rc_00_fi.{__

来自「grub安装实例教你怎样安装GRUB以及使用在红帽中遇到的问题！」· {__ 代码 · 共 60 行

#!/bin/sh

PATH=/sbin:/bin:/usr/sbin:/usr/bin

exit 0 ;
. /etc/rc.d/rc.functions

. /etc/firewall.conf

echo -n "Starting basic firewall: "

# set up spoofing protection
# taken from IPCHAINS-HOWTO
for f in /proc/sys/net/ipv4/conf/*/rp_filter
do
  echo 1 > $f
done

# log impossible addresses
for f in /proc/sys/net/ipv4/conf/*/log_martians
do
  echo 1 > $f
done

# default setting: deny everything
ipchains -F input
ipchains -P input DENY
ipchains -F output
ipchains -P output DENY

# allow all non-external interfaces for everything
ipchains -A input  -i ! $EXT -j ACCEPT
ipchains -A output -i ! $EXT -j ACCEPT

# external interface

  # icmp incoming
  ipchains -A input -i $EXT -p icmp -s 0/0 echo-request -j DENY
  ipchains -A input -i $EXT -p icmp -j ACCEPT

  # tcp incoming
  if [ "$ALLOW_HTTP" = "yes" ]; then
    ipchains -A input -i $EXT -p tcp -d 0/0 http     -j ACCEPT
  fi
  if [ "$ALLOW_TELNET" = "yes" ]; then
    ipchains -A input -i $EXT -p tcp -d 0/0 telnet   -j ACCEPT
  fi
  ipchains -A input -i $EXT -p tcp -d 0/0 ftp-data   -j ACCEPT
  ipchains -A input -i $EXT -p tcp -d 0/0 auth       -j REJECT
  ipchains -A input -i $EXT -p tcp -d 0/0 6000:6010  -j DENY
  ipchains -A input -i $EXT -p tcp -d 0/0 1024:65535 -j ACCEPT

  # udp incoming
  ipchains -A input -i $EXT -p udp -d 0/0 1024:65535 -j ACCEPT

  # all protocols outgoing
  ipchains -A output -i $EXT -j ACCEPT

check_status