CentOS 7에서 iptables 사용 > 에필로그

systemctl status firewalld

systemctl stop firewalld

systemctl disable firewalld

yum install -y iptables-services

systemctl start iptables

systemctl enable iptables

systemctl is-enabled iptables

#!/bin/bash

#Network

LOCALNET=192.168.0.0/24

#F/W stop

systemctl stop iptables

#Initialize

iptables -F

iptables -X

iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

iptables -P FORWARD DROP

#Loopback, Localnet, Chain Fragments

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -s $LOCALNET -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -f -j DROP

#PIng

iptables -N PINGBAN

iptables -A PINGBAN -m limit --limit 1/s --limit-burst 4 -j ACCEPT

iptables -A PINGBAN -j DROP

iptables -A INPUT -p icmp --icmp-type echo-request -j PINGBAN

#Cast

iptables -A INPUT -d 255.255.255.255 -j DROP

iptables -A INPUT -d 224.0.0.1 -j DROP

#AUTH

iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset

#SSH

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

#WEB

iptables -A INPUT -p tcp --dport 80,443 -j ACCEPT

#FTP

iptables -A INPUT -p tcp --sport 20,21 -j ACCEPT

iptables -A INPUT -p tcp --dport 989,990 -j ACCEPT

iptables -A INPUT -p tcp --dport 5001:5050 -j ACCEPT

#SMTP

iptables -A INPUT -p tcp --dport 25,465 -j ACCEPT

#POP3

iptables -A INPUT -p tcp --dport 110,995 -j ACCEPT

#IMAP

iptables -A INPUT -p tcp --dport 143,993 -j ACCEPT

#SMB

iptables -A INPUT ! -s $LOCALNET -p tcp -m multiport --dports 135:139,445 -j ACCEPT

iptables -A INPUT ! -s $LOCALNET -p udp -m multiport --dports 135:139,445 -j ACCEPT

iptables -A OUTPUT ! -d $LOCALNET -p tcp -m multiport --sports 135:139,445 -j ACCEPT

iptables -A OUTPUT ! -d $LOCALNET -p udp -m multiport --sports 135:139,445 -j ACCEPT

#Save

/usr/libexec/iptables/iptables.init save

#F/W start

systemctl start iptables

chmod 700 /etc/iptables/setup.sh

/etc/iptables/setup.sh