主页 / server / 问题 / 652966
Accepted
Phuong Nguyen
Asked: 2014-12-17 07:25:24 +0800 CST

iptables-restore 正在创建危险规则

  • 772

我有这个定义文件：

*filter

:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:Firewall-INPUT - [0:0]
-A INPUT -j Firewall-INPUT
-A FORWARD -j Firewall-INPUT
-A Firewall-INPUT -i lo -j ACCEPT
-A Firewall-INPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A Firewall-INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A Firewall-INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

# Ping
-A Firewall-INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Accept any established connections
-A Firewall-INPUT -m conntrack --ctstate  ESTABLISHED,RELATED -j ACCEPT

# Enable the traffic between the nodes of the cluster
-A Firewall-INPUT -s 10.0.1.1 -j ACCEPT

# Allow connections from docker container
-A Firewall-INPUT -i docker0 -j ACCEPT

# Accept ssh, http, https and git
-A Firewall-INPUT -m conntrack --ctstate NEW -m multiport -p tcp --dports 22,2222,80,443 -j ACCEPT

# Log and drop everything else
-A Firewall-INPUT -j LOG
-A Firewall-INPUT -j REJECT --reject-with icmp-host-prohibited

COMMIT

iptables-restore然后我使用这些规则调用：

/sbin/iptables-restore < /tmp/iptables-rules-save

之后，我运行iptables -L并得到这个：

Chain INPUT (policy DROP)
target     prot opt source               destination
Firewall-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
Firewall-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain Firewall-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  10.0.1.1             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            ctstate NEW multiport dports ssh,EtherNet/IP-1,http,https
LOG        all  --  anywhere             anywhere            LOG level warning
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

如您所见，它正在添加一个危险规则，该规则接受来自任何来源的所有数据包到服务器上的任何接口。

我的设置有什么问题导致这种情况？如何解决？

P/S：我在 Digital Ocean CentOS 6.5 droplet 上运行这个

iptables

1 个回答

  1. Best Answer

    的默认输出iptables -L不向您显示接口，因此它不会向您显示确切的规则。尝试运行iptables -L -v以获取输出中包含的接口 - 该destination列是网络地址，而不是接口。输出-v将显示您创建的确切规则。

    • 4

相关问题