我运行了以下iptables
命令来允许传入的 SSH 和 ICMP 连接并阻止所有其他连接。
sudo iptables -F INPUT
sudo iptables --policy INPUT ACCEPT && sudo iptables --policy OUTPUT
ACCEPT && sudo iptables --policy FORWARD ACCEPT
sudo iptables -I INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -I INPUT -p icmp -j ACCEPT
sudo iptables -I OUTPUT -p tcp --sport 5051 -j REJECT
sudo iptables -A INPUT -j REJECT
生成的 iptables 列表如下所示
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT tcp -- anywhere anywhere match-set minuteman dst,dst tcp flags:FIN,SYN,RST,ACK/SYN reject-with icmp-port-unreachable
DOCKER-ISOLATION all -- anywhere anywhere
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- anywhere anywhere tcp spt:ita-agent reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere match-set minuteman dst,dst tcp flags:FIN,SYN,RST,ACK/SYN reject-with icmp-port-unreachable
Chain DOCKER (1 references)
target prot opt source destination
Chain DOCKER-ISOLATION (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
我看到接受 SSH 的那一行位于拒绝所有其他流量的那一行之前。但我仍然无法通过 SSH 连接到机器。
有任何线索说明为什么这不起作用吗?
答案1
如果您只需要允许 SSH 和 ICMP
# Flush the FW Rules
iptables -F
iptables -X
# Block all traffic
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# Allow SSH
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Allow ICMP (ping)
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT