1293.html

著名的linux英雄站点的文档打包

<br>
# See how we were called.<br>
case "$1" in<br>
start)<br>
echo -n "Starting Firewalling Services: "<br>
<br>
# Some definitions for easy maintenance.<br>
<br>
# ----------------------------------------------------------------------------<br>
# EDIT THESE TO SUIT YOUR SYSTEM AND ISP.<br>
<br>
EXTERNAL_INTERFACE="eth0" # Internet connected interface<br>
LOOPBACK_INTERFACE="lo" # Your local naming convention<br>
IPADDR="my.ip.address" # Your IP address<br>
ANYWHERE="any/0" # Match any IP address<br>
NAMESERVER_1="my.name.server.1" # Everyone must have at least one<br>
NAMESERVER_2="my.name.server.2" # Your secondary name server<br>
MY_ISP="my.isp.address.range/24" # ISP NOC address range<br>
<br>
SMTP_SERVER="my.smtp.server" # Your Mail Hub Server.<br>
SYSLOG_SERVER="syslog.internal.server" # Your syslog internal server<br>
SYSLOG_CLIENT="sys.int.client.range/24" # Your syslog internal client range<br>
<br>
LOOPBACK="127.0.0.0/8" # Reserved loopback address range<br>
CLASS_A="10.0.0.0/8" # Class A private networks<br>
CLASS_B="172.16.0.0/12" # Class B private networks<br>
CLASS_C="192.168.0.0/16" # Class C private networks<br>
CLASS_D_MULTICAST="224.0.0.0/4" # Class D multicast addresses<br>
CLASS_E_RESERVED_NET="240.0.0.0/5" # Class E reserved addresses<br>
BROADCAST_SRC="0.0.0.0" # Broadcast source address<br>
BROADCAST_DEST="255.255.255.255" # Broadcast destination address<br>
PRIVPORTS="0:1023" # Well known, privileged port range<br>
UNPRIVPORTS="1024:65535" # Unprivileged port range<br>
<br>
# ----------------------------------------------------------------------------<br>
<br>
# SSH starts at 1023 and works down to 513 for<br>
# each additional simultaneous incoming connection.<br>
SSH_PORTS="1022:1023" # range for SSH privileged ports<br>
<br>
# traceroute usually uses -S 32769:65535 -D 33434:33523<br>
TRACEROUTE_SRC_PORTS="32769:65535"<br>
TRACEROUTE_DEST_PORTS="33434:33523"<br>
<br>
# ----------------------------------------------------------------------------<br>
# Default policy is DENY<br>
# Explicitly accept desired INCOMING OUTGOING connections<br>
<br>
# Remove all existing rules belonging to this filter<br>
ipchains -F<br>
<br>
# Clearing all current rules and user defined chains<br>
ipchains -X<br>
<br>
# Set the default policy of the filter to deny.<br>
# Don't even bother sending an error message back.<br>
ipchains -P input DENY<br>
ipchains -P output DENY<br>
ipchains -P forward DENY<br>
<br>
# ----------------------------------------------------------------------------<br>
# LOOPBACK<br>
<br>
# Unlimited traffic on the loopback interface.<br>
ipchains -A input -i $LOOPBACK_INTERFACE -j ACCEPT<br>
ipchains -A output -i $LOOPBACK_INTERFACE -j ACCEPT<br>
<br>
# ----------------------------------------------------------------------------<br>
# Network Ghouls<br>
# Deny access to jerks<br>
<br>
# /etc/rc.d/rc.firewall.blocked contains a list of<br>
# ipchains -A input -i $EXTERNAL_INTERFACE -s address -j DENY<br>
# rules to block from any access.<br>
<br>
# Refuse any connection from problem sites<br>
#if [ -f /etc/rc.d/rc.firewall.blocked ]; then<br>
# . /etc/rc.d/rc.firewall.blocked<br>
#fi<br>
<br>
# ----------------------------------------------------------------------------<br>
# SPOOFING BAD ADDRESSES<br>
# Refuse spoofed packets.<br>
# Ignore blatantly illegal source addresses.<br>
# Protect yourself from sending to bad addresses.<br>
<br>
# Refuse spoofed packets pretending to be from the external address.<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s $IPADDR -j DENY -l<br>
<br>
# Refuse packets claiming to be to or from a Class A private network<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s $CLASS_A -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -d $CLASS_A -j DENY -l<br>
ipchains -A output -i $EXTERNAL_INTERFACE -s $CLASS_A -j REJECT -l<br>
ipchains -A output -i $EXTERNAL_INTERFACE -d $CLASS_A -j REJECT -l<br>
<br>
# Refuse packets claiming to be to or from a Class B private network<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s $CLASS_B -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -d $CLASS_B -j DENY -l<br>
ipchains -A output -i $EXTERNAL_INTERFACE -s $CLASS_B -j REJECT -l<br>
ipchains -A output -i $EXTERNAL_INTERFACE -d $CLASS_B -j REJECT -l<br>
<br>
# Refuse packets claiming to be to or from a Class C private network<br>
# ipchains -A input -i $EXTERNAL_INTERFACE -s $CLASS_C -j DENY -l<br>
# ipchains -A input -i $EXTERNAL_INTERFACE -d $CLASS_C -j DENY -l<br>
# ipchains -A output -i $EXTERNAL_INTERFACE -s $CLASS_C -j REJECT -l<br>
# ipchains -A output -i $EXTERNAL_INTERFACE -d $CLASS_C -j REJECT -l<br>
<br>
# Refuse packets claiming to be from the loopback interface<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s $LOOPBACK -j DENY -l<br>
ipchains -A output -i $EXTERNAL_INTERFACE -s $LOOPBACK -j REJECT -l<br>
<br>
# Refuse broadcast address SOURCE packets<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s $BROADCAST_DEST -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -d $BROADCAST_SRC -j DENY -l<br>
<br>
# Refuse Class D multicast addresses (in.h) (NET-3-HOWTO)<br>
# Multicast is illegal as a source address.<br>
# Multicast uses UDP.<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s $CLASS_D_MULTICAST -j DENY -l<br>
<br>
# Refuse Class E reserved IP addresses<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s $CLASS_E_RESERVED_NET -j DENY -l<br>
<br>
# refuse addresses defined as reserved by the IANA<br>
# 0.*.*.*, 1.*.*.*, 2.*.*.*, 5.*.*.*, 7.*.*.*, 23.*.*.*, 27.*.*.*<br>
# 31.*.*.*, 37.*.*.*, 39.*.*.*, 41.*.*.*, 42.*.*.*, 58-60.*.*.*<br>
# 65-95.*.*.*, 96-126.*.*.*, 197.*.*.*, 201.*.*.* (?), 217-223.*.*.*<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 1.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 2.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 5.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 7.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 23.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 27.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 31.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 37.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 39.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 41.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 42.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 58.0.0.0/7 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 60.0.0.0/8 -j DENY -l<br>
<br>
#65: 01000001 - /3 includes 64 - need 65-79 spelled out<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 65.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 66.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 67.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 68.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 69.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 70.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 71.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 72.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 73.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 74.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 75.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 76.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 77.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 78.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 79.0.0.0/8 -j DENY -l<br>
<br>
#80: 01010000 - /4 masks 80-95<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 80.0.0.0/4 -j DENY -l<br>
<br>
# 96: 01100000 - /4 makses 96-111<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 96.0.0.0/4 -j DENY -l<br>
<br>
#126: 01111110 - /3 includes 127 - need 112-126 spelled out<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 112.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 113.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 114.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 115.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 116.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 117.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 118.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 119.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 120.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 121.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 122.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 123.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 124.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 125.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 126.0.0.0/8 -j DENY -l<br>
<br>
#217: 11011001 - /5 includes 216 - need 217-219 spelled out<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 217.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 218.0.0.0/8 -j DENY -l<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 219.0.0.0/8 -j DENY -l<br>
<br>
#223: 11011111 - /6 masks 220-223<br>
ipchains -A input -i $EXTERNAL_INTERFACE -s 220.0.0.0/6 -j DENY -l<br>
<br>
# ----------------------------------------------------------------------------<br>
# ICMP<br>
<br>
# To prevent denial of service attacks based on ICMP bombs, filter<br>
# incoming Redirect (5) and outgoing Destination Unreachable (3).<br>
# Note, however, disabling Destination Unreachable (3) is not<br>
# advisable, as it is used to negotiate packet fragment size.<br>
<br>
# For bi-directional ping.<br>
# Message Types: Echo_Reply (0), Echo_Request (icon_cool.gif<br>
# To prevent attacks, limit the src addresses to your ISP range.<br>
#<br>
# For outgoing traceroute.<br>
# Message Types: INCOMING Dest_Unreachable (3), Time_Exceeded (11)<br>
# default UDP base: 33434 to base+nhops-1<br>
#<br>
# For incoming traceroute.<br>
# Message Types: OUTGOING Dest_Unreachable (3), Time_Exceeded (11)<br>
# To block this, deny OUTGOING 3 and 11<br>
<br>
# 0: echo-reply (pong)<br>
# 3: destination-unreachable, port-unreachable, fragmentation-needed, etc.<br>
# 4: source-quench<br>
# 5: redirect<br>
# 8: echo-request (ping)<br>
# 11: time-exceeded<br>
# 12: parameter-problem<br>
<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p icmp <br>
-s $ANYWHERE 0 -d $IPADDR -j ACCEPT<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p icmp <br>
-s $ANYWHERE 3 -d $IPADDR -j ACCEPT<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p icmp <br>
-s $ANYWHERE 4 -d $IPADDR -j ACCEPT<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p icmp <br>
-s $ANYWHERE 11 -d $IPADDR -j ACCEPT<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p icmp <br>
-s $ANYWHERE 12 -d $IPADDR -j ACCEPT<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p icmp <br>
-s $MY_ISP 8 -d $IPADDR -j ACCEPT<br>
<br>
ipchains -A output -i $EXTERNAL_INTERFACE -p icmp <br>
-s $IPADDR 0 -d $MY_ISP -j ACCEPT<br>
ipchains -A output -i $EXTERNAL_INTERFACE -p icmp <br>
-s $IPADDR 3 -d $MY_ISP -j ACCEPT<br>
ipchains -A output -i $EXTERNAL_INTERFACE -p icmp <br>
-s $IPADDR 4 -d $ANYWHERE -j ACCEPT<br>
ipchains -A output -i $EXTERNAL_INTERFACE -p icmp <br>
-s $IPADDR 8 -d $ANYWHERE -j ACCEPT<br>
ipchains -A output -i $EXTERNAL_INTERFACE -p icmp <br>
-s $IPADDR 12 -d $ANYWHERE -j ACCEPT<br>
ipchains -A output -i $EXTERNAL_INTERFACE -p icmp <br>
-s $IPADDR 11 -d $MY_ISP -j ACCEPT<br>
<br>
# ----------------------------------------------------------------------------<br>
# UDP INCOMING TRACEROUTE<br>
# traceroute usually uses -S 32769:65535 -D 33434:33523<br>
<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p udp <br>
-s $MY_ISP $TRACEROUTE_SRC_PORTS <br>
-d $IPADDR $TRACEROUTE_DEST_PORTS -j ACCEPT -l<br>
<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p udp <br>
-s $ANYWHERE $TRACEROUTE_SRC_PORTS <br>
-d $IPADDR $TRACEROUTE_DEST_PORTS -j DENY -l<br>
<br>
# ----------------------------------------------------------------------------<br>
# DNS server<br>
# ----------<br>
<br>
# DNS: full server<br>
# server/client to server query or response<br>
<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p udp <br>
-s $ANYWHERE $UNPRIVPORTS <br>
-d $IPADDR 53 -j ACCEPT<br>
<br>
ipchains -A output -i $EXTERNAL_INTERFACE -p udp <br>
-s $IPADDR 53 <br>
-d $ANYWHERE $UNPRIVPORTS -j ACCEPT<br>
<br>
# DNS client Zone Transfers (53)<br>
# ---------------<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p udp <br>
-s $NAMESERVER_1 53 <br>
-d $IPADDR $UNPRIVPORTS -j ACCEPT<br>
<br>
ipchains -A output -i $EXTERNAL_INTERFACE -p udp <br>
-s $IPADDR $UNPRIVPORTS <br>
-d $NAMESERVER_1 53 -j ACCEPT<br>
<br>
ipchains -A input -i $EXTERNAL_INTERFACE -p tcp ! -y <br>
-s $NAMESERVER_1 53 <br>