LinuxϵͳIptablesµÄ³£Ó÷À»ðǽÅäÖ÷½·¨ ¡¡¡¡

¡¡

¡¡¡¡#ÒÔÏÂÊÇÄã¿ÉÒÔËÍПø±ðÈË¡¡¡¡iptables-AOUTPUT-o$EXT_IF-ptcp-s$FW_IP¡ª¡ªsport1024:65535-dany/0¡ª¡ªdport25-jACCEPT¡¡¡¡iptables-AINPUT-i$EXT_IF-ptcp!¡ª¡ªsyn-sany/0¡ª¡ªsport25-d$FW_IP¡ª¡ªdport1024:65525-jACCEPT¡¡¡¡###¡ª¡ª###¡¡¡¡#¿ª·Å¶ÔÍâÀëÏßÏÂÔØÐżþµÄͨµÀPOP3port110¡¡¡¡###¡ª¡ª###¡¡¡¡iptables-AOUTPUT-o$EXT_IF-ptcp-s$FW_IP¡ª¡ªsport1024:65535-dany/0¡ª¡ªdport110-jACCEPT¡¡¡¡iptables-AINPUT-i$EXT_IF-ptcp!¡ª¡ªsyn-sany/0¡ª¡ªsport110-d$FW_IP¡ª¡ªdport1024:65535-jACCEPT¡¡¡¡###¡ª¡ª###¡¡¡¡#¿ª·Åä¯ÀÀÍøÒ³µÄͨµÀhttpport80¡¡¡¡###¡ª¡ª###¡¡¡¡iptables-AOUTPUT-o$EXT_IF-ptcp-s$FW_IP¡ª¡ªsport1024:65535-dany/0¡ª¡ªdport80-jACCEPT¡¡¡¡iptables-AINPUT-i$EXT_IF-ptcp!¡ª¡ªsyn-sany/0¡ª¡ªsport80-d$FW_IP¡ª¡ªdport1024:65535-jACCEPT¡¡¡¡###¡ª¡ª###¡¡¡¡#¿ª·Å²éѯÍⲿÍøÂçµÄDNSÖ÷»úDNSport:53¡¡¡¡###¡ª¡ª###¡¡¡¡#µÚÒ»´Î»áÓÃudp·â°üÀ´²éѯ¡¡¡¡iptables-AOUTPUT-o$EXT_IF-pudp-s$FW_IP¡ª¡ªsport1024:65535-dany/0¡ª¡ªdport53-jACCEPT¡¡¡¡iptables-AINPUT-i$EXT_IF-pudp-sany/0¡ª¡ªsport53-d$FW_IP¡ª¡ªdport1024:65535-jACCEPT¡¡¡¡#ÈôÓдíÎó,»á¸ÄÓÃtcp°üÀ´²éѯ¡¡¡¡iptables-AOUTPUT-o$EXT_IF-ptcp-s$FW_IP¡ª¡ªsport1024:65535-dany/0¡ª¡ªdport53-jACCEPT¡¡¡¡iptables-AINPUT-i$EXT_IF-ptcp!¡ª¡ªsyn-sany/0¡ª¡ªsport53-d$FW_IP¡ª¡ªdport1024:65535-jACCEPT¡¡¡¡#¿ª·ÅÕą̂Ö÷»úÉϵÄDNSºÍÍⲿµÄDNSÖ÷»ú»¥¶¯²éѯ:ʹÓÃudp¡¡¡¡iptables-AOUTPUT-o$EXT_IF-pudp-s$FW_IP¡ª¡ªsport53-dany/0¡ª¡ªdport53-jACCEPT¡¡¡¡iptables-AINPUT-i$EXT_IF-pudp-sany/0¡ª¡ªsport53-d$FW_IP¡ª¡ªdport53-jACCEPT¡¡¡¡#¿ª·ÅÕą̂Ö÷»úÉϵÄDNSºÍÍⲿµÄDNSÖ÷»ú»¥¶¯²éѯ:ʹÓÃudp¡¡¡¡iptables-AOUTPUT-oEXT_IF-ptcp-s$FW_IP¡ª¡ªsport53-dany/0¡ª¡ªdport53-jACCEPT¡¡¡¡iptables-AINPUT-iEXT_IF-ptcp!¡ª¡ªsyn-sany/0¡ª¡ªsport53-d$FW_IP¡ª¡ªdport53-jACCEPT¡¡¡¡###¡ª¡ª###¡¡¡¡#¿ª·ÅÄÚ²¿Ö÷»ú¿ÉÒÔSSHÖÁÍⲿµÄÖ÷»úSSHport:22¡¡¡¡###¡ª¡ª###¡¡¡¡iptables-AOUTPUT-o$EXT_IF-ptcp-s$FW_IP¡ª¡ªsport1024:65535-dany/0¡ª¡ªdport22-jACCEPT¡¡¡¡iptables-AINPUT-i$EXT_IF-ptcp!¡ª¡ªsyn-sany/0¡ª¡ªsport22-d$FW_IP¡ª¡ªdport1024:65535-jACCEPT¡¡¡¡#ÒÔÏÂÊÇSSHprotocol±È½Ï²»Í¬µÄµØ·½¡¡¡¡iptables-AOUTPUT-o$EXT_IF-ptcp-s$FW_IP¡ª¡ªsport1020:1023-d

any/0¡ª¡ªdport22-jACCEPT¡¡¡¡iptables-AINPUT-i$EXT_IF-ptcp!¡ª¡ªsyn-sany/0¡ª¡ªsport22-d$FW_IP¡ª¡ªdport1020:1023-jACCEPT¡¡¡¡###¡ª¡ª###¡¡¡¡###¿ª·ÅÄÚ²¿ÍøÂç,¿ÉÒÔftpÖÁÍⲿÖ÷»ú¡¡¡¡###¡ª¡ª###¡¡¡¡#ÒÔÏÂÊÇ´ò¿ªÃüÁîchannel21¡¡¡¡iptables-AOUTPUT-o$EXT_IF-ptcp-s$FW_IP¡ª¡ªsport1024:65535-dany/0¡ª¡ªdport21-jACCEPT¡¡¡¡iptables-AINPUT-i$EXT_IF-ptcp!¡ª¡ªsyn-sany/0¡ª¡ªsport21-d$FW_IP¡ª¡ªdport1024:65535-jACCEPT¡¡¡¡#ÒÔÏÂÊÇ´ò¿ª×ÊÁÏchannel20¡¡¡¡iptables-AINPUT-i$EXT_IF-ptcp-sany/0¡ª¡ªsport20-d$FW_IP¡ª¡ªdport1024:65535-jACCEPT¡¡¡¡iptables-AOUTPUT-o$EXT_IF-ptcp!¡ª¡ªsyn-s$FW_IP¡ª¡ªsport1024:65535-dany/0¡ª¡ªdport20-jACCEPT