我正在使用 Ubuntu 18.04,我当前的 iptables 规则来自这个问题;iptables -L
给出:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy DROP)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
有了这些,我哪儿也连接不了。我必须刷新列表并再次接受(从头开始)才能恢复连接。为什么这些不起作用?
答案1
您需要允许本地环回接口:
sudo iptables -A INPUT -i lo -j ACCEPT
有时,进程间通信会通过环回接口进行。请参见这里有关环回接口的更多信息。
编辑:所以我的其中一台测试电脑上就有这个:
doug@s17:~$ sudo iptables -v -x -n -L
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
94 9843 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
5093 6056565 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
8 613 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 3904 packets, 321224 bytes)
pkts bytes target prot opt in out source destination
现在,如果我想进一步了解被拒绝的数据包,我也可以记录它们:
sudo iptables --insert INPUT 3 --jump LOG --log-prefix "INPUT-REJECT:" --log-level info
然后(在更多拒绝之后)查看 /var/log/syslog:
Dec 12 14:18:42 s17 kernel: [2007598.577383] INPUT-REJECT:IN=ens5 OUT= MAC=ff:ff:ff:ff:ff:ff:00:21:9b:f9:21:26:08:00 SRC=192.168.111.101 DST=255.255.255.255 LEN=42 TOS=0x00 PREC=0x00 TTL=1 ID=4970 PROTO=UDP SPT=55705 DPT=3289 LEN=22
Dec 12 14:18:42 s17 kernel: [2007598.695347] INPUT-REJECT:IN=ens5 OUT= MAC=ff:ff:ff:ff:ff:ff:00:21:9b:f9:21:26:08:00 SRC=192.168.111.101 DST=255.255.255.255 LEN=42 TOS=0x00 PREC=0x00 TTL=1 ID=4971 PROTO=UDP SPT=55708 DPT=3289 LEN=22
Dec 12 14:18:43 s17 kernel: [2007599.014201] INPUT-REJECT:IN=ens5 OUT= MAC=ff:ff:ff:ff:ff:ff:00:21:9b:f9:21:26:08:00 SRC=192.168.111.101 DST=255.255.255.255 LEN=42 TOS=0x00 PREC=0x00 TTL=1 ID=4972 PROTO=UDP SPT=55712 DPT=3289 LEN=22
我观察到它们只是来自我现在正在打字的这台计算机的广播数据包。