Iptable template

#! / bin/sh

Echo "starting forward..."

If [- e / proc/sys/net/ipv4/tcp_ecn]

Then

Echo 0 > / proc/sys/net/ipv4/tcp_ecn

Fi

Echo 1 > / proc/sys/net/ipv4/tcp_syncookies

Com_sh_ip1= "172.168.1.1Comp32"

Com_wh_ip1= "192.168.1.1Comp32"

Export com_sh_ip1 com_wh_ip1

/ sbin/iptables-F

/ sbin/iptables-F-t nat

/ sbin/depmod-a

/ sbin/modprobe ip_tables

/ sbin/modprobe ip_conntrack

/ sbin/modprobe ip_nat_ftp

/ sbin/modprobe ip_conntrack_ftp

/ sbin/iptables-N GM

/ sbin/iptables-N Area1

/ sbin/iptables-N Area2

/ sbin/iptables-N Area3

/ sbin/iptables-N Area4

/ sbin/iptables-N Area6

/ sbin/iptables-N Area7

/ sbin/iptables-An INPUT-I lo-j ACCEPT

/ sbin/iptables-An INPUT-p icmp-j ACCEPT

/ sbin/iptables-An INPUT-s $com_sh_ip1-p tcp-m tcp-- dport 22-m state-- state NEW-j ACCEPT

/ sbin/iptables-An INPUT-s $com_wh_ip1-p tcp-m tcp-- dport 22-m state-- state NEW-j ACCEPT

/ sbin/iptables-An INPUT-s 11.11.11.11-p tcp-m tcp-- dport 22-m state-- state NEW-j ACCEPT

/ sbin/iptables-An INPUT-s 10.0.0.0 dport 8-p tcp-m tcp-- dport 22-m state-- state NEW-j ACCEPT

/ sbin/iptables-An INPUT-s $com_sh_ip1-p tcp-m tcp-- dport 10050-m state-- state NEW-j ACCEPT

/ sbin/iptables-An INPUT-s $com_sh_ip1-p tcp-m tcp-- dport 4040-m state-- state NEW-j ACCEPT

/ sbin/iptables-An INPUT-m state-- state ESTABLISHED,RELATED-j ACCEPT

/ sbin/iptables-An INPUT-j GM

/ sbin/iptables-An INPUT-j Area1

/ sbin/iptables-An INPUT-j Area2

/ sbin/iptables-An INPUT-j Area3

/ sbin/iptables-An INPUT-j Area4

/ sbin/iptables-An INPUT-j Area6

/ sbin/iptables-An INPUT-j Area7

# open ftp port for dragonball operation data analyse

/ sbin/iptables-An INPUT-s $com_wh_ip1-p tcp-m tcp-- dport 3421 tcp 3425-m state-- state NEW-j ACCEPT

/ sbin/iptables-An INPUT-s $com_sh_ip1-p tcp-m tcp-- dport 3421 tcp 3425-m state-- state NEW-j ACCEPT

# GM

/ sbin/iptables-A GM-p tcp-- dport 1800-m state-- state NEW-j ACCEPT

/ sbin/iptables-A GM-p tcp-- dport 80-m state-- state NEW-j ACCEPT

# Area1

/ sbin/iptables-An Area1-p tcp-- dport 10120-m state-- state NEW-j ACCEPT

/ sbin/iptables-P INPUT DROP