#!/bin/bash

#無源IP限制的埠
TCP_DPORT="80 443 3306 3690"
UDP_DPORT=""

#帶有源IP限制的埠
S_TCP_IP=""
S_TCP_MAC=""
S_TCP_DPORT=""

S_UDP_IP=""
S_UDP_MAC=""
S_UDP_DPORT=""

#黑名單IP,禁止接入
DROP_IP=""

#系統版本,輸入大版本號,6(Centos 6)或者7(Centos 7)
sysver=


if [[ ! -n $sysver ]];then
	while true;
	do
		read -p "請選擇系統版本[1.Centos6 2.Centos7]: " version
		case $version in
				1)
				sysver=6
				break;
				;;
				2)
				sysver=7
				break;
				;;
				*)
				echo "----請輸入1或者2----"
				;;
		esac
	done		
fi

function config_iptables() {
#判斷SSH埠
if [ ! -n "$(egrep -wi Port /etc/ssh/sshd_config | grep -v \#)" ];then
        sshport=22
else
        sshport=$(egrep -wi "Port" /etc/ssh/sshd_config |grep -v \# |awk -F" " '{print $2}')
fi

iptables -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport $sshport -j ACCEPT
if [[ -n ${TCP_DPORT} ]];then
	for t_prot in ${TCP_DPORT};
		do
			iptables -A INPUT -p tcp -m tcp --dport ${t_prot} -j ACCEPT
		done
fi

if [[ -n ${UDP_DPORT} ]];then
	for u_port in ${UDP_DPORT};
		do
			iptables -A INPUT -p udp --dport ${u_port} -j ACCEPT
		done
fi

if [[ -n ${S_TCP_IP} && -n ${S_TCP_DPORT} ]];then
	for ip in ${S_TCP_IP};
		do
			for s_tport in ${S_TCP_DPORT};
				do
					iptables -A INPUT -p tcp -m tcp -s $ip --dport ${s_tport} -j ACCEPT
				done
		done
fi

if [[ -n ${S_TCP_MAC} && -n ${S_TCP_DPORT} ]];then
	for tmac in ${S_TCP_MAC};
		do
			for s_tport in ${S_TCP_DPORT};
				do
					iptables -A INPUT -p tcp -m mac --mac-source $tmac --dport ${s_tport} -j ACCEPT
				done
		done
fi

if [[ -n ${S_UDP_IP} && -n ${S_UDP_DPORT} ]];then
	for ip in ${S_UDP_IP};
		do
			for s_uport in ${S_UDP_DPORT};
				do
					iptables -A INPUT -p udp -s $ip --dport ${s_uport} -j ACCEPT
				done
		done
fi

if [[ -n ${S_UDP_MAC} && -n ${S_UDP_DPORT} ]];then
	for umac in ${S_UDP_MAC};
		do
			for s_uport in ${S_UDP_DPORT};
				do
					iptables -A INPUT -p udp -m mac --mac-source $umac --dport ${s_uport} -j ACCEPT
				done
		done
fi
if [[ -n ${DROP_IP} ]];then
	for d_ip in ${DROP_IP};
		do
			iptables -I INPUT -s ${d_ip} -j DROP
		done
fi
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
}

function main() {
if (( "$sysver" == "6" ));then
	echo "*/5 * * * * /etc/init.d/iptables stop" >> /var/spool/cron/root
	echo -e "[\033[35mINFO\033[0m] [開始配置防火牆策略,並加入每5分鐘關閉防火牆服務的定時任務,如稍後無法連線伺服器,請靜等五分鐘再嘗試連線]"
	/etc/init.d/iptables restart
	sleep 3
	config_iptables
	/etc/init.d/iptables save
	echo -e "[\033[32mOK\033[0m] [防火牆策略已生效,測試無問題後請在5分鐘內刪除關閉防火牆服務的定時任務]"
elif (( "$sysver" == "7" ));then
	echo "*/5 * * * * /bin/systemctl stop firewalld" >> /var/spool/cron/root
	echo -e "[\033[35mINFO\033[0m] [開始配置防火牆策略,並加入每5分鐘關閉防火牆服務的定時任務,如稍後無法連線伺服器,請靜等五分鐘再嘗試連線]"
	systemctl restart firewalld
	sleep 3
	config_iptables
	echo -e "[\033[32mOK\033[0m] [防火牆策略已生效,測試無問題後請在5分鐘內刪除關閉防火牆服務的定時任務]"
else
	echo "不正確的版本號,請檢查指令碼"
	exit 0
fi
}
main