主页 / unix / 问题 / 778366
Accepted
Hölderlin
Asked: 2024-06-15 04:45:51 +0800 CST

排除 nftables ssh 配置故障

  • 772

我可以通过连接ssh到我的云服务器。由于下面的规则集，服务器拒绝 ssh 连接。

我不使用自定义 ssh 端口。服务器有一个 IPv6 地址，以防万一。如果我应用此规则集，我会得到相同的结果。

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        ct state { established, related } accept
        tcp dport 22 accept
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }
}
firewall

2 个回答

  1. 对于域名查找，您显然需要端口53。或者使用硬编码 IP 代替名称sources.list。

    • 0
  2. Best Answer

    综上所述，iP6规则集很重要：

    flush ruleset                                                                    
                                                                                 
table inet firewall {
                                                                                 
    chain inbound_ipv4 {
        # icmp type echo-request limit rate 5/second accept      
    }

    chain inbound_ipv6 {                                                         
        # accept neighbour discovery otherwise connectivity breaks
        icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
    }

    chain inbound {                                                              
        type filter hook input priority 0; policy drop;
        ct state vmap { established : accept, related : accept, invalid : drop } 
        iifname lo accept
        meta protocol vmap { ip : jump inbound_ipv4, ip6 : jump inbound_ipv6 }
        tcp dport { 22} accept
    }                                                                            
                                                                                 
    chain forward {                                                              
        type filter hook forward priority 0; policy drop;                        
    }                                                                            
}
    • 0

相关问题