主页 / server / 问题 / 415500
Accepted
Lock
Asked: 2012-08-09 04:45:53 +0800 CST

iptables 不允许在 1194 上传出数据包

  • 772

我正在尝试设置 openvpn 并且取得了一些不错的进展。

我还没有到测试隧道的地步——我首先要确保所有端口都通过防火墙正确设置。

如果我通过 telnet 端口 1194 连接到启用了 iptables 的服务器，并运行 tcpdump，我得到：

22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>
22:39:28.934723 IP ip.openvpn > xxx.56236: R 0:0(0) ack 4157464469 win 0

但是如果我重新打开 iptables，它似乎只收到了数据包，但没有发送回复：

22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>

任何想法为什么？我的 iptables 看起来像这样：

[root@westc01-01-01 sysconfig]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports http
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports https
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports submission
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports imap
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports imaps
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports smtps
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports ms-wbt-server
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports 8884
ACCEPT     udp  --  anywhere             anywhere            udp multiport ports domain
ACCEPT     tcp  --  anywhere             westc01-01-01.local tcp multiport ports ndmp
ACCEPT     gre  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pptp
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
ACCEPT     udp  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED udp dpt:openvpn
linux

1 个回答

  1. Best Answer

    为什么不调换这些规则的顺序呢？

    REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
ACCEPT     udp  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED udp dpt:openvpn
    • 7

相关问题