Início / ubuntu / 问题

Perguntas[firewall](ubuntu)

Martin Hope
joebird
Asked: 2024-01-03 12:32:59 +0800 CST
  • 5

Instalei o vsftpd e estou usando o ufw como meu firewall. Posso me conectar ao servidor FTP, fazer login e alterar diretórios, mas qualquer tentativa de usar um comando LIST expira tanto no host externo quanto no local. Ao ler outras respostas, sou levado a acreditar que isso se deve ao fato de minhas portas passivas não terem sido abertas corretamente. No entanto, pelo que sei, as portas estão abertas no ufw. Além disso, quando executo ufw disablee tento novamente, o problema ainda ocorre. O fato de isso acontecer no mesmo host do servidor me leva a acreditar que algo está errado no meu sistema.

registro vsftpd (/var/log/vsftpd)

Tue Jan  2 21:22:03 2024 [pid 2] CONNECT: Client "127.0.0.1"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", "220 (vsFTPd 3.0.3)"
Tue Jan  2 21:22:03 2024 [pid 2] FTP command: Client "127.0.0.1", "FEAT"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", "211-Features:"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", " EPRT??"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", " EPSV??"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", " MDTM??"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", " PASV??"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", " REST STREAM??"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", " SIZE??"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", " TVFS??"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", " UTF8??"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", "211 End"
Tue Jan  2 21:22:03 2024 [pid 2] FTP command: Client "127.0.0.1", "OPTS UTF8 ON"
Tue Jan  2 21:22:03 2024 [pid 2] FTP response: Client "127.0.0.1", "200 Always in UTF8 mode."
Tue Jan  2 21:22:03 2024 [pid 2] FTP command: Client "127.0.0.1", "USER anonymous"
Tue Jan  2 21:22:03 2024 [pid 2] [anonymous] FTP response: Client "127.0.0.1", "331 Please specify the password."
Tue Jan  2 21:22:03 2024 [pid 2] [anonymous] FTP command: Client "127.0.0.1", "PASS <password>"
Tue Jan  2 21:22:03 2024 [pid 1] [ftp] OK LOGIN: Client "127.0.0.1", anon password "lftp@"
Tue Jan  2 21:22:03 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "230 Login successful."
Tue Jan  2 21:22:03 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "PWD"
Tue Jan  2 21:22:03 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "257 "/" is the current directory"
Tue Jan  2 21:22:08 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "CWD /tv"
Tue Jan  2 21:22:08 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "250 Directory successfully changed."
Tue Jan  2 21:22:16 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "CWD /nonefolder"
Tue Jan  2 21:22:16 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "550 Failed to change directory."
Tue Jan  2 21:22:19 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "CWD /"
Tue Jan  2 21:22:19 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "250 Directory successfully changed."
Tue Jan  2 21:22:19 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "PASV"
Tue Jan  2 21:22:19 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "227 Entering Passive Mode (127,0,0,1,39,111)."
Tue Jan  2 21:22:19 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "LIST"
Tue Jan  2 21:22:27 2024 [pid 2] CONNECT: Client "127.0.0.1"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", "220 (vsFTPd 3.0.3)"
Tue Jan  2 21:22:27 2024 [pid 2] FTP command: Client "127.0.0.1", "FEAT"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", "211-Features:"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", " EPRT??"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", " EPSV??"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", " MDTM??"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", " PASV??"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", " REST STREAM??"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", " SIZE??"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", " TVFS??"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", " UTF8??"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", "211 End"
Tue Jan  2 21:22:27 2024 [pid 2] FTP command: Client "127.0.0.1", "OPTS UTF8 ON"
Tue Jan  2 21:22:27 2024 [pid 2] FTP response: Client "127.0.0.1", "200 Always in UTF8 mode."
Tue Jan  2 21:22:27 2024 [pid 2] FTP command: Client "127.0.0.1", "USER anonymous"
Tue Jan  2 21:22:27 2024 [pid 2] [anonymous] FTP response: Client "127.0.0.1", "331 Please specify the password."
Tue Jan  2 21:22:27 2024 [pid 2] [anonymous] FTP command: Client "127.0.0.1", "PASS <password>"
Tue Jan  2 21:22:27 2024 [pid 1] [ftp] OK LOGIN: Client "127.0.0.1", anon password "lftp@"
Tue Jan  2 21:22:27 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "230 Login successful."
Tue Jan  2 21:22:27 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "CWD /tv"
Tue Jan  2 21:22:27 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "250 Directory successfully changed."
Tue Jan  2 21:22:27 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "PASV"
Tue Jan  2 21:22:27 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "227 Entering Passive Mode (127,0,0,1,39,112)."
Tue Jan  2 21:22:27 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "LIST"
Tue Jan  2 21:22:42 2024 [pid 2] CONNECT: Client "127.0.0.1"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", "220 (vsFTPd 3.0.3)"
Tue Jan  2 21:22:42 2024 [pid 2] FTP command: Client "127.0.0.1", "FEAT"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", "211-Features:"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", " EPRT??"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", " EPSV??"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", " MDTM??"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", " PASV??"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", " REST STREAM??"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", " SIZE??"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", " TVFS??"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", " UTF8??"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", "211 End"
Tue Jan  2 21:22:42 2024 [pid 2] FTP command: Client "127.0.0.1", "OPTS UTF8 ON"
Tue Jan  2 21:22:42 2024 [pid 2] FTP response: Client "127.0.0.1", "200 Always in UTF8 mode."
Tue Jan  2 21:22:42 2024 [pid 2] FTP command: Client "127.0.0.1", "USER anonymous"
Tue Jan  2 21:22:42 2024 [pid 2] [anonymous] FTP response: Client "127.0.0.1", "331 Please specify the password."
Tue Jan  2 21:22:42 2024 [pid 2] [anonymous] FTP command: Client "127.0.0.1", "PASS <password>"
Tue Jan  2 21:22:42 2024 [pid 1] [ftp] OK LOGIN: Client "127.0.0.1", anon password "lftp@"
Tue Jan  2 21:22:42 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "230 Login successful."
Tue Jan  2 21:22:42 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "CWD /tv"
Tue Jan  2 21:22:42 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "250 Directory successfully changed."
Tue Jan  2 21:22:42 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "PASV"
Tue Jan  2 21:22:42 2024 [pid 3] [ftp] FTP response: Client "127.0.0.1", "227 Entering Passive Mode (127,0,0,1,39,106)."
Tue Jan  2 21:22:42 2024 [pid 3] [ftp] FTP command: Client "127.0.0.1", "LIST"

registro lftp

[root@ladybug ~]# lftp
lftp :~> open 127.0.0.1
lftp 127.0.0.1:~> cd
cd ok, cwd=/
lftp 127.0.0.1:/> cd tv
cd ok, cwd=/tv
lftp 127.0.0.1:/tv> cd ..
lftp 127.0.0.1:/> cd nonefolder
cd: Access failed: 550 Failed to change directory. (/nonefolder)
lftp 127.0.0.1:/> ls
ls: Fatal error: 500 OOPS:           
lftp 127.0.0.1:/> cd tv
lftp 127.0.0.1:/tv> ls
ls: Fatal error: 500 OOPS:                 
lftp 127.0.0.1:/tv>

Log do Filezilla (execução diferente das duas acima)

Status: Connecting to 192.168.1.12:21...
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
Status: Logged in
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/" is the current directory
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PASV
Response:   227 Entering Passive Mode (192,168,1,12,39,110).
Command:    LIST
Error:  Could not read from transfer socket: ECONNRESET - Connection reset by peer
Error:  Connection closed by server
Error:  Failed to retrieve directory listing
Status: Disconnected from server
Status: Connecting to 192.168.1.12:21...
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
Status: Logged in
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/" is the current directory
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PASV
Response:   227 Entering Passive Mode (192,168,1,12,39,114).
Command:    LIST
Error:  Connection closed by server
Error:  Failed to retrieve directory listing

/etc/vsftpd.conf

log_ftp_protocol=YES
xferlog_enable=YES
pasv_enable=YES
pasv_max_port=10100
pasv_min_port=10090
local_umask=022
anon_umask=022
anonymous_enable=YES
anon_upload_enable=YES
anon_root=/mnt/hdd-8tb/home/ftpd/
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
chown_uploads=YES
chown_username=ftpd
listen=YES
pam_service_name=vsftpd

regras ufw (quando ativas)

To                         Action      From
--                         ------      ----
20/tcp                     ALLOW       Anywhere                  
21/tcp                     ALLOW       Anywhere                  
10090:10100/tcp            ALLOW       Anywhere                  
20/tcp (v6)                ALLOW       Anywhere (v6)             
21/tcp (v6)                ALLOW       Anywhere (v6)             
10090:10100/tcp (v6)       ALLOW       Anywhere (v6)

permissões de root ftp

ftpd@ladybug:/mnt/hdd-8tb/home/ftpd$ ls -la
total 52
dr-xr-xr-x  9 ftpd ftpd 4096 Jan  1 18:47 .
drwxr-xr-x 14 root root 4096 Jan  1 18:39 ..
-rw-rw-r--  1 ftpd ftpd 3339 Jan  2 21:20 .bash_history
-rw-rw-r--  1 ftpd ftpd  220 Jan 28  2023 .bash_logout
-rw-rw-r--  1 ftpd ftpd 3771 Jan 28  2023 .bashrc
drwxr-xr-x  9 ftpd ftpd 4096 Jul 29 21:46 books
drwxr-xr-x  5 ftpd ftpd 4096 Apr 13  2023 comics
drwxr-xr-x 10 ftpd ftpd 4096 Dec 31 18:44 games
drwxr-xr-x  7 ftpd ftpd 4096 Aug 25 21:20 movies
drwxr-xr-x 16 ftpd ftpd 4096 Apr 13  2023 music
-rw-rw-r--  1 ftpd ftpd  807 Jan 28  2023 .profile
drwxr-xr-x 16 ftpd ftpd 4096 Nov 12 20:49 tv
drwxr-xr-x  2 ftpd ftpd 4096 Jan  1 18:47 util

Não sei mais o que tentar. Parece que o vsftpd simplesmente não está aceitando conexões nessas portas, embora eu as tenha especificado. Disposto a tentar qualquer coisa neste momento.

firewall
Martin Hope
GregoInc
Asked: 2023-11-19 08:06:43 +0800 CST
  • 7

Fiz algumas pesquisas, mas não consegui encontrar algo que explique a mensagem abaixo que encontrei no dmesg. É óbvio que o firewall UFW está bloqueando alguma coisa, mas não estou tendo sucesso em rastrear o que está causando isso.

[1170462.231472] [UFW BLOCK] IN=ens3 OUT= MAC=01:00:5e:00:00:01:d8:d5:b9:00:68:9c:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2

Qualquer indicação sobre onde procurar seria apreciada.

firewall
Martin Hope
flen
Asked: 2022-05-20 10:07:06 +0800 CST
  • 0

Estou acessando minha máquina Ubuntu usando o RDP de um desktop Windows, na mesma rede wifi (ou seja, estou usando apenas o RDP localmente, não pela internet). Quero desabilitar todo o tráfego da internet, mas ainda permitir o tráfego WLAN, pois preciso controlar a máquina via RDP.

Existe uma opção/regra simples no RDP para fazer isso acontecer? Se possível, gostaria de criar um script ou ter alguma opção fácil para bloquear rapidamente toda a internet/permitir toda a internet novamente.

O motivo de eu querer fazer isso é que muitas vezes deixo a máquina ligada e não atendo, atualizo etc. A configuração de segurança também não é das melhores, já que é mais uma máquina de teste. É uma boa ideia desabilitar a internet nesses casos apenas para evitar ataques.

Pergunta relacionada: bloquear o acesso à Internet e manter o acesso à LAN - firewall (ele usa o iptables diretamente, mas não sou experiente o suficiente para lidar com eles, prefiro usar o UFW)

firewall
Martin Hope
Shivank Anchal
Asked: 2020-12-22 10:46:51 +0800 CST
  • 0

Estou executando o Apache2 no Ubuntu 20.04 e meu servidor pode ser acessado de todos os dispositivos conectados ao meu roteador WIFI (incluindo telefones e laptops). Este é o que é renderizado quando meu servidor é acessado. Agora quero acessar meu servidor pela Internet.

Esta é a saída da rota -n

frozenmafia@frozenmafia-H81M-S:~$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    600    0        0 wlxd03745b828ea
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlxd03745b828ea
192.168.1.0     0.0.0.0         255.255.255.0   U     600    0        0 wlxd03745b828ea

Esta é a saída do ifconfig

frozenmafia@frozenmafia-H81M-S:~$ ifconfig
enp3s0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 40:8d:5c:a5:eb:f9  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 5856  bytes 572976 (572.9 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5856  bytes 572976 (572.9 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlxd03745b828ea: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.39  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::2970:d411:fb39:7ff6  prefixlen 64  scopeid 0x20<link>
        ether d0:37:45:b8:28:ea  txqueuelen 1000  (Ethernet)
        RX packets 388866  bytes 507534243 (507.5 MB)
        RX errors 0  dropped 2905  overruns 0  frame 0
        TX packets 263147  bytes 67686494 (67.6 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Esta é a saída do status ufw

frozenmafia@frozenmafia-H81M-S:~$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
Apache Full                ALLOW       Anywhere                  
8080                       ALLOW       Anywhere                  
80/tcp                     ALLOW       Anywhere                  
Apache Full (v6)           ALLOW       Anywhere (v6)             
8080 (v6)                  ALLOW       Anywhere (v6)             
80/tcp (v6)                ALLOW       Anywhere (v6)

Esta é a saída de sudo netstat -tlpn

frozenmafia@frozenmafia-H81M-S:~$ sudo netstat -tlpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      706/systemd-resolve 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      975/sshd: /usr/sbin 
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      938/cupsd           
tcp        0      0 0.0.0.0:445             0.0.0.0:*               LISTEN      2201/smbd           
tcp        0      0 0.0.0.0:139             0.0.0.0:*               LISTEN      2201/smbd           
tcp6       0      0 :::80                   :::*                    LISTEN      1045/apache2        
tcp6       0      0 :::22                   :::*                    LISTEN      975/sshd: /usr/sbin 
tcp6       0      0 ::1:631                 :::*                    LISTEN      938/cupsd           
tcp6       0      0 :::445                  :::*                    LISTEN      2201/smbd           
tcp6       0      0 :::139                  :::*                    LISTEN      2201/smbd

Para tornar minha máquina pública preciso fazer o encaminhamento de porta. Para isso eu estaria configurando meu roteador WIFI. Eu fiz assim.

Este é o meu status de WAN

Eu acreditava que isso deveria ser suficiente para tornar minha máquina pública. Eu testei aqui. Está mostrando que minha porta está fechada.

Agora, pensei em usar o iptables para fazer o encaminhamento de porta. Eu segui este tutorial e digitei os seguintes comandos.

frozenmafia@frozenmafia-H81M-S:~$ cat /proc/sys/net/ipv4/conf/wlxd03745b828ea/forwarding 
1
frozenmafia@frozenmafia-H81M-S:~$ sudo  iptables -t nat -A PREROUTING -p tcp -i wlxd03745b828ea --dport 80 -j DNAT --to-destination 192.168.1.39:80
frozenmafia@frozenmafia-H81M-S:~$ sudo iptables -A FORWARD -p tcp -d 192.168.1.39 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
frozenmafia@frozenmafia-H81M-S:~$ ip route
default via 192.168.1.1 dev wlxd03745b828ea proto dhcp metric 600 
169.254.0.0/16 dev wlxd03745b828ea scope link metric 1000 
192.168.1.0/24 dev wlxd03745b828ea proto kernel scope link src 192.168.1.39 metric 600

Agora, acredito que tentei de tudo para tornar meu servidor público. Novamente testei a acessibilidade da minha máquina aqui, o que mostra minha falha.

Entrei em contato com meu ISP e confirmei que todas as portas estão abertas. Espero ter explicado e fundamentado tudo o que fiz. Seria ótimo se alguém me corrigisse e me desse uma solução para o meu problema. Agradecendo você

networking server iptables apache2 firewall
Martin Hope
dandreye
Asked: 2020-12-08 16:50:44 +0800 CST
  • 0

Com a seguinte configuração do UFW adicionada na parte superior de before.rules (além de todos os respectivos pré-requisitos, como habilitar o roteamento de IP na própria plataforma, alterar a política de encaminhamento padrão de DROP para ACCEPT e habilitar o encaminhamento de IP na configuração do UFW):

*nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.100.0.0/24 -o ens3 -j MASQUERADE
COMMIT

a sub-rede 10.100.0.0/24 precisa se conectar diretamente a qualquer uma das interfaces da VM do Ubuntu executando esse UFW? Em caso afirmativo, como configuro o UFW para NAT um conectado não diretamente à Internet? Por exemplo:

UserA--10.100.0.x/24---10.100.0.1/24--(Router1)--1.1.1.1/24-----1.1.1.2/24--(UFW)--Internet

Muito obrigado antecipadamente!

networking firewall ufw
Martin Hope
iBug
Asked: 2020-11-25 12:14:40 +0800 CST
  • 6

Eu migrei meu back-end de firewall do servidor Ubuntu Focal do iptables legado para o netfilter, executando update-alternatives --set iptables /usr/sbin/iptables-nfte reiniciando o servidor. Agora todas as tabelas mostradas iptables-legacy -Sestão vazias, mas quando executo iptables -Sa última linha sempre diz:

# Warning: iptables-legacy tables present, use iptables-legacy to see them

Desde então, removi iptables-legacyas alternativas usando o seguinte comando:

update-alternatives --remove iptables /usr/sbin/iptables-legacy

E agora apenas a versão netfilter é mostrada

root@iBug-Server:~# update-alternatives --display iptables
iptables - auto mode
  link best version is /usr/sbin/iptables-nft
  link currently points to /usr/sbin/iptables-nft
  link iptables is /usr/sbin/iptables
  slave iptables-restore is /usr/sbin/iptables-restore
  slave iptables-save is /usr/sbin/iptables-save
/usr/sbin/iptables-nft - priority 20
  slave iptables-restore: /usr/sbin/iptables-nft-restore
  slave iptables-save: /usr/sbin/iptables-nft-save

Como posso me livrar desse aviso?

networking iptables firewall nftables
Martin Hope
user1150482
Asked: 2020-11-24 16:18:58 +0800 CST
  • 0

Eu tenho minha instância do Oracle Cloud no Ubuntu 20.04 e configurei o servidor apache2. Está funcionando, curl localhostmas não funciona no IP público da minha instância. Meu status ufw:

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
Apache                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
OpenSSH                    ALLOW       Anywhere
OpenSSH (v6)               ALLOW       Anywhere (v6)
22/tcp (v6)                ALLOW       Anywhere (v6)
Apache (v6)                ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)

Se eu gostaria sudo ufw disableEle ainda não se conecta.

Ele se conecta apenas se eu fizer:

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F

Mas eu obviamente não quero fazer isso.

Se eu adicionar algumas regras ao iptables:

sudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT
sudo netfilter-persistent save

Isso não muda nada

EDITAR
sudo iptables -S OUTPUT :

-P OUTPUT ACCEPT
-A OUTPUT -d 169.254.0.0/16 -j InstanceServices
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output
-A OUTPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables apache2 firewall ufw 20.04
Martin Hope
bomben
Asked: 2020-11-21 01:42:21 +0800 CST
  • 1

Eu queria adicionar algumas regras ao iptables desta pergunta e respostas para rotear o tráfego do programa torrent Transmissão através de uma vpn (surfshark no meu caso).

Pelo menos duas das respostas são usadas iptables -Fpara liberar as tabelas antes de adicionar as regras personalizadas.

Uma dessas respostas faz referência especificamente a um servidor sem cabeça (como o meu). Então eu suspeito que isso deve funcionar.

Mas se eu usar iptables -F, sou instantaneamente expulso da minha sessão ssh para o servidor. Não consigo digitar nenhum novo comando no terminal e preciso reinicializar o servidor para fazer login novamente.

Eu tenho um firewall rodando no servidor que permite a porta 22 para cada IP.

Para esclarecimento, adicionarei algumas saídas de antes e depois de aplicar a resposta aceita:

Antes (aviso policy DROP):

     $ sudo iptables -xvnL
Chain INPUT (policy DROP 21 packets, 5628 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
     387    31969 f2b-sshd   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22
   27008 50413306 ufw-before-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   27008 50413306 ufw-before-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
     153    26176 ufw-after-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
      21     5628 ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
      21     5628 ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
      21     5628 ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
       0        0 ufw-before-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
       0        0 ufw-before-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
       0        0 ufw-after-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
       0        0 ufw-after-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
       0        0 ufw-reject-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
       0        0 ufw-track-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 7 packets, 324 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
    7130   870596 ufw-before-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    7130   870596 ufw-before-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
     997   113175 ufw-after-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
     997   113175 ufw-after-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
     997   113175 ufw-reject-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
     997   113175 ufw-track-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Depois:

 $ sudo iptables -L -v
Chain INPUT (policy ACCEPT 12648 packets, 12M bytes)

Isso é depois que eu configurei para policy ACCEPT, depois limpei, adicionei as regras transmission-daemonda outra resposta aqui e fiz essa configuração persistir após a reinicialização com sudo dpkg-reconfigure iptables-persistent, reinicializar e fazer login no ssh. Agora eu gostaria, policy DROPmas isso vai me expulsar novamente.

Talvez interessante: eu desativei o ufwfirewall só para ter certeza. Depois que eu o reativei, ele também me expulsou (enquanto policy ACCEPT). Claro que eu tinha uma allow 22regra. Eu tive que reiniciar e então eu poderia fazer login novamente com o firewall funcionando.

Não tenho conhecimento iptablese com certeza vou pesquisar. Não sei como ativar o firewall pode me expulsar se a política principal for ACCEPTe o firewall tiver um arquivo 22.

 $ sudo iptables -xvnL
[sudo] Passwort für ben: 
Chain INPUT (policy ACCEPT 34981 packets, 9871660 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
     121    15110 f2b-sshd   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22
       0        0 ACCEPT     all  --  tun0   *       0.0.0.0/0            0.0.0.0/0           
       0        0 ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
     134    12445 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
       0        0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 19730 packets, 3108705 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
       0        0 ACCEPT     tcp  --  *      eth0    0.0.0.0/0            192.168.100.0/25     tcp spt:9091 owner GID match 136
       0        0 ACCEPT     udp  --  *      eth0    0.0.0.0/0            192.168.100.0/25     udp spt:9091 owner GID match 136
       0        0 ACCEPT     all  --  *      tun0    0.0.0.0/0            0.0.0.0/0            owner GID match 136
       0        0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0            owner GID match 136
       0        0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner GID match 136 reject-with icmp-port-unreachable

Chain f2b-sshd (1 references)
    pkts      bytes target     prot opt in     out     source               destination         
     121    15110 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-after-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-after-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-after-logging-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-after-logging-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-after-logging-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-after-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-before-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-before-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-before-logging-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-before-logging-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-before-logging-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-before-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-logging-allow (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-logging-deny (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-not-local (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-reject-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-reject-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-reject-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-skip-to-policy-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-skip-to-policy-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-skip-to-policy-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-track-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-track-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-track-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-user-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-user-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-user-limit (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-user-limit-accept (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-user-logging-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-user-logging-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-user-logging-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ufw-user-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination

Aqui as regras de firewall:

$ sudo ufw status
Status: Aktiv

Zu                         Aktion      Von
--                         ------      ---
22                         ALLOW       192.168.100.0/24          
5900                       ALLOW       192.168.100.0/24           # vnc
1900                       ALLOW       192.168.100.0/24           # minidlna
8200                       ALLOW       192.168.100.0/24           # minidlna
445                        ALLOW       192.168.100.0/24           # cifs
5901                       ALLOW       192.168.100.0/24           # vnc
5902                       ALLOW       192.168.100.0/24           # vnc

Uma coisa adicional: eu tenho uma eth0interface? Meu mini PC ZOTAC tem duas conexões ethernet e fiquei confuso que eth0não aparece. O script para definir as regras usa IFACE_INTERNAL=eth0. Isso poderia ser um problema?

$ ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 00:01:2e:4d:52:96 brd ff:ff:ff:ff:ff:ff
3: enp4s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:01:2e:4d:52:9b brd ff:ff:ff:ff:ff:ff
4: wlp2s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 0c:d2:92:57:c2:53 brd ff:ff:ff:ff:ff:ff
networking server iptables ssh firewall
Martin Hope
Stonecraft
Asked: 2020-10-18 15:55:36 +0800 CST
  • 0

Configurei com sucesso o nginx usando estas instruções , mas uma parte nunca funcionou para mim, e isso me incomoda, embora não pareça causar problemas.

root@devtest:/home/dev-admin# ufw app list
Available applications:
  Nginx Full
  Nginx HTTP
  Nginx HTTPS
  OpenSSH
root@devtest:/home/dev-admin# sudo ufw delete allow 'Nginx HTTP'
Could not delete non-existent rule
Could not delete non-existent rule (v6)
root@devtest:/home/dev-admin# ufw app list
Available applications:
  Nginx Full
  Nginx HTTP
  Nginx HTTPS
  OpenSSH

O que estou perdendo aqui? Esta não é a sintaxe correta para excluir a regra? Isso está no Ubuntu 20.04, mas recebo o mesmo resultado em 18.04.

server firewall ufw nginx