Tạo file script
Tạo file script với tên iptables.sh
#vi iptables.sh
Điền vào nội dung sau.
#!/bin/bash
# define some constants. Those are your WAN IP which need to be whitelisted.
your_vnpt_ip=’x.x.x.x’
your_viettel_ip=’y.y.y.y’
# delete all configuration and set default policy for each chain.
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -N ZIMBRA-FIREWALL
/sbin/iptables -A INPUT -j ZIMBRA-FIREWALL
/sbin/iptables -A FORWARD -j ZIMBRA-FIREWALL
# Stop some attacks
/sbin/iptables -A ZIMBRA-FIREWALL -p tcp –tcp-flags ALL NONE -j DROP
/sbin/iptables -A ZIMBRA-FIREWALL -p tcp ! –syn -m state –state NEW -j DROP
/sbin/iptables -A ZIMBRA-FIREWALL -p tcp –tcp-flags ALL ALL -j DROP
# Accept save connection and icmp
/sbin/iptables -A ZIMBRA-FIREWALL -i lo -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -p icmp –icmp-type any -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state ESTABLISHED,RELATED -j ACCEPT
# enable this rule if have has layer remote 2/3 devices
/sbin/iptables -A ZIMBRA-FIREWALL -p tcp –tcp-flags FIN,SYN,RST,ACK RST,ACK -j ACCEPT
# enable ssh and snmp
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT -s $vnpt_ip
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT -s $viettel_ip
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m udp -p udp –dport 161 -j ACCEPT -s $vnpt_ip
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m udp -p udp –dport 161 -j ACCEPT -s $viettel_ip
# enable zimbra ports
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 25 -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 110 -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 143 -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 443 -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 465 -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 587 -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 993 -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 995 -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 7071 -j ACCEPT
/sbin/iptables -A ZIMBRA-FIREWALL -m state –state NEW -m tcp -p tcp –dport 9071 -j ACCEPT
# log and reject everything else
#/sbin/iptables -A ZIMBRA-FIREWALL -j LOG -m limit –limit 10/m –log-prefix “DROP ON INPUT: ” –log-tcp-options –log-ip-options –log-level INFO
/sbin/iptables -A ZIMBRA-FIREWALL -j DROP
# save configuraton and restart iptables
/etc/rc.d/init.d/iptables save
/etc/rc.d/init.d/iptables restart
