如何编写批量添加防火墙规则脚本

wen 实用脚本 2026-07-29 1

本文目录导读：

如何编写批量添加防火墙规则脚本

Linux iptables 批量添加规则
Linux firewalld 批量添加规则
Windows PowerShell 防火墙脚本
Cisco IOS 批量配置脚本
高级功能脚本
使用建议

Linux iptables 批量添加规则

基本脚本模板

#!/bin/bash
# 批量添加iptables规则脚本
# 保存为 add_rules.sh
# 定义规则数组
RULES=(
    "-A INPUT -p tcp --dport 80 -j ACCEPT"
    "-A INPUT -p tcp --dport 443 -j ACCEPT"
    "-A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT"
    "-A INPUT -s 10.0.0.0/8 -j DROP"
    "-A OUTPUT -p tcp --dport 53 -j ACCEPT"
)
# 批量添加规则
for RULE in "${RULES[@]}"
do
    echo "添加规则: iptables $RULE"
    iptables $RULE
done
# 保存规则
iptables-save > /etc/iptables/rules.v4

从文件读取规则

#!/bin/bash
# 规则文件格式: 每行一条规则
#  rules.txt内容:
# -A INPUT -p tcp --dport 80 -j ACCEPT
# -A INPUT -p tcp --dport 443 -j ACCEPT
RULE_FILE="rules.txt"
if [ ! -f "$RULE_FILE" ]; then
    echo "规则文件 $RULE_FILE 不存在"
    exit 1
fi
while IFS= read -r RULE
do
    if [ -n "$RULE" ] && [[ ! "$RULE" =~ ^# ]]; then
        echo "添加规则: iptables $RULE"
        iptables $RULE
    fi
done < "$RULE_FILE"
iptables-save > /etc/iptables/rules.v4

Linux firewalld 批量添加规则

#!/bin/bash
# 批量添加firewalld规则
# 开启服务
SERVICES=("http" "https" "ssh")
for SERVICE in "${SERVICES[@]}"
do
    firewall-cmd --permanent --add-service=$SERVICE
done
# 添加端口
PORTS=("8080/tcp" "3306/tcp" "5432/tcp")
for PORT in "${PORTS[@]}"
do
    firewall-cmd --permanent --add-port=$PORT
done
# 添加源地址规则
SOURCES=("192.168.1.0/24" "10.0.0.0/8")
for SOURCE in "${SOURCES[@]}"
do
    firewall-cmd --permanent --add-source=$SOURCE
done
# 重新加载生效
firewall-cmd --reload

Windows PowerShell 防火墙脚本

# Windows防火墙批量添加规则脚本
# 定义规则数组
$rules = @(
    @{
        Name = "允许HTTP"
        Protocol = "TCP"
        LocalPort = 80
        Action = "Allow"
    },
    @{
        Name = "允许HTTPS"
        Protocol = "TCP"
        LocalPort = 443
        Action = "Allow"
    },
    @{
        Name = "允许内部SSH"
        Protocol = "TCP"
        LocalPort = 22
        RemoteAddress = "192.168.1.0/24"
        Action = "Allow"
    }
)
# 批量添加规则
foreach ($rule in $rules) {
    $params = @{
        Name = $rule.Name
        DisplayName = $rule.Name
        Protocol = $rule.Protocol
        LocalPort = $rule.LocalPort
        Action = $rule.Action
        Direction = "Inbound"
        Enabled = "True"
        Profile = "Any"
    }
    if ($rule.RemoteAddress) {
        $params.RemoteAddress = $rule.RemoteAddress
    }
    try {
        New-NetFirewallRule @params
        Write-Host "添加规则: $($rule.Name)"
    }
    catch {
        Write-Host "添加规则失败: $($rule.Name) - $_"
    }
}

Cisco IOS 批量配置脚本

#!/bin/bash
# Cisco IOS 防火墙规则批量配置
# SSH到交换机执行命令
DEVICE="192.168.1.1"
USER="admin"
PASS="password"
# 规则列表
RULES=(
    "access-list 100 permit tcp any any eq 80"
    "access-list 100 permit tcp any any eq 443"
    "access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 22"
    "access-list 100 deny ip any any log"
)
# 生成配置命令
{
    echo "configure terminal"
    for RULE in "${RULES[@]}"
    do
        echo "$RULE"
    done
    echo "interface GigabitEthernet0/1"
    echo "ip access-group 100 in"
    echo "end"
    echo "write memory"
} | sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no $USER@$DEVICE

高级功能脚本

带备份和回滚功能

#!/bin/bash
# 带备份功能的防火墙规则批量添加脚本
BACKUP_DIR="/tmp/firewall_backup_$(date +%Y%m%d_%H%M%S)"
mkdir -p $BACKUP_DIR
# 备份当前规则
echo "备份当前规则..."
iptables-save > "$BACKUP_DIR/rules.backup"
# 添加新规则
echo "添加新规则..."
RULES=("$@")
SUCCESS=0
FAILED=0
for RULE in "${RULES[@]}"
do
    if iptables $RULE; then
        echo "✓ 成功: $RULE"
        ((SUCCESS++))
    else
        echo "✗ 失败: $RULE"
        ((FAILED++))
        echo "错误规则: $RULE" >> "$BACKUP_DIR/failed_rules.log"
    fi
done
# 提示回滚方法
echo "===================="
echo "规则添加完成"
echo "成功: $SUCCESS, 失败: $FAILED"
echo "备份位置: $BACKUP_DIR/rules.backup"
echo "回滚命令: iptables-restore < $BACKUP_DIR/rules.backup"

使用配置文件

# rules.yaml 配置文件示例
rules:
  - action: "ACCEPT"
    protocol: "tcp"
    port: 80
    comment: "HTTP"
  - action: "ACCEPT"
    protocol: "tcp"
    port: 443
    comment: "HTTPS"
  - action: "ACCEPT"
    protocol: "tcp"
    port: 22
    source: "192.168.1.0/24"
    comment: "内部SSH"
  - action: "DROP"
    protocol: "tcp"
    port: 3306
    source: "0.0.0.0/0"
    comment: "阻止外部Mysql"

#!/bin/bash
# 读取YAML配置添加规则 (需要yq工具)
RULES_FILE="rules.yaml"
# 解析YAML并添加规则
yq e '.rules[]' $RULES_FILE | while IFS= read -r RULE
do
    # 构建iptables命令
    CMD="iptables -A INPUT"
    ACTION=$(yq e ".rules[] | select(.comment==\"$RULE.comment\") | .action" $RULES_FILE)
    PROTO=$(yq e ".rules[] | select(.comment==\"$RULE.comment\") | .protocol" $RULES_FILE)
    PORT=$(yq e ".rules[] | select(.comment==\"$RULE.comment\") | .port" $RULES_FILE)
    SOURCE=$(yq e ".rules[] | select(.comment==\"$RULE.comment\") | .source" $RULES_FILE)
    CMD="$CMD -p $PROTO --dport $PORT"
    [ -n "$SOURCE" ] && CMD="$CMD -s $SOURCE"
    CMD="$CMD -j $ACTION"
    echo "执行: $CMD"
    eval $CMD
done

使用建议

测试环境先测试：在测试环境验证脚本
备份当前规则：添加前备份现有规则
逐步添加：不要一次性添加太多规则
错误处理：添加错误恢复机制
日志记录：记录添加的规则和执行结果
权限控制：使用适当的用户权限执行

根据你的具体需求选择合适的脚本模板,并调整相应的规则内容。