创建/导入 iptables 规则到 ufw

创建/导入 iptables 规则到 ufw

非常感谢您花时间查看我的问题。我目前正在尝试将以下 iptables 转换为 ufw:

iptables -A INPUT -p tcp -s 127.0.0.1 --destination-port 443 -j ACCEPT
iptables -A INPUT -p udp -s 127.0.0.1 --destination-port 80 -j ACCEPT
iptables -A INPUT -p udp -s 127.0.0.1 --destination-port 443 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 443 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp --destination-port 80 -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -p udp --destination-port 443 -j REJECT --reject-with icmp-port-unreachable
ip6tables -A INPUT -p tcp -s ::1 --destination-port 443 -j ACCEPT
ip6tables -A INPUT -p udp -s ::1 --destination-port 80 -j ACCEPT
ip6tables -A INPUT -p udp -s ::1 --destination-port 443 -j ACCEPT
ip6tables -A INPUT -p tcp --destination-port 443 -j REJECT --reject-with tcp-reset
ip6tables -A INPUT -p udp --destination-port 80 -j REJECT --reject-with icmp6-port-unreachable
ip6tables -A INPUT -p udp --destination-port 443 -j REJECT --reject-with icmp6-port-unreachable

目前,我有以下内容:/etc/ufw/before.rules(就在“#End required lines”之后)

-A ufw-before-input -p tcp -s 127.0.0.1 --destination-port 443 -j ACCEPT
-A ufw-before-input -p udp -s 127.0.0.1 --destination-port 80 -j ACCEPT
-A ufw-before-input -p udp -s 127.0.0.1 --destination-port 443 -j ACCEPT
-A ufw-before-input -p tcp --destination-port 443 -j REJECT --reject-with tcp-reset
-A ufw-before-input -p udp --destination-port 80 -j REJECT --reject-with icmp-port-unreachable
-A ufw-before-input -p udp --destination-port 443 -j REJECT --reject-with icmp-port-unreachable

/etc/ufw/before6.rules(紧接着“# End required lines”之后)

-A ufw6-before-input -p tcp -s ::1 --destination-port 443 -j ACCEPT
-A ufw6-before-input -p udp -s ::1 --destination-port 80 -j ACCEPT
-A ufw6-before-input -p udp -s ::1 --destination-port 443 -j ACCEPT
-A ufw6-before-input -p tcp --destination-port 443 -j REJECT --reject-with tcp-reset
-A ufw6-before-input -p udp --destination-port 80 -j REJECT --reject-with icmp6-port-unreachable
-A ufw6-before-input -p udp --destination-port 443 -j REJECT --reject-with icmp6-port-unreachable

我正在监控点击次数:

watch -n1 -d "iptables -vnxL | grep -v -e pkts -e Chain | sort -nk1 | tac | column -t | grep -E -- 'reject-with|127.0.0.1'"

我正在访问应该触发这些拒绝规则的域,但计数仍然为 0。

如果你能帮助我弄清楚:

我的规则哪里出错了?为什么我无法触发它们?

我对 iptables 的经验和知识很少。但是我相信我创建的流量应该会触发这些 REJECT 规则。它们甚至没有触及我的 ACCEPT 规则。

我在想我搞乱了我将规则放在哪里/放哪个链中。

非常感谢,请注意安全 <3

评论中要求的输出:

    root@TinkerBoardS:~ # sudo iptables -vnxL Chain INPUT (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
    6663   681990 ufw-before-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    6663   681990 ufw-before-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       1      328 ufw-after-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ufw-before-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-before-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-after-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-after-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-reject-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-track-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 2 packets, 80 bytes)
    pkts      bytes target     prot opt in     out     source               destination
    6664   512047 ufw-before-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    6664   512047 ufw-before-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
      38     3357 ufw-after-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
      38     3357 ufw-after-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
      38     3357 ufw-reject-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
      38     3357 ufw-track-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-after-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-after-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137
       0        0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:138
       0        0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:139
       0        0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:445
       1      328 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
       0        0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:68
       0        0 ufw-skip-to-policy-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-after-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-before-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 4
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
       0        0 ufw-user-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       6      360 ACCEPT     tcp  --  *      *       127.0.0.1            0.0.0.0/0            tcp dpt:443
       0        0 ACCEPT     udp  --  *      *       127.0.0.1            0.0.0.0/0            udp dpt:80
       0        0 ACCEPT     udp  --  *      *       127.0.0.1            0.0.0.0/0            udp dpt:443
       0        0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 reject-with tcp-reset
       0        0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:80 reject-with icmp-port-unreachable
       0        0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:443 reject-with icmp-port-unreachable
    6496   489806 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
     121   180087 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
       0        0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 4
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
      40    11737 ufw-not-local  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251          udp dpt:5353
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            239.255.255.250      udp dpt:1900
      40    11737 ufw-user-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-logging-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-before-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination
    6502   490166 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
     124    18524 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
      38     3357 ufw-user-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-logging-allow (0 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID limit: avg 3/min burst 10
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
    pkts      bytes target     prot opt in     out     source               destination
      23     9400 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
       3      174 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
      14     2163 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
       0        0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-reject-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-reject-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-reject-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-skip-to-policy-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-input (7 references)
    pkts      bytes target     prot opt in     out     source               destination
       1      328 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-track-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-track-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-track-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination
      17     1020 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW
      19     2257 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW

Chain ufw-user-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-user-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       2      104 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 /* 'dapp_DNS' */
       1       63 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 /* 'dapp_DNS' */
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:115
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:82
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:82
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:444
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:444
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:445
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:445
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2295
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:2295
      36    11242 ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0.0/0
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            192.168.1.0/24
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5355
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5355
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:853
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:853

Chain ufw-user-limit (0 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
       0        0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-user-logging-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-user-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination

答案1

非常感谢 Doug。你让我找到了答案。我重新配置了 PiHole,使其响应我的本地 192.168。地址,现在它可以正常工作了(我之前将其配置为响应 127.0.01)

相关内容