主页 / unix / 问题 / 493075
Accepted
elp
Asked: 2019-01-08 11:23:16 +0800 CST

iptables 优先级

  • 772

部署所有 kubernetes 资源后port 443，我想打开. 我将它添加到我的白名单表中，但它仍然关闭。我的 80 端口也发生了同样的事情。在刷新所有表后，删除所有 kubernetes 资源并从头开始设置防火墙（包括白名单port 80），然后再次部署 kubernetesport 80终于打开了。

现在我更愿意理解为什么我不能打开port 443而不是再做一遍。我发现有一个表KUBE-FIREWALL（见下文），默认情况下会阻止所有内容。

这是我的主要问题：

KUBE-FIREWALL 的规则优先级是否比我的表 TCP 高？如果，我怎样才能改变优先级？

输入

Chain INPUT (policy DROP)
target     prot opt source               destination         
cali-INPUT  all  --  anywhere             anywhere             /* cali:Cz_u1IQiXIMmKD4c */
f2b-sshd   tcp  --  anywhere             anywhere             multiport dports ssh
KUBE-EXTERNAL-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes externally-visible service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere             ctstate INVALID
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request ctstate NEW
UDP        udp  --  anywhere             anywhere             ctstate NEW
TCP        tcp  --  anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN ctstate NEW
REJECT     udp  --  anywhere             anywhere             reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere             reject-with tcp-reset
REJECT     all  --  anywhere             anywhere             reject-with icmp-proto-unreachable

校准输入

Chain cali-INPUT (1 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             /* cali:msRIDfJRWnYwzW4g */ mark match 0x10000/0x10000
cali-wl-to-host  all  --  anywhere             anywhere            [goto]  /* cali:y4fKWmWkTnYGshVX */
MARK       all  --  anywhere             anywhere             /* cali:JnMb-hdLugWL4jEZ */ MARK and 0xfff0ffff
cali-from-host-endpoint  all  --  anywhere             anywhere             /* cali:NPKZwKxJ-5imzORj */
ACCEPT     all  --  anywhere             anywhere             /* cali:aes7S4xZI-7Jyw63 */ /* Host endpoint policy accepted packet. */ mark match 0x10000/0x10000

KUBE-防火墙

Chain cali-INPUT (1 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             /* cali:msRIDfJRWnYwzW4g */ mark match 0x10000/0x10000
cali-wl-to-host  all  --  anywhere             anywhere            [goto]  /* cali:y4fKWmWkTnYGshVX */
MARK       all  --  anywhere             anywhere             /* cali:JnMb-hdLugWL4jEZ */ MARK and 0xfff0ffff
cali-from-host-endpoint  all  --  anywhere             anywhere             /* cali:NPKZwKxJ-5imzORj */
ACCEPT     all  --  anywhere             anywhere             /* cali:aes7S4xZI-7Jyw63 */ /* Host endpoint policy accepted packet. */ mark match 0x10000/0x10000
claus@vmd33301:~$ sudo iptables -L KUBE-FIREWALL
Chain KUBE-FIREWALL (2 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere             /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

TCP

Chain TCP (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
iptables kubernetes

1 个回答

  1. Best Answer

    编辑 2

    端口已关闭，因为没有人在听它 :)

    编辑 1

    列表顺序很重要，但 KUBE-FIREWALL 只丢弃标记的包。我错过了mark match 0x8000/0x8000规则末尾的。因此它应该工作。我的猜测是 cali 规则之一（或 fail2ban？）要求端口 443。没有完整的 iptables 输出就无法知道。

    ---下面的原始答案---

    是的，TCP 的优先级较低，因为它在列表中较低。不仅在您的 TCP 链之前评估 KUBE-FIREWALL 链，它还以丢弃所有剩余流量的规则结束。因此，您的 TCP 规则永远不会被评估。

    您可以使用将您的 TCP 链入口点插入到 KUBE-FIREWALL 链上方，也可以使用iptables -I INPUT ...将其插入到特定行号iptables -I INPUT 2 ...上方（插入到第 2 行上方）。您可以通过在 iptables 命令中添加 --line-numbers 来查看行号。( iptables -nvL --line-numbers)

    • 1

相关问题