这是Linux的iptables的一个很好的起点吗？

我是iptables的新手，我一直在试图把防火墙放在一起，目的是保护networking服务器。 下面的规则是我迄今为止所做的规定，我想听听规则是否合理 – 我是否遗漏了任何必要的规则？

除了端口80，我还需要为外部连接打开端口3306（mysql）和22（ssh）。

任何反馈是高度赞赏！

#!/bin/sh # Clear all existing rules. iptables -F # ACCEPT connections for loopback network connection, 127.0.0.1. iptables -A INPUT -i lo -j ACCEPT # ALLOW established traffic iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # DROP packets that are NEW but does not have the SYN but set. iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP # DROP fragmented packets, as there is no way to tell the source and destination ports of such a packet. iptables -A INPUT -f -j DROP # DROP packets with all tcp flags set (XMAS packets). iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP # DROP packets with no tcp flags set (NULL packets). iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # ALLOW ssh traffic (and prevent against DoS attacks) iptables -A INPUT -p tcp --dport ssh -m limit --limit 1/s -j ACCEPT # ALLOW http traffic (and prevent against DoS attacks) iptables -A INPUT -p tcp --dport http -m limit --limit 5/s -j ACCEPT # ALLOW mysql traffic (and prevent against DoS attacks) iptables -A INPUT -p tcp --dport mysql -m limit --limit 25/s -j ACCEPT # DROP any other traffic. iptables -A INPUT -j DROP 

• 邮件服务器锤击
• iptables不让SMTP通过
• iptables nat：通过PREROUTING链处理OUTPUT链/从OUTPUT转发到PREROUTING
• 这些防火墙设置足够安全的Ubuntu Web服务器？
• ipTables：如何改善目前的设置？