROP

$ipt -t filter -A INPUT -p udp --dport 3000 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 2989 -j DROP

$ipt -t filter -A INPUT -p udp --dport 2989 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 2869 -j DROP

$ipt -t filter -A INPUT -p udp --dport 2869 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 2500 -j DROP

$ipt -t filter -A INPUT -p udp --dport 2500 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 2475 -j DROP

$ipt -t filter -A INPUT -p udp --dport 2475 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 2140 -j DROP

$ipt -t filter -A INPUT -p udp --dport 2140 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 2115 -j DROP

$ipt -t filter -A INPUT -p udp --dport 2115 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 2023 -j DROP

$ipt -t filter -A INPUT -p udp --dport 2023 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 2012 -j DROP

$ipt -t filter -A INPUT -p udp --dport 2012 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 2001 -j DROP

$ipt -t filter -A INPUT -p udp --dport 2001 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 2000 -j DROP

$ipt -t filter -A INPUT -p udp --dport 2000 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 1981 -j DROP

$ipt -t filter -A INPUT -p udp --dport 1981 -j DROP

$ipt -t filter -A INPUT -p tcp --dport 1900 -j DROP

$ipt -t filter -A INPUT -p udp --dport 1900 -j DROP

$ipt -t filter -A INPUT -p icmp -m icmp --icmp-type echo-request -j DROP

$ipt -t filter -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

$ipt -t filter -A INPUT -p icmp --icmp-type any -m limit --limit 1/sec --limit-burst 10 -j ACCEPT

$ipt -t filter -A INPUT -f -m limit --limit 150/sec --limit-burst 150 -j ACCEPT

$ipt -t filter -A INPUT ! -i lo -m state --state NEW,INVALID -j LOG --log-prefix "iniptables:"

$ipt -t filter -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

$ipt -t filter -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

$ipt -t filter -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

$ipt -t filter -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$ipt -t filter -A INPUT -i $inet_iface -m state --state ESTABLISHED,RELATED -j ACCEPT

$ipt -t filter -A INPUT -i $lan_iface -m state --state ESTABLISHED,RELATED -j ACCEPT

$ipt -t filter -A INPUT -i virbr0 -m state --state ESTABLISHED,RELATED -j ACCEPT

$ipt -t filter -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

$ipt -t filter -A INPUT -i lo -j ACCEPT

$ipt -t filter -A INPUT -s $lan_ip_range -i $lan_iface -m state --state NEW -m udp -p udp --dport domain -j ACCEPT

$ipt -t filter -A INPUT -s $lan_ip_range -i $lan_iface -m state --state NEW -m tcp -p tcp --dport domain -j ACCEPT

$ipt -t filter -A INPUT -s $dns1 -i $inet_iface -m state --state NEW -m udp -p udp --sport domain -j ACCEPT

$ipt -t filter -A INPUT -s $dns1 -i $inet_iface -m state --state NEW -m tcp -p tcp --sport domain -j ACCEPT

$ipt -t filter -A INPUT -s $dns2 -i $inet_iface -m state --state NEW -m udp -p udp --sport domain -j ACCEPT

$ipt -t filter -A INPUT -s $dns2 -i $inet_iface -m state --state NEW -m tcp -p tcp --sport domain -j ACCEPT

$ipt -t filter -A INPUT -p udp --dport domain ! -s $dns1 -i $inet_iface -j DROP

$ipt -t filter -A INPUT -p tcp --dport domain ! -s $dns1 -i $inet_iface -j DROP

$ipt -t filter -A INPUT -p udp --dport domain ! -s $dns2 -i $inet_iface -j DROP

$ipt -t filter -A INPUT -p tcp --dport domain ! -s $dns2 -i $inet_iface -j DROP

$ipt -t filter -N LOGJOIN

$ipt -t filter -A INPUT -s $lan_ip_range -i $lan_iface -m state --state NEW -m tcp -p tcp --dport 22 -j LOGJOIN

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i virbr0 -m state --state NEW -m tcp -p tcp --dport 22 -j LOGJOIN

$ipt -t filter -A LOGJOIN -j LOG --log-prefix "iptenter:"

$ipt -t filter -A LOGJOIN -j ACCEPT

$ipt -t filter -A INPUT -i $lan_iface -p udp --dport 67 -j ACCEPT

$ipt -t filter -A INPUT -i $lan_iface -p tcp --dport 67 -j ACCEPT

$ipt -t filter -A INPUT -i $inet_iface -p tcp -m multiport --dports 5989,1863,1723,995,993,443,143,113,111,110,80,25,21,20 -j ACCEPT

$ipt -t filter -A INPUT -i $inet_iface -p udp -m multiport --dports 1863,1194,443,113,111,110,80,20 -j ACCEPT

$ipt -t filter -A INPUT -s $lan_ip_range -i $lan_iface -p ah -j ACCEPT

$ipt -t filter -A INPUT -s $lan_ip_range -i $lan_iface -p esp -j ACCEPT

$ipt -t filter -A INPUT -s $lan_ip_range -i $lan_iface -p tcp -m multiport --dports 1863,1723,995,993,445,443,143,139,113,111,110,80,25,21,20 -j ACCEPT

$ipt -t filter -A INPUT -s $lan_ip_range -i $lan_iface -p tcp -m multiport --dports 21064,11111,6160,5989,2049 -j ACCEPT

$ipt -t filter -A INPUT -s $lan_ip_range -i $lan_iface -p udp -m multiport --dports 5405,5404,1863,1194,500,443,138,137,123,113,111,110,80,69,20 -j ACCEPT

$ipt -t filter -A INPUT -p udp -s $ntp -i $inet_iface --dport 123 -j ACCEPT

$ipt -t filter -A INPUT -i $inet_iface -p gre -j ACCEPT

$ipt -t filter -A INPUT -s $lan_ip_range -i $lan_iface -p gre -j ACCEPT

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i virbr0 -p gre -j ACCEPT

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i virbr0 -p ah -j ACCEPT

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i virbr0 -p esp -j ACCEPT

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i virbr0 -p tcp -m multiport --dports 1863,1723,995,993,445,443,143,139,113,111,110,80,25,21,20 -j ACCEPT

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i virbr0 -p tcp -m multiport --dports 21064,11111,6160,5989,2049 -j ACCEPT

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i virbr0 -p udp -m multiport --dports 1863,1194,500,443,138,137,123,113,111,110,80,69,20 -j ACCEPT

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i virbr0 -p udp -m multiport --dports 5405,5404 -j ACCEPT

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i virbr0 -m state --state NEW -m udp -p udp --dport domain -j ACCEPT

$ipt -t filter -A INPUT -s 192.168.122.0/24 -i virbr0 -m state --state NEW -m tcp -p tcp --dport domain -j ACCEPT

$ipt -t filter -A INPUT -i virbr0 -p udp --dport 67 -j ACCEPT

$ipt -t filter -A INPUT -i virbr0 -p tcp --dport 67 -j ACCEPT

$ipt -t filter -A INPUT -p icmp --icmp-type any -j ACCEPT

$ipt -t filter -A INPUT -p tcp -j REJECT --reject-with tcp-reset

$ipt -t filter -A INPUT -j REJECT --reject-with icmp-port-unreachable

$ipt -t filter -A INPUT -j DROP

$ipt -t filter -A FORWARD -s $lan_ip_range -i $inet_iface -j DROP

$ipt -t filter -A FORWARD -s 192.168.122.0/24 -i $inet_iface -j DROP

$ipt -t filter -A FORWARD -s 192.168.0.0/16 -i $inet_iface -j DROP

$ipt -t filter -A FORWARD -s 10.0.0.0/8 -i $inet_iface -j DROP

$ipt -t filter -A FORWARD -s 172.16.0.0/16 -i $inet_iface -j DROP

$ipt -t filter -A FORWARD -s 127.0.0.0/8 -i $inet_iface -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 0:19 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 0:19 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 22:24 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 21:79 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 26:79 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 81:109 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 81:109 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 112 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 112 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 114:138 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 140:142 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 114:442 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 144:442 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 444 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 446:1001 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 444:1001 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 31790 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 31790 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 31789 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 31789 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 31340 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 31340 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 31339 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 31339 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 31338 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 31338 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 31337 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 31337 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 31335 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 31335 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 30100 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 30100 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 27665 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 27665 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 27444 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 27444 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 27374 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 27374 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 23445 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 23445 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 23444 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 23444 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 19191 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 19191 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 14704 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 14704 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 10000 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 10000 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 9704 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 9704 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 9393 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 9393 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 8102 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 8102 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 8011 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 8011 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 7626 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 7626 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 7306 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 7306 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 6667 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 6667 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 6346 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 6346 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 6267 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 6267 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 6129 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 6129 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 6000 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 6000 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 5900 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 5900 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 5800 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 5800 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 5554 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 5554 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 5400 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 5400 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 5168 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 5168 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 5100 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 5100 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 5000 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 5000 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 4500 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 4500 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 4444 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 4444 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 3389 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 3389 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 3306 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 3306 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 3150 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 3150 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 3127 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 3127 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 3000 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 3000 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 2989 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 2989 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 2869 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 2869 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 2500 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 2500 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 2475 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 2475 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 2140 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 2140 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 2115 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 2115 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 2023 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 2023 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 2012 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 2012 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 2001 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 2001 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 2000 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 2000 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1981 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1981 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1900 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1900 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1807 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1807 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1600 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1600 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1524 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1524 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1492 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1492 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1444 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1444 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1443 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1443 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1434 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1434 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1349 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1349 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1245 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1245 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1243 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1243 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1234 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1234 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1099 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1099 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1098 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1098 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1097 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1097 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1095 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1095 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1090 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1090 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1080 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1080 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1057 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1057 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1053 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1053 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1051 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1051 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1045 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1045 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1042 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1042 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1025 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1025 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1024 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1024 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1015 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1015 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1012 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1012 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1011 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1011 -j DROP

$ipt -t filter -A FORWARD -p tcp --dport 1010 -j DROP

$ipt -t filter -A FORWARD -p udp --dport 1010 -j DROP

$ipt -t filter -A FORWARD -p icmp -m icmp --icmp-type echo-request -j DROP

$ipt -t filter -A FORWARD -p icmp -m icmp --icmp-type echo-reply -j DROP

$ipt -t filter -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

$ipt -t filter -A FORWARD -p icmp --icmp-type any -m limit --limit 1/sec --limit-burst 10 -j ACCEPT

$ipt -t filter -A FORWARD -f -m limit --limit 150/sec --limit-burst 150 -j ACCEPT

$ipt -t filter -A FORWARD ! -i lo -m state --state NEW,INVALID -j LOG --log-prefix "foriptables:"

$ipt -t filter -A FORWARD -p tcp --tcp-flags ALL ALL -j DROP

$ipt -t filter -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP

$ipt -t filter -A FORWARD -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

$ipt -t filter -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$ipt -t filter -A FORWARD -i $inet_iface -o $lan_iface -d $lan_ip_range -m state --state RELATED,ESTABLISHED -j ACCEPT

$ipt -t filter -A FORWARD -i $inet_iface -o virbr0 -d 192.168.122.0/24 -m state --state RELATED,ESTABLISHED -j ACCEPT

$ipt -t filter -A FORWARD -i $lan_iface -o virbr0 -d 192.168.122.0/24 -m state --state RELATED,ESTABLISHED -j ACCEPT

$ipt -t filter -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP

$ipt -t filter -A FORWARD -s $lan_ip_range -i $lan_iface -o virbr0 -p tcp -j ACCEPT

$ipt -t filter -A FORWARD -i virbr0 -o $lan_iface -d $lan_ip_range -p tcp -j ACCEPT

$ipt -t filter -A FORWARD -s $lan_ip_range -i $lan_iface -o virbr0 -p udp -j ACCEPT

$ipt -t filter -A FORWARD -i virbr0 -o $lan_iface -d $lan_ip_range -p udp -j ACCEPT

$ipt -t filter -A FORWARD -s $lan_ip_range -i $lan_iface -o $inet_iface -p tcp -m multiport --dports 8000,1863,1723,995,993,445,443,139,113,111,110,80,25,21,20 -j ACCEPT

$ipt -t filter -A FORWARD -i $inet_iface -o $lan_iface -d $lan_ip_range -p tcp -m multiport --dports 8000,1863,1723,995,993,445,443,139,113,111,110,80,25,21,20 -j ACCEPT

$ipt -t filter -A FORWARD -s $lan_ip_range -i $lan_iface -o $inet_iface -p udp -m multiport --dports 8000,1863,1194,443,113,111,110,80,21,20 -j ACCEPT

$ipt -t filter -A FORWARD -i $inet_iface -o $lan_iface -d $lan_ip_range -p udp -m multiport --dports 8000,1863,1194,443,113,111,110,80,21,20 -j ACCEPT

$ipt -t filter -A FORWARD -p gre -i $inet_iface -o $lan_iface -d $lan_ip_range -j ACCEPT

$ipt -t filter -A FORWARD -p gre -s $lan_ip_range -i $lan_iface -o $inet_iface -j ACCEPT

$ipt -t filter -A FORWARD -p udp -i $inet_iface -o $lan_iface -d $lan_ip_range -j ACCEPT

$ipt -t filter -A FORWARD -i $inet_iface -o virbr0 -d 192.168.122.0/24 -p tcp -m multiport --dports 8000,1863,1723,445,443,139,113,111,110,80,25,21,20 -j ACCEPT

$ipt -t filter -A FORWARD -s 192.168.122.0/24 -i virbr0 -o $inet_iface -p tcp -m multiport --dports 8000,1863,1723,445,443,139,113,111,110,80,25,21,20 -j ACCEPT

$ipt -t filter -A FORWARD -i $inet_iface -o virbr0 -d 192.168.122.0/24 -p udp -m multiport --dports 8000,1863,1194,443,113,111,110,80,21,20 -j ACCEPT

$ipt -t filter -A FORWARD -s 192.168.122.0/24 -i virbr0 -o $inet_iface -p udp -m multiport --dports 8000,1863,1194,443,113,111,110,80,21,20 -j ACCEPT

$ipt -t filter -A FORWARD -p gre -i $inet_iface -o virbr0 -d 192.168.122.0/24 -j ACCEPT

$ipt -t filter -A FORWARD -p gre -s 192.168.122.0/24 -i virbr0 -o $inet_iface -j ACCEPT

$ipt -t filter -A FORWARD -p udp -i $inet_iface -o virbr0 -d 192.168.122.0/24 -j ACCEPT

$ipt -t filter -A FORWARD -p icmp --icmp-type any -j ACCEPT

$ipt -t filter -A FORWARD -p tcp -j REJECT --reject-with tcp-reset

$ipt -t filter -A FORWARD -j REJECT --reject-with icmp-port-unreachable

$ipt -t filter -A FORWARD -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 0:19 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 0:19 -j DROP

$ipt -t filter -A OUTPUT -o $inet_iface -p tcp --sport 22 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 23:24 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 22:52 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 26:52 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 54:66 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 54:66 -j DROP

$ipt -t filter -A OUTPUT -o $inet_iface -p tcp --sport 67 -j DROP

$ipt -t filter -A OUTPUT -o $inet_iface -p udp --sport 67:68 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 68:79 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 70:79 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 81:109 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 81:109 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 112 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 112 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 114:122 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 114:138 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 140:142 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 144:442 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 124:442 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 444 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 446:1001 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 444:1001 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 31790 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 31790 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 31789 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 31789 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 31340 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 31340 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 31339 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 31339 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 31338 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 31338 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 31337 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 31337 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 31335 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 31335 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 30100 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 30100 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 27665 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 27665 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 27444 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 27444 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 27374 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 27374 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 23445 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 23445 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 23444 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 23444 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 19191 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 19191 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 14704 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 14704 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 10000 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 10000 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 9704 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 9704 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 9393 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 9393 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 8102 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 8102 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 8011 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 8011 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 7626 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 7626 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 7306 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 7306 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 6667 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 6667 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 6346 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 6346 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 6267 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 6267 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 6129 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 6129 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 6000 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 6000 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 5900 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 5900 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 5800 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 5800 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 5554 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 5554 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 5400 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 5400 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 5168 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 5168 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 5100 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 5100 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 5000 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 5000 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 4500 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 4500 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 4444 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 4444 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 3389 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 3389 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 3306 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 3306 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 3150 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 3150 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 3127 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 3127 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 3000 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 3000 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 2989 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 2989 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 2869 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 2869 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 2500 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 2500 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 2475 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 2475 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 2140 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 2140 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 2115 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 2115 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 2023 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 2023 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 2012 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 2012 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 2001 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 2001 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 2000 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 2000 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1981 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1981 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1900 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1900 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1807 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1807 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1600 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1600 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1524 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1524 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1492 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1492 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1444 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1444 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1443 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1443 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1434 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1434 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1349 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1349 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1245 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1245 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1243 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1243 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1234 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1234 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1099 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1099 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1098 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1098 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1097 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1097 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1095 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1095 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1090 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1090 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1080 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1080 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1057 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1057 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1053 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1053 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1051 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1051 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1045 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1045 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1042 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1042 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1025 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1025 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1024 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1024 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1015 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1015 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1012 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1012 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1011 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1011 -j DROP

$ipt -t filter -A OUTPUT -p tcp --sport 1010 -j DROP

$ipt -t filter -A OUTPUT -p udp --sport 1010 -j DROP

$ipt -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -j DROP

$ipt -t filter -A OUTPUT -p icmp --icmp-type any -m limit --limit 1/sec --limit-burst 10 -j ACCEPT

$ipt -t filter -A OUTPUT -o lo -j ACCEPT

$ipt -t filter -A OUTPUT -p tcp -m multiport --dports 5989,1863,1723,995,993,443,143,113,111,110,80,25,21,20 -j ACCEPT

$ipt -t filter -A OUTPUT -p udp -m multiport --dports 1863,1194,443,123,113,111,110,80,21,20 -j ACCEPT

$ipt -t filter -A OUTPUT -p tcp --sport domain -j ACCEPT

$ipt -t filter -A OUTPUT -p udp --sport domain -j ACCEPT

$ipt -t filter -A OUTPUT -o $lan_iface -p ah -j ACCEPT

$ipt -t filter -A OUTPUT -o $lan_iface -p esp -j ACCEPT

$ipt -t filter -A OUTPUT -o virbr0 -p ah -j ACCEPT

$ipt -t filter -A OUTPUT -o virbr0 -p esp -j ACCEPT

$ipt -t filter -A OUTPUT -o $lan_iface -p tcp -m multiport --dports 21064,11111,6160,2049,445,139,67,22 -j ACCEPT

$ipt -t filter -A OUTPUT -o $lan_iface -p udp -m multiport --dports 5405,5404,500,69,68,67 -j ACCEPT

$ipt -t filter -A OUTPUT -o virbr0 -p tcp -m multiport --dports 21064,11111,6160,2049,445,139,67,22 -j ACCEPT

$ipt -t filter -A OUTPUT -o virbr0 -p udp -m multiport --dports 5405,5404,500,69,68,67 -j ACCEPT

$ipt -t filter -A OUTPUT -o $inet_iface -p gre -j ACCEPT

$ipt -t filter -A OUTPUT -d $lan_ip_range -o $lan_iface -p gre -j ACCEPT

$ipt -t filter -A OUTPUT -d 192.168.122.0/24 -o virbr0 -p gre -j ACCEPT

$ipt -t filter -A OUTPUT -p icmp --icmp-type any -j ACCEPT

if [ "$inet_iface" = ppp0 ] ; then

$ipt -t nat -A POSTROUTING -o $inet_iface -j MASQUERADE

else

$ipt -t nat -A POSTROUTING -o $inet_iface -j SNAT --to $inet_ip

fi

$ip6t -P INPUT DROP

$ip6t -P FORWARD DROP

$ip6t -P OUTPUT ACCEPT

for TABLE in filter mangle ; do

$ip6t -t $TABLE -F

$ip6t -t $TABLE -X

done

$ip6t -t filter -A INPUT -p udp -i $lan_iface --dport 67 --sport 68 -j DROP

$ip6t -t filter -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-request -j DROP

$ip6t -t filter -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

$ip6t -t filter -A INPUT -p icmpv6 -m limit --limit 1/sec --limit-burst 10 -j ACCEPT

$ip6t -t filter -A INPUT -m limit --limit 150/sec --limit-burst 150 -j ACCEPT

$ip6t -t filter -A INPUT ! -i lo -m state --state NEW,INVALID -j LOG --log-prefix "inip6tables:"

$ip6t -t filter -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

$ip6t -t filter -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

$ip6t -t filter -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

$ip6t -t filter -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$ip6t -t filter -A INPUT -i $inet_iface -m state --state ESTABLISHED,RELATED -j ACCEPT

$ip6t -t filter -A INPUT -i $lan_iface -m state --state ESTABLISHED,RELATED -j ACCEPT

$ip6t -t filter -A INPUT -i virbr0 -m state --state ESTABLISHED,RELATED -j ACCEPT

$ip6t -t filter -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

$ip6t -t filter -A INPUT -i lo -j ACCEPT

$ip6t -t filter -A INPUT -i $lan_iface -m state --state NEW -m udp -p udp --dport domain -j ACCEPT

$ip6t -t filter -A INPUT -i $lan_iface -m state --state NEW -m tcp -p tcp --dport domain -j ACCEPT

$ip6t -t filter -A INPUT -i $inet_iface -m state --state NEW -m udp -p udp --sport domain -j ACCEPT

$ip6t -t filter -A INPUT -i $inet_iface -m state --state NEW -m tcp -p tcp --sport domain -j ACCEPT

$ip6t -t filter -N ip6LOGJOIN

$ip6t -t filter -A INPUT -i $lan_iface -m state --state NEW -m tcp -p tcp --dport 22 -j ip6LOGJOIN

$ip6t -t filter -A INPUT -i virbr0 -m state --state NEW -m tcp -p tcp --dport 22 -j ip6LOGJOIN

$ip6t -t filter -A ip6LOGJOIN -j LOG --log-prefix "ip6tenter:"

$ip6t -t filter -A ip6LOGJOIN -j ACCEPT

$ip6t -t filter -A INPUT -i $lan_iface -p udp --dport 67 -j ACCEPT

$ip6t -t filter -A INPUT -i $lan_iface -p tcp --dport 67 -j ACCEPT

$ip6t -t filter -A INPUT -i $inet_iface -p tcp -m multiport --dports 5989,1863,1723,995,993,443,143,113,111,110,80,25,21,20 -j ACCEPT

$ip6t -t filter -A INPUT -i $inet_iface -p udp -m multiport --dports 1863,1194,443,113,111,110,80,20 -j ACCEPT

$ip6t -t filter -A INPUT -i $inet_iface -p gre -j ACCEPT

$ip6t -t filter -A INPUT -i $lan_iface -p tcp -m multiport --dports 1863,1723,995,993,445,443,143,139,113,111,110,80,25,21,20 -j ACCEPT

$ip6t -t filter -A INPUT -i $lan_iface -p tcp -m multiport --dports 21064,11111,6160,5989,2049 -j ACCEPT

$ip6t -t filter -A INPUT -i $lan_iface -p udp -m multiport --dports 5405,5404,1863,1194,500,443,138,137,123,113,111,110,80,69,20 -j ACCEPT

$ip6t -t filter -A INPUT -i $lan_iface -p gre -j ACCEPT

$ip6t -t filter -A INPUT -i virbr0 -p gre -j ACCEPT

$ip6t -t filter -A INPUT -i virbr0 -p tcp -m multiport --dports 1863,1723,995,993,445,443,143,139,113,111,110,80,25,21,20 -j ACCEPT

$ip6t -t filter -A INPUT -i virbr0 -p tcp -m multiport --dports 21064,11111,6160,5989,2049 -j ACCEPT

$ip6t -t filter -A INPUT -i virbr0 -p udp -m multiport --dports 5405,5404,1863,1194,500,443,138,137,123,113,111,110,80,69,20 -j ACCEPT

$ip6t -t filter -A INPUT -i virbr0 -m state --state NEW -m udp -p udp --dport domain -j ACCEPT

$ip6t -t filter -A INPUT -i virbr0 -m state --state NEW -m tcp -p tcp --dport domain -j ACCEPT

$ip6t -t filter -A INPUT -i virbr0 -p udp --dport 67 -j ACCEPT

$ip6t -t filter -A INPUT -i virbr0 -p tcp --dport 67 -j ACCEPT

$ip6t -t filter -A INPUT -p icmpv6 -j ACCEPT

$ip6t -t filter -A INPUT -p tcp -j REJECT --reject-with tcp-reset

$ip6t -t filter -A INPUT -j REJECT --reject-with icmp6-port-unreachable

$ip6t -t filter -A INPUT -j DROP

$ip6t -t filter -A FORWARD -p icmpv6 -m icmpv6 --icmpv6-type echo-request -j DROP

$ip6t -t filter -A FORWARD -p icmpv6 -m icmpv6 --icmpv6-type echo-reply -j DROP

$ip6t -t filter -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

$ip6t -t filter -A FORWARD -p icmpv6 -m limit --limit 1/sec --limit-burst 10 -j ACCEPT

$ip6t -t filter -A FORWARD -m limit --limit 150/sec --limit-burst 150 -j ACCEPT

$ip6t -t filter -A FORWARD ! -i lo -m state --state NEW,INVALID -j LOG --log-prefix "forip6tables:"

$ip6t -t filter -A FORWARD -p tcp --tcp-flags ALL ALL -j DROP

$ip6t -t filter -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP

$ip6t -t filter -A FORWARD -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

$ip6t -t filter -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$ip6t -t filter -A FORWARD -i $inet_iface -o $lan_iface -m state --state RELATED,ESTABLISHED -j ACCEPT

$ip6t -t filter -A FORWARD -i $inet_iface -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT

$ip6t -t filter -A FORWARD -i $lan_iface -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT

$ip6t -t filter -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP

$ip6t -t filter -A FORWARD -i $lan_iface -o virbr0 -p tcp -j ACCEPT

$ip6t -t filter -A FORWARD -i $lan_iface -o virbr0 -p udp -j ACCEPT

$ip6t -t filter -A FORWARD -i virbr0 -o $lan_iface -p tcp -j ACCEPT

$ip6t -t filter -A FORWARD -i virbr0 -o $lan_iface -p udp -j ACCEPT

$ip6t -t filter -A FORWARD -i $lan_iface -o $inet_iface -p tcp -m multiport --dports 8000,1863,1723,995,993,445,443,139,113,111,110,80,25,21,20 -j ACCEPT

$ip6t -t filter -A FORWARD -i $inet_iface -o $lan_iface -p tcp -m multiport --dports 8000,1863,1723,995,993,445,443,139,113,111,110,80,25,21,20 -j ACCEPT

$ip6t -t filter -A FORWARD -i $lan_iface -o $inet_iface -p udp -m multiport --dports 8000,1863,1194,443,113,111,110,80,21,20 -j ACCEPT

$ip6t -t filter -A FORWARD -i $inet_iface -o $lan_iface -p udp -m multiport --dports 8000,1863,1194,443,113,111,110,80,21,20 -j ACCEPT

$ip6t -t filter -A FORWARD -p gre -i $inet_iface -o $lan_iface -j ACCEPT

$ip6t -t filter -A FORWARD -p gre -i $lan_iface -o $inet_iface -j ACCEPT

$ip6t -t filter -A FORWARD -i $inet_iface -o virbr0 -p tcp -m multiport --dports 8000,1863,1723,445,443,139,113,111,110,80,25,21,20 -j ACCEPT

$ip6t -t filter -A FORWARD -i virbr0 -o $inet_iface -p tcp -m multiport --dports 8000,1863,1723,445,443,139,113,111,110,80,25,21,20 -j ACCEPT

$ip6t -t filter -A FORWARD -i $inet_iface -o virbr0 -p udp -m multiport --dports 8000,1863,1194,443,113,111,110,80,21,20 -j ACCEPT

$ip6t -t filter -A FORWARD -i virbr0 -o $inet_iface -p udp -m multiport --dports 8000,1863,1194,443,113,111,110,80,21,20 -j ACCEPT

$ip6t -t filter -A FORWARD -p gre -i $inet_iface -o virbr0 -j ACCEPT

$ip6t -t filter -A FORWARD -p gre -i virbr0 -o $inet_iface -j ACCEPT

$ip6t -t filter -A FORWARD -p icmpv6 -j ACCEPT

$ip6t -t filter -A FORWARD -p tcp -j REJECT --reject-with tcp-reset

$ip6t -t filter -A FORWARD -j REJECT --reject-with icmp6-port-unreachable

$ip6t -t filter -A FORWARD -j DROP

$ip6t -t filter -A OUTPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-reply -j DROP

$ip6t -t filter -A OUTPUT -p icmpv6 -m limit --limit 1/sec --limit-burst 10 -j ACCEPT

$ip6t -t filter -A OUTPUT -o lo -j ACCEPT

$ip6t -t filter -A OUTPUT -p tcp -m multiport --dports 5989,1863,1723,995,993,443,143,113,111,110,80,25,21,20 -j ACCEPT

$ip6t -t filter -A OUTPUT -p udp -m multiport --dports 1863,1194,443,123,113,111,110,80,21,20 -j ACCEPT

$ip6t -t filter -A OUTPUT -p tcp --sport domain -j ACCEPT

$ip6t -t filter -A OUTPUT -p udp --sport domain -j ACCEPT

$ip6t -t filter -A OUTPUT -o $lan_iface -p tcp -m multiport --dports 21064,11111,6160,2049,445,139,67,22 -j ACCEPT

$ip6t -t filter -A OUTPUT -o $lan_iface -p udp -m multiport --dports 5405,5404,500,69,68,67 -j ACCEPT

$ip6t -t filter -A OUTPUT -o virbr0 -p tcp -m multiport --dports 21064,11111,6160,2049,445,139,67,22 -j ACCEPT

$ip6t -t filter -A OUTPUT -o virbr0 -p udp -m multiport --dports 5405,5404,500,69,68,67 -j ACCEPT

$ip6t -t filter -A OUTPUT -o $inet_iface -p gre -j ACCEPT

$ip6t -t filter -A OUTPUT -o $lan_iface -p gre -j ACCEPT

$ip6t -t filter -A OUTPUT -o virbr0 -p gre -j ACCEPT

$ip6t -t filter -A OUTPUT -p icmpv6 -j ACCEPT

$ipt -t filter -I FORWARD -i $inet_iface -o virbr0 -p tcp -j ACCEPT

$ipt -t filter -I FORWARD -i virbr0 -o $inet_iface -p tcp -j ACCEPT

$ipt -t filter -I FORWARD -i $inet_iface -o virbr0 -p udp -j ACCEPT

$ipt -t filter -I FORWARD -i virbr0 -o $inet_iface -p udp -j ACCEPT

$ipt -t nat -I PREROUTING -p tcp -d $inet_ip --dport 80 -j DNAT --to 192.168.122.192:80

$ipt -t nat -I PREROUTING -p udp -d $inet_ip --dport 80 -j DNAT --to 192.168.122.192:80

$ipt -t nat -I PREROUTING -p tcp -d $lan_ip --dport 80 -j DNAT --to 192.168.122.192:80

$ipt -t nat -I PREROUTING -p udp -d $lan_ip --dport 80 -j DNAT --to 192.168.122.192:80

保存防火墙配置runing snort.sh

service iptables save

service ip6tables save

或者

/etc/init.d/iptables save

/etc/init.d/ip6tables save

可以在/var/log/messages文件中查看记录信息。

在/etc/crontab中加入如下信息：

# iptables reload（每隔30分钟运行一次防火墙配置）

*/30 * * * * root /etc/rc.d/snort.sh

现实中必须使用service iptables restart且service ip6tables restart

更改自启动firewall+[IDS]