web server iptables configuration script implementation code

web server iptables configuration script welcomes 1 improvement

Implementation code:

#!/bin/bash
# ID 201510192126
# Author Ricky
# E-mail 564001002@qq.com IT Operation and maintenance management technology exchange group  16548318
# CentOS 6  System initial optimization script 
# version 1.0.0

#add iptables
yum -y install iptables

#iptables conf bak
if [ ! -e "/etc/sysconfig/iptables.bak" ]; then
  cp /etc/sysconfig/iptables /etc/sysconfig/iptables.bak > /dev/null 2>&1
fi

#add config
cat > /etc/sysconfig/iptables << EOF
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
#  Firewall rules have sequence, please test before modification and then change 
# E-Mail:564001002@QQ.COM
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:syn-flood - [0:0]

#RELATED,ESTABLISHED
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#io
-A INPUT -i lo -j ACCEPT

#ping
-A INPUT -p icmp -j ACCEPT

#redis
#-A INPUT -p tcp -m tcp --dport 6379 -j ACCEPT
#-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 6379 -j ACCEPT

#mysql
#-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
#-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 3306 -j ACCEPT

#memcache
#-A INPUT -p tcp -m tcp --dport 11211 -j ACCEPT
#-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 11211 -j ACCEPT

#php
#-A INPUT -p tcp -m tcp --dport 9000 -j ACCEPT
#-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 9000 -j ACCEPT

#ssh
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
#-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name SSH --rsource -j DROP
#-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource -j ACCEPT

#http 500 * 90%  The control can be cancelled if the restriction is needed 1 Comment line 
#-A INPUT -p tcp -m tcp --dport 80 -m connlimit --connlimit-above 500 --connlimit-mask 32 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

#https 500 * 90%  The control can be cancelled if the restriction is needed 1 Comment line 
#-A INPUT -p tcp -m tcp --dport 443 -m connlimit --connlimit-above 500 --connlimit-mask 32 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

#---service--------------------------------------------------
#DNS  The installation DNS After the server needs to open 
#-A INPUT -p udp --sport 53 -j ACCEPT

#ntp  configuration ntp The server needs to be open 
#-A INPUT -p udp --sport 123 -j ACCEPT

# External visits, for example api interface   Need to combine OUTPUT DROP  You only need to turn it on if it's all closed, and you only need to configure it if it's very restricted 
#-A OUTPUT -p tcp --dport 80 -j ACCEPT
#-A OUTPUT -p tcp --dport 443 -j ACCEPT

######################################################################################
# The following # Section number is not tested or is successful, and may have errors before opening please test first, and ensure that it can match your environment 
#syn-flood
#-A syn-flood -p tcp -m limit --limit 500/sec --limit-burst 10000 -j RETURN

#------FIN SYN RST ACK SYN-----------------
#-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j ACCEPT
#-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 10/sec --limit-burst 100 -j ACCEPT
######################################################################################

#PORTSAN  Port scan rejected, lack of tools failed to test well, please use with caution. 
#-A INPUT -p tcp --syn -m recent --name portscan --rcheck --seconds 60 --hitcount 10 -j LOG
#-A INPUT -p tcp --syn -m recent --name portscan --set -j DROP

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A syn-flood -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT
EOF
/sbin/service iptables restart
source /etc/profile
chkconfig iptables on
/sbin/iptables -L -v
chkconfig | grep iptables
echo -e "\033[31m iptables ok \033[0m"

Thank you for reading, I hope to help you, thank you for your support to this site!