传入ACCEPT所有iptables规则仍然出现

8

我在这里遵循此指南：http : //isalazyadmin.net/2009/07/02/configuring-a-basic-firewall-for-debian-linux/

而且，我列出了列出的iptables，但是我的服务器似乎仍在接受所有传入的连接（即：即使我不允许这些端口，bittorrent同行仍在连接）。

/etc/iptables.rules

*filter

# This will allow all loopback (lo0) traffic and drop all traffic to 127/8
# that does not use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

#  This accepts all already established connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# This allows all outbound traffic
-A OUTPUT -j ACCEPT

# This will allow HTTP and HTTPS connections from anywhere, this are the normal
# ports used for a web server
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

# Allow SSH connections
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow bittorrent/rtorrent ports, from ~/.rtorrent.rc
## -A INPUT -p tcp --dport 8071:8079 -j ACCEPT


# Allow ICMP ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# Reject all other inbound traffic
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

重新引导后运行iptables -L时，我仍然将其作为第一条规则：

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere

不知道这是从哪里来的。

这是完整列表：

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere

这是iptables-save的输出：

# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013
*raw
:PREROUTING ACCEPT [6701:942626]
:OUTPUT ACCEPT [8927:989420]
COMMIT
# Completed on Fri Jan 11 09:54:19 2013
# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013
*nat
:PREROUTING ACCEPT [3281:284415]
:INPUT ACCEPT [9:720]
:OUTPUT ACCEPT [1758:148908]
:POSTROUTING ACCEPT [1758:148908]
COMMIT
# Completed on Fri Jan 11 09:54:19 2013
# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013
*mangle
:PREROUTING ACCEPT [6701:942626]
:INPUT ACCEPT [6701:942626]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [8928:989684]
:POSTROUTING ACCEPT [8928:989684]
COMMIT
# Completed on Fri Jan 11 09:54:19 2013
# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT 
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -j REJECT --reject-with icmp-port-unreachable 
-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A OUTPUT -j ACCEPT 
COMMIT
# Completed on Fri Jan 11 09:54:19 2013

这是iptables -vL输出：

$ sudo iptables -vL
[sudo] password for ettinger: 
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 8303 1206K ACCEPT     all  --  lo     any     anywhere             anywhere            
    0     0 REJECT     all  --  !lo    any     anywhere             loopback/8          reject-with icmp-port-unreachable 
  12M 7191M ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 
   18   980 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:www 
    7   344 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https 
  379 22728 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:ssh 
18316 1110K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpts:8071:8079 
 120K   15M ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpt:6881 
24809 1489K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:9001 
  688 35244 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:9030 
  874 73072 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-request 
12705  871K REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  14M   12G ACCEPT     all  --  any    any     anywhere             anywhere
debian  iptables 
— 汤汁
source
您是否没有注意到您的第一个INPUT规则ACCEPT all -- anywhere anywhere？
— ott--
1
似乎在引导时未加载规则。确保在您的/ etc / network / interfaces文件中添加了“ pre-up iptables-restore </etc/iptables.rules”行（如教程作者所建议的那样）
— mzet 2013年
1
@ott：它只涉及接口，所以没关系
— mzet
2
您可以与重做清单iptables -vL吗？
— ott--
您的规则和开机后状态实际上确实匹配，这不是问题所在–请参阅我的回答;）
— goldilocks 2013年

Answers:

17

您担心的那条线：

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere

实际上是因为您的规则中这样：

-A INPUT -i lo -j ACCEPT

请注意，该接口在规则中是显式的，但在-L输出中却不是。将该规则移到列表的中间，使用iptables-restore并注意“接受所有位置-任何地方”也已向下移动。现在尝试稍微修改一下规则：

-A INPUT -i lo -s 127.0.0.1 -j ACCEPT

和-L输出将变为：

target     prot opt source                 destination  
ACCEPT     all  --  localhost.localdomain  anywhere

“ localhost.localdomain”将是来自您的127.0.0.1主机名/etc/hosts。这至少使该规则的来源更加清晰。

您还可以查看更多详细信息，包括与的接口iptables -vL。

顺便说一句，您可能要启动规则：

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

为了安全起见，默认情况下应丢弃所有内容。但是，这被认为是不好的举止（请参阅下面的Gilles评论中的链接），因此您可能希望为每个使用的表创建最终捕获-j REJECT --reject-with icmp-net-prohibited。

— 金发姑娘
source
4
仅供参考，iptables -vL将显示完整的规则，包括界面。因此，它将消除这种混乱。
— derobert
感谢@derobert-我忘记了那个显示器。将其编辑成答案！
— goldilocks 2013年
2
关于默认情况下丢弃所有内容：拒绝具有ICMP错误的IP数据包，还是只是丢弃它们？
— 吉尔斯2013年
@derobert +1在-v开关上。我的防火墙规则看起来没有我想的那么糟:)
— rdev5 '16
1

出于完整性考虑，为了避免将来出现此问题，-v在显示表时请使用详细命令行选项。因此：

iptables -Lv

现在，输出应在“输入”和“输出”列中包括它影响的接口：

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  151 13073 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
  126 33414 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited
— D b_
source
-1

问题出在INPUT链的这一部分：

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere

特别是在最后一行。此行之后的所有内容都是不必要的，因为此行接受所有想法。

您必须通过以下命令从规则中删除此行：

iptables -D INPUT 1

您必须检查防火墙规则（规则在哪里），并添加此行。

— 扬·马雷克（Jan Marek）
source
7
“接受所有-任何地方的任何地方”都来自以下规则：“-A INPUT -i lo -j ACCEPT”，因此仅关注lo接口，所以这不是问题。
— mzet
我删除了所有内容，但仍显示iptables -L
— chovy
好，那是别人提到的。谢谢。我可以放心地忽略它。
— chovy
1
@chovy：您的规则还可以。问题在于重新启动后还原它。尝试执行以下步骤：debian-administration.org/articles/445
— mzet 2013年
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.