☰

使用 iptables 阻止除特定端口之外的所有互联网流量

tag-icon • tag-icon networking iptables firewall
使用 iptables 阻止除特定端口之外的所有互联网流量

我有一个在 Ubuntu Server 20.04 LTS 上运行的 Emby 服务器，我想配置 iptables 以阻止除端口 8920 之外的所有来自互联网的传入连接，但允许来自本地网络节点的正常传入连接（ssh 等）。这可能吗？（我这样做是因为我的 Zyxel 路由器 EMG3425-Q10A 没有正确进行端口转发。仍在努力解决这个问题。）

答案1

以下是一个 iptables 脚本。LAN（局域网）和接口定义适用于我的测试计算机，必须根据用户要求进行更改：

doug@s19:~/iptables/misc$ cat ask1337350
#!/bin/sh
FWVER=0.01
#
# ask1337350 Smythies 2021.05.10 Ver:0.01
#       See here:
#       https://askubuntu.com/questions/1337350/using-iptables-to-block-all-internet-originating-traffic-except-for-a-specific-p
#       run as sudo on s19.
#
#       Note: These rules likely need to be merged with
#       any existing iptables rules set.

echo "Loading ask1337350 rule set version $FWVER..\n"

# The location of the iptables program
#
IPTABLES=/sbin/iptables

#Setting the EXTERNAL and INTERNAL interfaces and addresses for the network
#
# Set for Smythies s19 computer (for testing). Edit for ask1337350's computer.
# EXTIF="enp3s0" no,no,no use the bridge br0, or everything breaks, big time.
EXTIF="br0"
EXTIP="192.168.111.136"
NETWORK="192.168.111.0/24"
UNIVERSE="0.0.0.0/0"

# Clearing any previous configuration
# Be careful here. I can do this on s18, but do not know
# about vxsa4's computer.
#
echo "  Clearing any existing rules and setting default policies.."
$IPTABLES -P INPUT DROP
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F

# Delete user defined chains
$IPTABLES -X
# Reset all IPTABLES counters
$IPTABLES -Z
# Smythies: While my references do not have it, I think this is needed.
$IPTABLES -t nat -Z

# loopback interfaces are valid.
#
$IPTABLES -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT

# Allow any related traffic coming back to the server in.
#
$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow in any LAN traffic
#
$IPTABLES -A INPUT -s $NETWORK -i $EXTIF -j ACCEPT

# Also allow in port 8920 traffic from anywhere
# The question does not specify a protocol. Do both.
#
$IPTABLES -A INPUT --protocol udp --destination-port 8920 -i $EXTIF -j ACCEPT
$IPTABLES -A INPUT --protocol tcp --destination-port 8920 -i $EXTIF -j ACCEPT

# Do not allow in anything else
# Could also just fall through to default policy here, but sometimes a logging rule is also desired.
#
$IPTABLES -A INPUT -i $EXTIF -j DROP

# At this point carry on. This might need to be merged into whatever existing iptables rule set.
#
echo ask1337350 rule set version $FWVER done.

经过短暂的时间后，给出以下信息：

doug@s19:~/iptables/misc$ sudo iptables -xvnL
Chain INPUT (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       8      616 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
     133     7916 ACCEPT     all  --  br0    *       0.0.0.0/0            192.168.111.136      state RELATED,ESTABLISHED
      51     3355 ACCEPT     all  --  br0    *       192.168.111.0/24     0.0.0.0/0
       0        0 ACCEPT     udp  --  br0    *       0.0.0.0/0            0.0.0.0/0            udp dpt:8920
       0        0 ACCEPT     tcp  --  br0    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8920
      19     5880 DROP       all  --  br0    *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 90 packets, 12122 bytes)
    pkts      bytes target     prot opt in     out     source               destination

相关内容