#!/bin/bash

#data 2015-01-19

#autoer  lrm

iptables -F

iptables -F -t nat

iptables -X

iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

iptables -P FORWARD ACCEPT

######################load connection-tracking modules

modprobe iptable_nat

modprobe ip_conntrack_ftp

modprobe ip_nat_ftp

#####################access

iptables -A INPUT -f -m limit --limit 100/sec --limit-burst 100 -j ACCEPT

iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 10 -j ACCEPT

#####################gz_IDC

iptables -A INPUT -s 1.1.1.x -j ACCEPT

iptables -A INPUT -s 2.2.2.x -j ACCEPT

#####################gz_lanhai_IDC_end

#####################gz_office_IP

iptables -A INPUT -s 1.1.1.x -j ACCEPT

#####################

iptables -A INPUT -i lo -j ACCEPT

iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp -m multiport --dport 80 -j ACCEPT                                                        

本文出自 “信不信由你” 博客，请务必保留此出处http://312461613.blog.51cto.com/965442/1605851

适合web的单机防火墙