351 lines
11 KiB
Bash
351 lines
11 KiB
Bash
#!/bin/bash
|
||
# FRP 服务器防火墙配置脚本
|
||
# 功能：封禁攻击IP，设置连接速率限制
|
||
|
||
echo "========================================"
|
||
echo " FRP 服务器防火墙安全加固"
|
||
echo "========================================"
|
||
echo ""
|
||
|
||
# 服务器信息
|
||
SERVER_IP="180.97.221.140"
|
||
SERVER_USER="root"
|
||
SERVER_PASS="NEjoy4h8B9Fa"
|
||
|
||
# 检查 sshpass
|
||
if ! command -v sshpass &> /dev/null; then
|
||
echo "❌ 错误：需要安装 sshpass"
|
||
exit 1
|
||
fi
|
||
|
||
echo "🔗 连接到服务器..."
|
||
echo ""
|
||
|
||
sshpass -p "$SERVER_PASS" ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no "$SERVER_USER@$SERVER_IP" << 'ENDSSH'
|
||
|
||
echo "✅ 已连接到服务器"
|
||
echo ""
|
||
|
||
# ========================================
|
||
# 第一步：分析日志，找出攻击IP
|
||
# ========================================
|
||
echo "🔍 第一步：分析最近24小时的攻击IP..."
|
||
echo ""
|
||
|
||
# 提取攻击IP（连接次数超过100的IP，排除白名单）
|
||
echo "正在分析日志..."
|
||
ATTACK_IPS=$(grep 'get a user connection' /var/log/frps.log | \
|
||
awk '{match($0, /\[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+\]/);
|
||
ip = substr($0, RSTART+1, RLENGTH-2);
|
||
if(ip != "") {split(ip, a, ":"); print a[1]}}' | \
|
||
sort | uniq -c | sort -rn | \
|
||
awk '$1 > 100 {print $2}' | \
|
||
grep -v '^127\.' | \
|
||
grep -v '^10\.' | \
|
||
grep -v '^172\.1[6-9]\.' | \
|
||
grep -v '^172\.2[0-9]\.' | \
|
||
grep -v '^172\.3[0-1]\.' | \
|
||
grep -v '^192\.168\.')
|
||
|
||
echo "⚪ 白名单（永不封禁）："
|
||
echo " - 127.0.0.0/8 (本地回环地址)"
|
||
echo " - 10.0.0.0/8 (私有网络A类)"
|
||
echo " - 172.16.0.0/12 (私有网络B类)"
|
||
echo " - 192.168.0.0/16 (私有网络C类)"
|
||
echo ""
|
||
|
||
echo "🔴 发现以下高频攻击IP（连接次数 > 100）："
|
||
echo "$ATTACK_IPS" | nl
|
||
echo ""
|
||
|
||
ATTACK_COUNT=$(echo "$ATTACK_IPS" | wc -l | tr -d ' ')
|
||
echo "总计：$ATTACK_COUNT 个攻击IP"
|
||
echo ""
|
||
|
||
# ========================================
|
||
# 第二步：备份当前防火墙规则
|
||
# ========================================
|
||
echo "💾 第二步：备份当前防火墙规则..."
|
||
echo ""
|
||
|
||
mkdir -p /root/firewall-backup
|
||
iptables-save > /root/firewall-backup/iptables-backup-$(date +%Y%m%d-%H%M%S).rules
|
||
echo "✅ 防火墙规则已备份到 /root/firewall-backup/"
|
||
echo ""
|
||
|
||
# ========================================
|
||
# 第三步：创建防火墙规则
|
||
# ========================================
|
||
echo "🛡️ 第三步：设置防火墙规则..."
|
||
echo ""
|
||
|
||
# 检查是否已经有 FRP_BLACKLIST 链
|
||
if ! iptables -L FRP_BLACKLIST -n &> /dev/null; then
|
||
echo "创建 FRP_BLACKLIST 链..."
|
||
iptables -N FRP_BLACKLIST
|
||
iptables -I INPUT -j FRP_BLACKLIST
|
||
echo "✅ FRP_BLACKLIST 链已创建"
|
||
else
|
||
echo "⚠️ FRP_BLACKLIST 链已存在，清空旧规则..."
|
||
iptables -F FRP_BLACKLIST
|
||
fi
|
||
echo ""
|
||
|
||
# 封禁攻击IP
|
||
echo "🚫 封禁攻击IP..."
|
||
BLOCKED=0
|
||
for ip in $ATTACK_IPS; do
|
||
# 检查IP是否已被封禁
|
||
if ! iptables -C FRP_BLACKLIST -s $ip -j DROP 2>/dev/null; then
|
||
iptables -A FRP_BLACKLIST -s $ip -j DROP
|
||
echo " ✅ 已封禁：$ip"
|
||
BLOCKED=$((BLOCKED + 1))
|
||
else
|
||
echo " ⏭️ 已存在：$ip"
|
||
fi
|
||
done
|
||
echo ""
|
||
echo "✅ 成功封禁 $BLOCKED 个新IP"
|
||
echo ""
|
||
|
||
# ========================================
|
||
# 第四步：设置连接速率限制
|
||
# ========================================
|
||
echo "⚡ 第四步：设置连接速率限制..."
|
||
echo ""
|
||
|
||
# FRP主端口(7000)的速率限制
|
||
if ! iptables -L INPUT -n | grep -q "dpt:7000.*limit:"; then
|
||
iptables -I INPUT -p tcp --dport 7000 -m state --state NEW -m recent --set --name FRP_CONN
|
||
iptables -I INPUT -p tcp --dport 7000 -m state --state NEW -m recent --update --seconds 60 --hitcount 100 --name FRP_CONN -j DROP
|
||
echo "✅ FRP主端口(7000)：限制每IP每分钟最多100个新连接"
|
||
else
|
||
echo "⏭️ FRP主端口(7000)速率限制已存在"
|
||
fi
|
||
echo ""
|
||
|
||
# SSH代理端口的速率限制
|
||
SSH_PORTS="2322 2323 6000"
|
||
for port in $SSH_PORTS; do
|
||
if ! iptables -L INPUT -n | grep -q "dpt:$port.*limit:"; then
|
||
iptables -I INPUT -p tcp --dport $port -m state --state NEW -m recent --set --name SSH_$port
|
||
iptables -I INPUT -p tcp --dport $port -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name SSH_$port -j DROP
|
||
echo "✅ SSH代理端口($port)：限制每IP每分钟最多10个新连接"
|
||
else
|
||
echo "⏭️ SSH代理端口($port)速率限制已存在"
|
||
fi
|
||
done
|
||
echo ""
|
||
|
||
# ========================================
|
||
# 第五步：保存防火墙规则（持久化）
|
||
# ========================================
|
||
echo "💾 第五步：保存防火墙规则（重启后生效）..."
|
||
echo ""
|
||
|
||
# 检查系统类型
|
||
if command -v iptables-save &> /dev/null; then
|
||
# CentOS 7
|
||
if [ -f /etc/sysconfig/iptables ]; then
|
||
iptables-save > /etc/sysconfig/iptables
|
||
echo "✅ 规则已保存到 /etc/sysconfig/iptables"
|
||
fi
|
||
|
||
# 确保 iptables 服务开机启动
|
||
if command -v systemctl &> /dev/null; then
|
||
if systemctl list-unit-files | grep -q iptables.service; then
|
||
systemctl enable iptables 2>/dev/null || echo "⚠️ 无法设置 iptables 开机启动"
|
||
fi
|
||
fi
|
||
fi
|
||
echo ""
|
||
|
||
# ========================================
|
||
# 第六步：显示当前防火墙状态
|
||
# ========================================
|
||
echo "📊 第六步：当前防火墙状态"
|
||
echo ""
|
||
|
||
echo "--- FRP_BLACKLIST 链（黑名单）---"
|
||
iptables -L FRP_BLACKLIST -n -v | head -20
|
||
TOTAL_BLOCKED=$(iptables -L FRP_BLACKLIST -n | grep DROP | wc -l)
|
||
echo ""
|
||
echo "总计封禁：$TOTAL_BLOCKED 个IP"
|
||
echo ""
|
||
|
||
echo "--- 速率限制规则 ---"
|
||
iptables -L INPUT -n -v | grep -E "limit:|recent:"
|
||
echo ""
|
||
|
||
# ========================================
|
||
# 第七步：创建管理脚本
|
||
# ========================================
|
||
echo "📝 第七步：创建管理脚本..."
|
||
echo ""
|
||
|
||
cat > /root/frp-firewall-manager.sh << 'MANAGER_SCRIPT'
|
||
#!/bin/bash
|
||
# FRP 防火墙管理脚本
|
||
|
||
case "$1" in
|
||
list)
|
||
echo "=== 当前黑名单IP ==="
|
||
iptables -L FRP_BLACKLIST -n | grep DROP | awk '{print $4}' | nl
|
||
;;
|
||
|
||
add)
|
||
if [ -z "$2" ]; then
|
||
echo "用法: $0 add <IP地址>"
|
||
exit 1
|
||
fi
|
||
iptables -A FRP_BLACKLIST -s $2 -j DROP
|
||
echo "✅ 已封禁：$2"
|
||
# 保存规则
|
||
iptables-save > /etc/sysconfig/iptables 2>/dev/null || true
|
||
;;
|
||
|
||
del)
|
||
if [ -z "$2" ]; then
|
||
echo "用法: $0 del <IP地址>"
|
||
exit 1
|
||
fi
|
||
iptables -D FRP_BLACKLIST -s $2 -j DROP
|
||
echo "✅ 已解封：$2"
|
||
# 保存规则
|
||
iptables-save > /etc/sysconfig/iptables 2>/dev/null || true
|
||
;;
|
||
|
||
clear)
|
||
read -p "确定要清空所有黑名单规则吗？(yes/no): " confirm
|
||
if [ "$confirm" = "yes" ]; then
|
||
iptables -F FRP_BLACKLIST
|
||
echo "✅ 黑名单已清空"
|
||
iptables-save > /etc/sysconfig/iptables 2>/dev/null || true
|
||
fi
|
||
;;
|
||
|
||
stats)
|
||
echo "=== 防火墙统计 ==="
|
||
echo "黑名单IP数量：$(iptables -L FRP_BLACKLIST -n | grep DROP | wc -l)"
|
||
echo ""
|
||
echo "=== 被拦截最多的IP（前10）==="
|
||
iptables -L FRP_BLACKLIST -n -v | grep DROP | sort -rn -k1 | head -10
|
||
;;
|
||
|
||
update)
|
||
echo "正在分析日志更新黑名单..."
|
||
NEW_IPS=$(grep 'get a user connection' /var/log/frps.log | \
|
||
awk '{match($0, /\[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+\]/);
|
||
ip = substr($0, RSTART+1, RLENGTH-2);
|
||
if(ip != "") {split(ip, a, ":"); print a[1]}}' | \
|
||
sort | uniq -c | sort -rn | \
|
||
awk '$1 > 100 {print $2}' | \
|
||
grep -v '^127\.' | \
|
||
grep -v '^10\.' | \
|
||
grep -v '^172\.1[6-9]\.' | \
|
||
grep -v '^172\.2[0-9]\.' | \
|
||
grep -v '^172\.3[0-1]\.' | \
|
||
grep -v '^192\.168\.')
|
||
|
||
ADDED=0
|
||
for ip in $NEW_IPS; do
|
||
if ! iptables -C FRP_BLACKLIST -s $ip -j DROP 2>/dev/null; then
|
||
iptables -A FRP_BLACKLIST -s $ip -j DROP
|
||
echo " ✅ 新增封禁：$ip"
|
||
ADDED=$((ADDED + 1))
|
||
fi
|
||
done
|
||
|
||
if [ $ADDED -eq 0 ]; then
|
||
echo "✅ 没有发现新的攻击IP"
|
||
else
|
||
echo "✅ 新增封禁 $ADDED 个IP"
|
||
iptables-save > /etc/sysconfig/iptables 2>/dev/null || true
|
||
fi
|
||
;;
|
||
|
||
*)
|
||
echo "FRP 防火墙管理工具"
|
||
echo ""
|
||
echo "用法: $0 {命令} [参数]"
|
||
echo ""
|
||
echo "命令："
|
||
echo " list - 查看黑名单"
|
||
echo " add <IP> - 添加IP到黑名单"
|
||
echo " del <IP> - 从黑名单移除IP"
|
||
echo " clear - 清空黑名单"
|
||
echo " stats - 查看统计信息"
|
||
echo " update - 自动更新黑名单（分析日志）"
|
||
echo ""
|
||
echo "示例："
|
||
echo " $0 list"
|
||
echo " $0 add 1.2.3.4"
|
||
echo " $0 del 1.2.3.4"
|
||
echo " $0 update"
|
||
;;
|
||
esac
|
||
MANAGER_SCRIPT
|
||
|
||
chmod +x /root/frp-firewall-manager.sh
|
||
echo "✅ 管理脚本已创建：/root/frp-firewall-manager.sh"
|
||
echo ""
|
||
|
||
# ========================================
|
||
# 第八步：设置定时任务
|
||
# ========================================
|
||
echo "⏰ 第八步：设置定时任务..."
|
||
echo ""
|
||
|
||
# 检查是否已有定时任务
|
||
if ! crontab -l 2>/dev/null | grep -q "frp-firewall-manager.sh update"; then
|
||
# 添加定时任务：每1小时自动更新黑名单
|
||
(crontab -l 2>/dev/null; echo "0 * * * * /root/frp-firewall-manager.sh update >> /var/log/frp-firewall-update.log 2>&1") | crontab -
|
||
echo "✅ 已设置定时任务：每1小时自动更新黑名单"
|
||
else
|
||
echo "⏭️ 定时任务已存在"
|
||
fi
|
||
echo ""
|
||
|
||
# ========================================
|
||
# 完成
|
||
# ========================================
|
||
echo "========================================"
|
||
echo "✅ 防火墙配置完成！"
|
||
echo "========================================"
|
||
echo ""
|
||
|
||
echo "📋 配置摘要："
|
||
echo " - 封禁IP数量：$TOTAL_BLOCKED 个"
|
||
echo " - 速率限制：已启用"
|
||
echo " - 管理工具：/root/frp-firewall-manager.sh"
|
||
echo " - 自动更新：每1小时"
|
||
echo ""
|
||
|
||
echo "🔧 常用管理命令："
|
||
echo " 查看黑名单：/root/frp-firewall-manager.sh list"
|
||
echo " 添加IP： /root/frp-firewall-manager.sh add <IP>"
|
||
echo " 移除IP： /root/frp-firewall-manager.sh del <IP>"
|
||
echo " 查看统计： /root/frp-firewall-manager.sh stats"
|
||
echo " 更新黑名单：/root/frp-firewall-manager.sh update"
|
||
echo ""
|
||
|
||
echo "📊 当前被封禁的主要攻击者："
|
||
echo "$ATTACK_IPS" | head -5 | nl
|
||
echo ""
|
||
|
||
ENDSSH
|
||
|
||
if [ $? -eq 0 ]; then
|
||
echo ""
|
||
echo "🎉 配置成功完成！"
|
||
echo ""
|
||
echo "下一步建议："
|
||
echo " 1. 测试您的服务是否正常访问"
|
||
echo " 2. 监控日志确认攻击被拦截"
|
||
echo " 3. 定期查看统计信息"
|
||
else
|
||
echo ""
|
||
echo "❌ 配置失败，请检查连接"
|
||
fi
|
||
|