Linux - 用Iptables构建主机防火墙安全

#!/bin/bash


# 检查iptables服务是否存在
iptables_exists=$(sudo systemctl --type=service list-unit-files | grep -i "iptables")
# 检查firewalld服务是否存在
firewalld_exists=$(sudo systemctl --type=service list-unit-files | grep -i "firewalld")
# 初始化变量
iptables_status=$(sudo service iptables status &>/dev/null; echo $?)
if [ "$iptables_exists" != "" ] && [ "$firewalld_exists" != "" ]; then
	echo "同时存在iptables和firewalld服务，未避免冲突将停用firewalld服务，请确认是否停用？(y/n)"
	read -p "请输入 'y' or 'n': " user_input
	if [ "$user_input" == "y" ]; then
		# 执行停止服务器的命令
		echo "firewalld服务正在停止..."
		sudo systemctl stop firewalld
		sudo systemctl disable firewalld
		sudo systemctl enable iptables
		sudo systemctl start iptables
		echo "firewalld服务已停用,并启用iptables"
	else
		echo "已取消操作"
		echo "请按任意键退出程序..."
		read -n 1 -s
		exit
	fi
else
	if [ "$iptables_exists" != "" ]; then
		sudo systemctl enable iptables
		sudo systemctl start iptables
	else
		echo "iptables服务不存在"
	fi
	if [ "$firewalld_exists" != "" ]; then
		echo "存在firewalld服务，当前脚本不支持firewalld防火墙配置"
	else
		echo "firewalld服务不存在"
	fi
fi
# 判断iptables是否在运行
if [ $iptables_status -eq 0 ]; then
	echo "iptables已启用"
	echo "执行此脚本前请先确认脚本中的端口是否与现场配置情况一致，不一致请根据现场情况调整！"
	echo ""
	read -p "请按任意键继续，或按Ctrl+C退出："
	echo "请选择部署方式："
	echo "1. 单机部署"
	echo "2. 集群部署"
	read choice

	case $choice in
		1)
			echo "执行单机部署模式下防火墙配置脚本"
			echo "服务器默认1个，若不满足可根据现场实际情况修改脚本"
			echo ""
			read -p "请按任意键继续，或按Ctrl+C退出："
			echo "请输入服务器ip1："
			read trusted_ip1
			
			# 允许所有流量通过
			sudo iptables -t filter -P INPUT ACCEPT
			# 清空所有规则
			sudo iptables -F
			# 允许本地回环地址和特定IP地址的流量通过
			sudo iptables -t filter -A INPUT -i lo -j ACCEPT
			# 拒绝特定端口的流量  端口最多支持13个，如果多余13个请分两行 
			sudo iptables -A INPUT -p tcp -m multiport --dport 8889,9000,9765 -j REJECT
			sudo iptables -A INPUT -p tcp -m multiport --dport 8888,9098,9765 -j REJECT
			# 允许来自特定IP地址的TCP流量
			sudo iptables -I INPUT -p TCP -m multiport --dport 8443,12345 -j DROP
			sudo iptables -I INPUT -s 127.0.0.1,$trusted_ip1 -p TCP -m multiport --dport 8443,12345 -j ACCEPT
			# 保存iptables规则
			sudo mkdir -p /etc/artisaniptables
			sudo iptables-save > /etc/artisaniptables/rules.v4

			# 开启自动重新加载，请根据自身系统，选择合适的加载时机
			sudo echo "iptables-restore < /etc/artisaniptables/rules.v4" | sudo tee -a /etc/rc.local
			;;
		2)
			echo "执行集群部署模式下防火墙配置脚本"
			echo "服务器默认1个，若不满足可根据现场实际情况修改脚本"
			echo ""
			read -p "请按任意键继续，或按Ctrl+C退出："
			echo "请输入服务器ip1："
			read trusted_ip1
			echo "集群服务器默认3台，若不满足请根据现场实际情况修改脚本"
			echo ""
			read -p "请按任意键继续，或按Ctrl+C退出："
			echo "请输入本机ip地址："
			read local_ip
			echo "请输入集群ip1："
			read cluster_ip1
			echo "请输入集群ip2："
			read cluster_ip2

			# 允许所有流量通过
			sudo iptables -t filter -P INPUT ACCEPT
			# 清空所有规则
			sudo iptables -F
			# 允许本地回环地址和特定IP地址的流量通过
			sudo iptables -t filter -A INPUT -i lo -j ACCEPT
			# 允许特定端口的流量通过  端口最多支持13个，如果多余13个请分两行 
			sudo iptables -I INPUT 1 -p tcp -s 127.0.0.1,$local_ip,$cluster_ip1,$cluster_ip2 -m multiport --dport 8889,9876 -j ACCEPT
			sudo iptables -I INPUT 1 -p tcp -s 127.0.0.1,$local_ip,$cluster_ip1,$cluster_ip2 -m multiport --dport 8888,9098,8897 -j ACCEPT
			sudo iptables -A INPUT -p tcp -m multiport --dport 8889,9400,9001 -j REJECT
			sudo iptables -A INPUT -p tcp -m multiport --dport 18888,13776 -j REJECT
			# 允许来自特定IP地址的TCP流量
			sudo iptables -I INPUT -p TCP -m multiport --dport 2122,9123,10123 -j DROP
			sudo iptables -I INPUT -s 127.0.0.1,$trusted_ip1 -p TCP -m multiport --dport 2122,9123,10123 -j ACCEPT
			# 保存iptables规则
			sudo mkdir -p /etc/artisaniptables
			sudo iptables-save > /etc/artisaniptables/rules.v4

			# 开启自动重新加载，请根据自身系统，选择合适的加载时机
			echo "iptables-restore < /etc/artisaniptables/rules.v4" | sudo tee -a /etc/rc.local
			;;
		*)
			echo "输入错误，请输入1或2"
			;;
	esac
	echo "防火墙已配置完成，请根据【端口外漏检测】检查配置是否生效"
else
	echo "当前系统不支持iptables或iptables未启用"
fi
echo "请按任意键退出程序..."
read -n 1 -s
exit