主页 / user-1793457

Questionz's questions

Martin Hope
Questionz
Asked: 2023-04-26 21:27:47 +0800 CST
  • 7

我将旧的 iptables v1.4.7 与 fail2ban 结合使用。然而，我在日志中看到“已经被禁止”的消息，并且无法弄清楚为什么它们仍然到达我的服务器并且没有被 f2b -ASTERISK部分阻止，如下所示。您是否看到以下内容乍一看不起作用的任何原因？我检查了其他答案，但他们没有透露任何信息。这是输出：

[root@server bin]# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
f2b-ASTERISK  udp  --  anywhere             anywhere            udp dpt:sip
DROP       udp  --  anywhere             anywhere            udp dpt:sip STRING match "friendly-scanner" ALGO name bm TO 65535
DROP       udp  --  anywhere             anywhere            udp dpt:sip STRING match "VaxSIPUserAgent" ALGO name bm TO 65535
DROP       udp  --  anywhere             anywhere            udp dpt:sip STRING match "VaxIPUserAgent" ALGO name bm TO 65535
DROP       udp  --  anywhere             anywhere            udp dpt:sip STRING match "sundayddr" ALGO name bm TO 65535
DROP       udp  --  anywhere             anywhere            udp dpt:sip STRING match "sipsak" ALGO name bm TO 65535
DROP       udp  --  anywhere             anywhere            udp dpt:sip STRING match "sipvicious" ALGO name bm TO 65535
DROP       udp  --  anywhere             anywhere            udp dpt:sip STRING match "iWar" ALGO name bm TO 65535
...
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2346 flags:0x17/0x02 limit: avg 1/min burst 3
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2346 flags:0x17/0x02
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 state NEW
DROP       all  -f  0.0.0.0/0            0.0.0.0/0
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x3F
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x00
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           limit: avg 5/sec burst 5
DROP       icmp --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:5060
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:5060
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:4569
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpts:10000:20000
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 flags:0x17/0x02 limit: avg 100/sec burst 100
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 flags:0x17/0x02
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:5666

...

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain f2b-ASTERISK (1 references)
target     prot opt source               destination
DROP       all  --  ip16.ip-54-37-90.eu  anywhere
DROP       all  --  207.231.108.225      anywhere
...

fail2ban.log：

2023-04-23 09:50:30,881 fail2ban.actions        [26615]: NOTICE  [asterisk-iptables] 207.231.108.225 already banned

当我检查 ip 时，它列在 f2b-ASTERISK 中：

[root@server bin]# iptables -L -n | grep "193.32.162.159"
DROP       all  --  207.231.108.225       0.0.0.0/0
iptables