4 234
modifications
« Proxmox3 » : différence entre les versions
Aller à la navigation
Aller à la recherche
→firewall iptables
| Ligne 488 : | Ligne 488 : | ||
==firewall iptables== | ==firewall iptables== | ||
Voici un petit script | |||
<pre> | |||
#! /bin/bash | |||
trusted_ipv6="votreipv6" | |||
db=fr.zone | |||
wget http://www.ipdeny.com/ipblocks/data/countries/fr.zone | |||
trusted=$(egrep -v "^#|^$" $db) | |||
rm $db | |||
echo "clearing iptables" | |||
/sbin/iptables -t filter -D INPUT -p tcp -i vmbr0 -m multiport --dports 21,22,8006 -j firewall | |||
/sbin/iptables -F firewall | |||
/sbin/iptables -X firewall | |||
echo "adding rules to iptables" | |||
/sbin/iptables -t filter -N firewall | |||
/sbin/iptables -t filter -A INPUT -p tcp -i vmbr0 -m multiport --dports 21,22,8006 -j firewall | |||
for ipblock in $trusted; do | |||
/sbin/iptables -t filter -A firewall -s $ipblock -j ACCEPT | |||
done | |||
/sbin/iptables -t filter -A firewall -j DROP | |||
echo "clearing ip6tables" | |||
/sbin/ip6tables -t filter -D INPUT -p tcp -i vmbr0 -m multiport --dports 21,22,8006 -j firewall | |||
/sbin/ip6tables -F firewall | |||
/sbin/ip6tables -X firewall | |||
echo "adding rules to ip6tables" | |||
/sbin/ip6tables -t filter -N firewall | |||
/sbin/ip6tables -t filter -A INPUT -p tcp -i vmbr0 -m multiport --dports 21,22,8006 -j firewall | |||
/sbin/ip6tables -t filter -A firewall -s $trusted_ipv6 -j ACCEPT | |||
/sbin/ip6tables -t filter -A firewall -j DROP | |||
</pre> | |||
=VMs= | =VMs= | ||