!/bin/bash

IPT=/sbin/iptables

Сброс всего

$IPT -F $IPT -t nat -F

$IPT -P INPUT DROP

$IPT -P OUTPUT DROP

$IPT -P FORWARD DROP

$IPT -t filter -A INPUT -i lo -j ACCEPT $IPT -t filter -A OUTPUT -o lo -j ACCEPT

$IPT -t filter -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT

$IPT -t filter -A OUTPUT -m state –state RELATED,ESTABLISHED -j ACCEPT

$IPT -t filter -A FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT

$IPT -t filter -A INPUT -p tcp –dport 22 -j ACCEPT

$IPT -t filter -A OUTPUT -p tcp –sport 22 -j ACCEPT

$IPT -t filter -A FORWARD -s 10.10.10.0/24 -j ACCEPT

$IPT -t nat -A POSTROUTING -s 10.10.10.0/24 -j MASQUERADE

$IPT -t nat -A PREROUTING -i eth1 -p tcp –dport 222 -j DNAT –to-destination 10.10.10.10:22

$IPT -t filter -A FORWARD -i eth1 -p tcp –dport 22 -j ACCEPT

$IPT -t filter -A FORWARD -i eth1 -p tcp –syn –dport 22 -m connlimit –connlimit-above 3 -j REJECT

~