主页 / computer / 问题 / 1423860
Accepted
Biel
Asked: 2019-04-11 08:23:33 +0800 CST

Debian 9 服务器上的 Node-RED 无法连接到 MQTT 代理

  • 772

我的 Node-RED 流程：

[{"id":"6c5780e.7e86f","type":"mqtt in","z":"fa8ef0ce.69a348","name":"","topic":"bs/esp8266/ldr","qos":"2","datatype":"auto","broker":"11952de3.32d7b2","x":320,"y":420,"wires":[["e5ac261a.a24058"]]},{"id":"11952de3.32d7b2","type":"mqtt-broker","z":"","name":"","broker":"localhost","port":"1883","clientid":"","usetls":false,"compatmode":true,"keepalive":"60","cleansession":true,"birthTopic":"","birthQos":"0","birthPayload":"","closeTopic":"","closeQos":"0","closePayload":"","willTopic":"","willQos":"0","willPayload":""}]

我有一个连接到本地主机（本地 mosquitto 服务器）的 MQTT 节点和连接到 HiveMQ 代理的 4 个节点。他们都无法连接。

我的 iptables 规则：

Chain INPUT (policy DROP 243 packets, 11542 bytes)
 pkts bytes target     prot opt in     out     source               destination
   34  1700 ACCEPT     all  --  lo     any     anywhere             anywhere
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:1883
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:1883
  735 80016 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:1880
  771 55433 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:3000

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy DROP 156 packets, 11397 bytes)
 pkts bytes target     prot opt in     out     source               destination
   34  1700 ACCEPT     all  --  any    lo      anywhere             anywhere
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:1883
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:1883
 1175 2794K ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:1880
 2369 6542K ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:3000

我可以从另一台机器（安装了 Node-RED 的 Windows 机器）连接到我的 mosquitto 服务器，甚至可以使用 MQTTS 和证书。

我在想也许问题取决于我的 iptables 规则，但我不确定，而且我是这个主题的初学者。先感谢您。

编辑：在修改我的 iptables 规则之前，我可以从我的 Windows 机器连接到代理。对于新的（我最初粘贴在这里的那些）它没有连接。我以前只使用过这些规则，当它仍然有效时：

sudo iptables -A INPUT -p tcp --dport 1883--jump ACCEPT
sudo iptables -A INPUT -p tcp --dport 8883--jump ACCEPT
linux networking debian

1 个回答

  1. Best Answer

    我的 iptables 规则确实有问题。我按照下一个脚本更改了它们（如果需要更改您的 ssh 端口，并添加您想要的规则）：

    #!/bin/bash

IPTABLES=/sbin/iptables

echo " * flushing old rules"
${IPTABLES} --flush
${IPTABLES} --delete-chain
${IPTABLES} --table nat --flush
${IPTABLES} --table nat --delete-chain

echo " * setting default policies"
${IPTABLES} -P INPUT DROP
${IPTABLES} -P FORWARD DROP
${IPTABLES} -P OUTPUT ACCEPT

echo " * allowing loopback devices"
${IPTABLES} -A INPUT -i lo -j ACCEPT
${IPTABLES} -A OUTPUT -o lo -j ACCEPT

${IPTABLES} -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
${IPTABLES} -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

## BLOCK ABUSING IPs HERE ##
#echo " * BLACKLIST"
#${IPTABLES} -A INPUT -s _ABUSIVE_IP_ -j DROP
#${IPTABLES} -A INPUT -s _ABUSIVE_IP2_ -j DROP

echo " * allowing ssh on port 22"
${IPTABLES} -A INPUT -p tcp --dport 34254  -m state --state NEW -j ACCEPT

echo " * allowing ftp on port 21"
${IPTABLES} -A INPUT -p tcp --dport 21  -m state --state NEW -j ACCEPT

echo " * allowing dns on port 53 udp"
${IPTABLES} -A INPUT -p udp -m udp --dport 53 -j ACCEPT

echo " * allowing dns on port 53 tcp"
${IPTABLES} -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT

echo " * allowing http on port 80"
${IPTABLES} -A INPUT -p tcp --dport 80  -m state --state NEW -j ACCEPT

echo " * allowing https on port 443"
${IPTABLES} -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

echo " * allowing smtp on port 25"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT

echo " * allowing submission on port 587"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT

echo " * allowing imaps on port 993"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT

echo " * allowing pop3s on port 995"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT

echo " * allowing imap on port 143"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT

echo " * allowing pop3 on port 110"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT

echo " * allowing mosquitto on ports 1883 and 8883"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 1883 -j ACCEPT
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 8883 -j ACCEPT

echo " * allowing grafana on port 3000"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 3000 -j ACCEPT

echo " * allowing node-red on port 1880"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 1880 -j ACCEPT

echo " * allowing ping responses"
${IPTABLES} -A INPUT -p ICMP --icmp-type 8 -j ACCEPT

# DROP everything else and Log it
${IPTABLES} -A INPUT -j LOG
${IPTABLES} -A INPUT -j DROP

#
# Save settings
#
echo " * SAVING RULES"

if [[ -d /etc/network/if-pre-up.d ]]; then
    if [[ ! -f /etc/network/if-pre-up.d/iptables ]]; then
        echo -e "#!/bin/bash" > /etc/network/if-pre-up.d/iptables
        echo -e "test -e /etc/iptables.rules && iptables-restore -c /etc/iptables.rules" >> /etc/network/if-pre-up.d/iptables
        chmod +x /etc/network/if-pre-up.d/iptables
    fi
fi

iptables-save > /etc/fwall.rules
iptables-restore -c /etc/fwall.rules

    我现在仍然无法从我的 debian 服务器连接到我自己的 mosquitto 代理，但这可能是凭据问题。我从这里得到了这个脚本。

    • 0

相关问题