Linux VPS防火牆腳本 SS vp,n WEB MYSQL SSH

iptables -F 
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -j ACCEPT   
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 222 -j ACCEPT

iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A INPUT -p gre -j ACCEPT
//這2條是pptp 扶牆的

iptables -A INPUT -p tcp --dport 40000:60000 -j ACCEPT
//ss開放端口


iptables -A INPUT -s 11.11.11.11 -p tcp --dport 3306 -j ACCEPT

iptables -A INPUT -s 101.199.100.150 -p udp --dport 161 -j ACCEPT
//snmpd監控

iptables -A OUTPUT -p tcp -m multiport --dports 25,26,109,110,143,220,366,465,587,691,993,995,2710,6881 -j REJECT --reject-with tcp-reset
iptables -A OUTPUT -p udp -m multiport --dports 25,26,109,110,143,220,366,465,587,691,993,995,2710,6881 -j DROP
//屏蔽ss亂髮垃圾郵件

iptables -A INPUT -p icmp -j ACCEPT 
iptables -A OUTPUT -p icmp -j ACCEPT

iptables -A INPUT -j DROP   
/etc/init.d/iptables save 


iptables -A FORWARD -s 172.16.36.0/24 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --set-mss 1356
iptables -t nat -A POSTROUTING -s 172.16.36.0/24 -j SNAT --to-source 111.111.111.111
//這2條是pptp 扶牆轉發的