iptables,ebtables,arptables

还有多少tables可以来一下。

话说还是把本机防火墙配起来了，经历两次把自己关在门外后，开始小心翼翼了。

1 #!/bin/sh -e

2 IPTABLES="/sbin/iptables"

3 ARPTABLES="/sbin/arptables"

4

5 echo 1 > /proc/sys/net/ipv4/ip_forward

6 start(){

7 # flush

8 $IPTABLES -F

9

# set default policy

$IPTABLES -P INPUT ACCEPT

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -P FORWARD ACCEPT

# input chain

# state allow

$IPTABLES -A OUTPUT -m state --state INVALID -j REJECT

$IPTABLES -A INPUT -m state --state INVALID -j REJECT

$IPTABLES -A INPUT -p icmp -m limit --limit 20/minute --limit-burst 5 --icmp-type 8 -j ACCEPT

$IPTABLES -A INPUT -p icmp -m limit --limit 20/minute --limit-burst 5 --icmp-type 11 -j ACCEPT

$IPTABLES -A INPUT -p icmp -j REJECT --reject-with icmp-host-unreachable

#reject arping

$ARPTABLES -P INPUT DROP

$ARPTABLES -P OUTPUT DROP

$ARPTABLES -P FORWARD ACCEPT

$ARPTABLES -A INPUT --source-mac 00:d0:xx:xx:xx:xx -j ACCEPT

$ARPTABLES -A OUTPUT --destination-mac 00:d0:xx:xx:xx:xx -j ACCEPT

$ARPTABLES -A INPUT --opcode 2 -j ACCEPT

$ARPTABLES -A OUTPUT --opcode 1 -j ACCEPT

}

stop(){

$IPTABLES -F

$IPTABLES -P INPUT ACCEPT

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -P FORWARD ACCEPT

$ARPTABLES -F

$ARPTABLES -P INPUT ACCEPT

$ARPTABLES -P OUTPUT ACCEPT

$ARPTABLES -P FORWARD ACCEPT

}

case "$1" in

start)

start

;;

stop)

stop

;;

*)

echo "$0 {start|stop}"

exit 1

;;

esac

exit 0