我写了一个iptables防火墙脚本,请高手指点一下,是否要作改进
#!/bin/sh
echo "Starting iptables rules..."
modprobe iptable_nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F INPUT
iptables -F FORWARD
iptables -F POSTROUTING -t nat
iptables -P FORWARD DROP
iptables -A FORWARD -s 192.168.0.1/24 -o ppp0 -j ACCEPT
iptables -A FORWARD -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o ppp0 -s 192.168.0.0/24 -j MASQUERADE
iptables -F PREROUTING -t nat
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport www -i ppp0 -j ACCEPT
iptables -A FORWARD -o ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A PREROUTING -i ppp0 -j DNAT --to 192.168.0.1
iptables -A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT
iptables -A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
其中192.168.0.1是www服务器,希望被外网访问,由于只有两台电脑,无法测试设置情况,所以请高手指点一下,最好能从安全角度作一些改进.谢谢了!!!
