Linux Firewall
*/3 * * * * root tail -1000 /var/log/httpd/access_log |awk ‘($10 == 200)&&($11==2300){ print $2 }’|sort |uniq -dc|awk ‘ $1 >100{ print $2 }’>/var/www/black.list
*/5 * * * * root /root/fire.sh >> /root/fire.log
28 * * * * root /root/flush.sh >> /root/fire.log
/root/fire.sh
#!/bin/sh
echo “ipadd=====================Time:`date +%r`:===================”;
if [ -s "/var/www/black.list" ];then
for i in `cat /var/www/black.list`;do
iptables -I INPUT -p TCP -s $i –dport 80 -j REJECT
echo $i;
done;
fi
echo “===========================end===============================”;
exit 0
/root/flush.sh
#!/bin/sh
iptables -Z;
sleep 40;
iptables -vnxL INPUT|awk ‘$1==0&&$2==0{ print $8 }’|xargs -t -i iptables -D INPUT -p TCP -s {} –dport 80 -j REJECT;
echo “`date +%r`”;
exit 0
