귀차니즘

#!/bin/sh

# 초기화

iptables -F

# 포트 스캔 방지

iptables -A INPUT -d 0.0.0.0/0 -p icmp -j DROP

# DoS 공격 방지

iptables -N syn-flood

iptables -A syn-flood -m limit --limit 12/second --limit-burst 24 -j RETURN

iptables -A syn-flood -j DROP

# ssh 정책(root, webpage 계정만 접속 가능)

# ssh 포트 : 22, root 번호: 0, webpage 번호:500 

iptables -A INPUT -p tcp --dport 22 -m owner --uid-owner 0 -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -m owner --gid-owner 0 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 22 -m owner --uid-owner 0 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 22 -m owner --gid-owner 0 -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -m owner --uid-owner 500 -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -m owner --gid-owner 500 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 22 -m owner --uid-owner 500 -j DROP

iptables -A OUTPUT -p tcp --dport 22 -m owner --gid-owner 500 -j DROP

# 1초에 15번 이상의 HTTP 접근을 할 경우 차단

iptables -A INPUT -m recent --name HTTP --rcheck --seconds 60 -j DROP

iptables -A INPUT -p tcp --dport 80 -m recent --update --seconds 1 --hitcount 15 --name HTTP -j DROP

#--------------------------------------------------------------------

# 커널 컴파일 및 iptables 패치 후, connlimit 사용이 가능한 경우

# 1초에 15번 이상의 HTTP 접근을 할 경우 차단

#iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 15 -connlimit-mask 24 -j DROP

#메일서버의 경우 동시에 5개이상 SMTP 접근일 경우 5분동안 접근 제한

#iptables -A INPUT -m recent --name spammer --rcheck --seconds 300 -j DROP

#iptables -A INPUT -p tcp --syn --dport 25 -m connlimit --connlimit-above 5 -m recent --name spammer --set -j DROP

#---------------------------------------------------------------------

#----------------------------------------------------------------------

# STRING 필터기능

# MSN 문자열이 들어간 패킷 차단

#iptables -A FORWARD -m string --string "messenger.msn.com" -j DROP

# 싸이월드 접속차단

#iptables -A FORWARD -p tcp --dport 80 -m string --string "Host: cyworld.nate.com" -j DROP

#----------------------------------------------------------------------

# 서버가 해킹당했을 때 DoS공격지로 사용될 경우에 적용.

# DNS 쿼리 이외 UDP 패킷 전송 방지

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -p udp ! --dport 53 -m state --state NEW -j DROP

Usage: iptables -[AD] chain rule-specification [options]

       iptables -[RI] chain rulenum rule-specification [options]

       iptables -D chain rulenum [options]

       iptables -[LFZ] [chain] [options]

       iptables -[NX] chain

       iptables -E old-chain-name new-chain-name

       iptables -P chain target [options]

       iptables -h (print this help information)

Commands:

Either long or short options are allowed.

  --append  -A chain            Append to chain

  --delete  -D chain            Delete matching rule from chain

  --delete  -D chain rulenum

                                Delete rule rulenum (1 = first) from chain

  --insert  -I chain [rulenum]

                                Insert in chain as rulenum (default 1=first)

  --replace -R chain rulenum

                                Replace rule rulenum (1 = first) in chain

  --list    -L [chain]          List the rules in a chain or all chains

  --flush   -F [chain]          Delete all rules in  chain or all chains

  --zero    -Z [chain]          Zero counters in chain or all chains

  --new     -N chain            Create a new user-defined chain

  --delete-chain

            -X [chain]          Delete a user-defined chain

  --policy  -P chain target

                                Change policy on chain to target

  --rename-chain

            -E old-chain new-chain

                                Change chain name, (moving any references)

Options:

  --proto       -p [!] proto    protocol: by number or name, eg. `tcp'

  --source      -s [!] address[/mask]

                                source specification

  --destination -d [!] address[/mask]

                                destination specification

  --in-interface -i [!] input name[+]

                                network interface name ([+] for wildcard)

  --jump        -j target

                                target for rule (may load target extension)

  --goto      -g chain

                              jump to chain with no return

  --match       -m match

                                extended match (may load extension)

  --numeric     -n              numeric output of addresses and ports

  --out-interface -o [!] output name[+]

                                network interface name ([+] for wildcard)

  --table       -t table        table to manipulate (default: `filter')

  --verbose     -v              verbose mode

  --line-numbers                print line numbers when listing

  --exact       -x              expand numbers (display exact values)

[!] --fragment  -f              match second or further fragments only

  --modprobe=<command>          try to insert modules using this command

  --set-counters PKTS BYTES     set the counter during insert/append

[!] --version   -V              print package version.