92 lines
2.0 KiB
Bash
92 lines
2.0 KiB
Bash
|
#!/bin/bash
|
|||
|
|
|
|||
|
|
# 获取命令行参数
|
|||
|
|
while getopts "4:6:" opt; do
|
|||
|
|
case $opt in
|
|||
|
|
4) ALLOWED_IPV4="$OPTARG"
|
|||
|
|
;;
|
|||
|
|
6) ALLOWED_IPV6="$OPTARG"
|
|||
|
|
;;
|
|||
|
|
\?) echo "无效的参数: -$OPTARG" >&2
|
|||
|
|
exit 1
|
|||
|
|
;;
|
|||
|
|
esac
|
|||
|
|
done
|
|||
|
|
|
|||
|
|
# 检查是否提供了IP地址
|
|||
|
|
if [ -z "$ALLOWED_IPV4" ] && [ -z "$ALLOWED_IPV6" ]; then
|
|||
|
|
echo "必须指定IPv4或IPv6地址"
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# 更新包管理器并安装 iptables-persistent 以便在重启后保存规则
|
|||
|
|
install_iptables() {
|
|||
|
|
echo "正在安装iptables..."
|
|||
|
|
apt-get update
|
|||
|
|
apt-get install -y iptables ip6tables iptables-persistent
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# 配置 ufw
|
|||
|
|
configure_ufw() {
|
|||
|
|
echo "配置ufw规则"
|
|||
|
|
|
|||
|
|
# 移除现有的22端口规则
|
|||
|
|
ufw delete allow 22/tcp
|
|||
|
|
|
|||
|
|
# 允许指定IP地址访问22端口
|
|||
|
|
if [ -n "$ALLOWED_IPV4" ]; then
|
|||
|
|
ufw allow from $ALLOWED_IPV4 to any port 22 proto tcp
|
|||
|
|
fi
|
|||
|
|
if [ -n "$ALLOWED_IPV6" ]; then
|
|||
|
|
ufw allow from $ALLOWED_IPV6 to any port 22 proto tcp
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# 启用ufw
|
|||
|
|
ufw reload
|
|||
|
|
|
|||
|
|
# 显示当前的ufw状态
|
|||
|
|
ufw status verbose
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# 配置 iptables
|
|||
|
|
configure_iptables() {
|
|||
|
|
echo "配置iptables规则"
|
|||
|
|
|
|||
|
|
# 移除现有的22端口规则
|
|||
|
|
iptables -D INPUT -p tcp --dport 22 -j ACCEPT
|
|||
|
|
ip6tables -D INPUT -p tcp --dport 22 -j ACCEPT
|
|||
|
|
|
|||
|
|
# 允许指定IP地址访问22端口
|
|||
|
|
if [ -n "$ALLOWED_IPV4" ]; then
|
|||
|
|
iptables -A INPUT -p tcp -s $ALLOWED_IPV4 --dport 22 -j ACCEPT
|
|||
|
|
fi
|
|||
|
|
if [ -n "$ALLOWED_IPV6" ]; then
|
|||
|
|
ip6tables -A INPUT -p tcp -s $ALLOWED_IPV6 --dport 22 -j ACCEPT
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# 保存iptables规则
|
|||
|
|
iptables-save > /etc/iptables/rules.v4
|
|||
|
|
ip6tables-save > /etc/iptables/rules.v6
|
|||
|
|
|
|||
|
|
# 使规则在重启后生效
|
|||
|
|
netfilter-persistent save
|
|||
|
|
netfilter-persistent reload
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# 检查是否安装了ufw或iptables
|
|||
|
|
if command -v ufw &> /dev/null
|
|||
|
|
then
|
|||
|
|
configure_ufw
|
|||
|
|
|
|||
|
|
elif command -v iptables &> /dev/null
|
|||
|
|
then
|
|||
|
|
configure_iptables
|
|||
|
|
|
|||
|
|
else
|
|||
|
|
echo "没有安装ufw或iptables，正在安装iptables..."
|
|||
|
|
install_iptables
|
|||
|
|
configure_iptables
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
echo "防火墙规则配置完成"
|