arno
919124af89
- 添加 DNS 全局配置脚本（含 IPv6 禁用、有线网卡静态 IP） - 添加 UFW 防火墙配置脚本（默认拒绝入站、允许出站） - 添加 Claude Code 本地权限与记忆配置
56 lines
1.5 KiB
Bash
Executable File
56 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ============================================================
|
|
# 防火墙配置脚本
|
|
# 功能: 默认拒绝所有入站连接，启用 UFW 并设置开机自启
|
|
# 用法: sudo bash firewall_setup.sh
|
|
# ============================================================
|
|
|
|
set -euo pipefail
|
|
|
|
# 颜色输出
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m' # No Color
|
|
|
|
echo "========================================"
|
|
echo " 防火墙配置脚本 (UFW)"
|
|
echo "========================================"
|
|
echo ""
|
|
|
|
# 检查是否以 root 运行
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo -e "${RED}[错误] 请使用 sudo 运行此脚本: sudo bash $0${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# 检查 UFW 是否已安装
|
|
if ! command -v ufw &> /dev/null; then
|
|
echo -e "${RED}[错误] UFW 未安装，请先安装: apt install ufw${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
echo ""
|
|
echo "==> 步骤 1/3: 设置默认策略 — 拒绝所有入站连接"
|
|
sudo ufw default deny incoming
|
|
echo -e "${GREEN}[完成] 入站默认策略已设为 deny${NC}"
|
|
|
|
echo ""
|
|
echo "==> 步骤 2/3: 允许出站连接"
|
|
sudo ufw default allow outgoing
|
|
echo -e "${GREEN}[完成] 出站默认策略已设为 allow${NC}"
|
|
|
|
echo ""
|
|
echo "==> 步骤 3/3: 启用 UFW（开机自启）"
|
|
sudo ufw --force enable
|
|
echo -e "${GREEN}[完成] UFW 已启用并设为开机自启${NC}"
|
|
|
|
echo ""
|
|
echo "========================================"
|
|
echo " 当前防火墙状态"
|
|
echo "========================================"
|
|
sudo ufw status verbose
|
|
|
|
echo ""
|
|
echo -e "${GREEN}防火墙配置完成！${NC}"
|