#!/bin/sh

IPTABLES=“/sbin/iptables“

echo “1“ > /proc/sys/net/ipv4/ip_forward

$$$$IPTABLES -P INPUT *

$$$$IPTABLES -P FORWARD *

$$$$IPTABLES -P OUTPUT *

$$$$IPTABLES -F

$$$$IPTABLES -X

$$$$IPTABLES -Z

#$$$$IPTABLES -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

# 如果同时在80端口的连接数大于10，就*掉这个ip

netstat -an | grep :80 | awk -F: ‘{ print $$$$8 }‘ | sort | uniq -c | awk -F\ ‘$$$$1>10 && $$$$2!=““ { print $$$$2 }‘ >> /etc/fw.list

less /etc/fw.list | sort | uniq -c | awk -F\ ‘$$$$2!=““ { print $$$$2 }‘ > /etc/fw.list2

less /etc/fw.list2 > /etc/fw.list

while read line

do

t=`echo “$$$$line“`

$$$$IPTABLES -A INPUT -p tcp -s $$$$t -j *

done < /etc/fw.list2

$$$$IPTABLES -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

$$$$IPTABLES -A INPUT -p tcp –dport 22 -j ACCEPT

$$$$IPTABLES -A INPUT -p tcp –dport 443 –tcp-flags SYN,ACK,FIN,RST SYN -m limit –limit 30/m –limit-burst 2 -j ACCEPT

$$$$IPTABLES -A INPUT -p tcp –dport 80 –tcp-flags SYN,ACK,FIN,RST SYN -m limit –limit 30/m –limit-burst 2 -j ACCEPT

#限制连往本机的web服务，单个IP的并发连接不超过10个，超过的被拒绝

$$$$IPT -A INPUT -i $$$$INTERNET -p tcp –dport 80 -m connlimit –connlimit-above 10 -j REJECT

$$$$IPT -A INPUT -i $$$$INTERNET -p tcp –dport 443 -m connlimit –connlimit-above 10 -j REJECT

#限制连往本机的web服务，单个IP在60秒内只允许最多新建15个连接，超过的被拒绝

$$$$IPT -A INPUT -i $$$$INTERNET -p tcp –dport 80 -m recent –name BAD_HTTP_ACCESS –* –seconds 60 –hitcount 15 -j REJECT

$$$$IPT -A INPUT -i $$$$INTERNET -p tcp –dport 80 -m recent –name BAD_HTTP_ACCESS –set -j ACCEPT

$$$$IPT -A INPUT -i $$$$INTERNET -p tcp –dport 443 -m recent –name BAD_HTTP_ACCESS –* –seconds 60 –hitcount 15 -j REJECT

$$$$IPT -A INPUT -i $$$$INTERNET -p tcp –dport 443 -m recent –name BAD_HTTP_ACCESS –set -j ACCEPT

#限制连往本机的web服务，1个C段的IP的并发连接不超过150个，超过的被拒绝

$$$$IPT -A INPUT -i $$$$INTERNET -p tcp –dport 80 -m iplimit –iplimit-above 150 –iplimit-mask 24 -j REJECT

$$$$IPT -A INPUT -i $$$$INTERNET -p tcp –dport 443 -m iplimit –iplimit-above 150 –iplimit-mask 24 -j REJECT

$$$$IPTABLES -A OUTPUT -p tcp -s 127.0.0.1 -j ACCEPT

$$$$IPTABLES -A OUTPUT -p udp -s 127.0.0.1 -j ACCEPT

$$$$IPTABLES -A INPUT -p tcp –syn -j *

#防止被tracert

iptables -A INPUT -m ttl –ttl-eq 1 -j *

iptables -A INPUT -m ttl –ttl-lt 4 -j *

iptables -A FORWARD -m ttl –ttl-lt 6 -j *