我正在管理（编辑：由 VPS 托管) 一台小型机器，用于几个游戏服务器和网站服务器 (apache)，我和一些朋友一起。问题是防火墙有时会丢弃 UDP 数据包。我之所以说“有时”，是因为我找不到任何规则。我将在下面几行中进一步解释。
机器正在运行Ubuntu 14.04.3 LTS（GNU/Linux 3.14.32-xxxx-grs-ipv6-64 x86_64）对于防火墙配置，我使用联邦快递。 我在跑阿帕奇2，mysql，FTP，远程控制，武装3，武装2，反恐精英和叛乱服务器。
UDP“连接”工作正常：
- 在游戏过程中，“连接”正确建立后
- 收到 TCP 数据包后
UDP“连接”不起作用：
- 当随机“ping”时（例如通过网络猫）
- 有时当 gametracker 尝试查询游戏服务器时
- 当任何其他服务器列表大厅查询服务器时
- 基本上每次在短时间内从客户端发送第一个数据包时
服务器 IP 替换为123.123.12.123。
ufw status verbose给出：
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), allow (routed)
New profiles: skip
To Action From
-- ------ ----
22/tcp ALLOW IN Anywhere
21/tcp ALLOW IN Anywhere
80/tcp ALLOW IN Anywhere
2300:2305/udp ALLOW IN Anywhere
2380:2385/udp ALLOW IN Anywhere
27015 ALLOW IN Anywhere
27000:27014/udp ALLOW IN Anywhere
27016:27030/udp ALLOW IN Anywhere
4380/udp ALLOW IN Anywhere
28015 ALLOW IN Anywhere
28000:28014/udp ALLOW IN Anywhere
28016:28030/udp ALLOW IN Anywhere
26901/udp ALLOW IN Anywhere
53 ALLOW IN Anywhere
26902/udp ALLOW IN Anywhere
42367 ALLOW IN Anywhere
22/tcp (v6) ALLOW IN Anywhere (v6)
21/tcp (v6) ALLOW IN Anywhere (v6)
80/tcp (v6) ALLOW IN Anywhere (v6)
2300:2305/udp (v6) ALLOW IN Anywhere (v6)
2380:2385/udp (v6) ALLOW IN Anywhere (v6)
27015 (v6) ALLOW IN Anywhere (v6)
27000:27014/udp (v6) ALLOW IN Anywhere (v6)
27016:27030/udp (v6) ALLOW IN Anywhere (v6)
4380/udp (v6) ALLOW IN Anywhere (v6)
28015 (v6) ALLOW IN Anywhere (v6)
28000:28014/udp (v6) ALLOW IN Anywhere (v6)
28016:28030/udp (v6) ALLOW IN Anywhere (v6)
26901/udp (v6) ALLOW IN Anywhere (v6)
53 (v6) ALLOW IN Anywhere (v6)
26902/udp (v6) ALLOW IN Anywhere (v6)
42367 (v6) ALLOW IN Anywhere (v6)
netstat -ntl给出：
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:28015 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:27015 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN
tcp6 0 0 :::80 :::* LISTEN
tcp6 0 0 ::1:53 :::* LISTEN
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 ::1:953 :::* LISTEN
netstat -nul给出：
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 123.123.12.123:26901 0.0.0.0:*
udp 0 0 123.123.12.123:26902 0.0.0.0:*
udp 0 0 123.123.12.123:27005 0.0.0.0:*
udp 0 0 123.123.12.123:27015 0.0.0.0:*
udp 0 0 123.123.12.123:27020 0.0.0.0:*
udp 0 0 123.123.12.123:28005 0.0.0.0:*
udp 0 0 123.123.12.123:28015 0.0.0.0:*
udp 0 0 123.123.12.123:28020 0.0.0.0:*
udp 0 0 127.0.0.1:53 0.0.0.0:*
udp 0 0 0.0.0.0:2302 0.0.0.0:*
udp 0 0 0.0.0.0:2303 0.0.0.0:*
udp 0 0 0.0.0.0:2304 0.0.0.0:*
udp 0 0 0.0.0.0:2305 0.0.0.0:*
udp 0 0 123.123.12.123:2382 0.0.0.0:*
udp 0 0 123.123.12.123:2383 0.0.0.0:*
udp 0 0 123.123.12.123:2384 0.0.0.0:*
udp 0 0 123.123.12.123:2385 0.0.0.0:*
udp6 0 0 ::1:53 :::*
iptables -L给出：
Chain INPUT (policy DROP)
target prot opt source destination
ufw-before-logging-input all -- anywhere anywhere
ufw-before-input all -- anywhere anywhere
ufw-after-input all -- anywhere anywhere
ufw-after-logging-input all -- anywhere anywhere
ufw-reject-input all -- anywhere anywhere
ufw-track-input all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source estination
ufw-before-logging-forward all -- anywhere anywhere
ufw-before-forward all -- anywhere anywhere
ufw-after-forward all -- anywhere anywhere
ufw-after-logging-forward all -- anywhere anywhere
ufw-reject-forward all -- anywhere anywhere
ufw-track-forward all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ufw-before-logging-output all -- anywhere anywhere
ufw-before-output all -- anywhere anywhere
ufw-after-output all -- anywhere anywhere
ufw-after-logging-output all -- anywhere anywhere
ufw-reject-output all -- anywhere anywhere
ufw-track-output all -- anywhere anywhere
Chain ufw-after-forward (1 references)
target prot opt source destination
Chain ufw-after-input (1 references)
target prot opt source destination
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-ns
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-dgm
ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:netbios-ssn
ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:microsoft-ds
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootps
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootpc
ufw-skip-to-policy-input all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
Chain ufw-after-logging-forward (1 references)
target prot opt source destination
Chain ufw-after-logging-input (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
Chain ufw-after-logging-output (1 references)
target prot opt source destination
Chain ufw-after-output (1 references)
target prot opt source destination
Chain ufw-before-forward (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT icmp -- anywhere anywhere icmp echo-request
ufw-user-forward all -- anywhere anywhere
Chain ufw-before-input (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ufw-logging-deny all -- anywhere anywhere ctstate INVALID
DROP all -- anywhere anywhere ctstate INVALID
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
ufw-not-local all -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere 239.255.255.250 udp dpt:1900
ufw-user-input all -- anywhere anywhere
Chain ufw-before-logging-forward (1 references)
target prot opt source destination
Chain ufw-before-logging-input (1 references)
target prot opt source destination
Chain ufw-before-logging-output (1 references)
target prot opt source destination
Chain ufw-before-output (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ufw-user-output all -- anywhere anywhere
Chain ufw-logging-allow (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] "
Chain ufw-logging-deny (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere ctstate INVALID limit: avg 3/min burst 10
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
Chain ufw-not-local (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
RETURN all -- anywhere anywhere ADDRTYPE match dst-type MULTICAST
RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
ufw-logging-deny all -- anywhere anywhere limit: avg 3/min burst 10
DROP all -- anywhere anywhere
Chain ufw-reject-forward (1 references)
target prot opt source destination
Chain ufw-reject-input (1 references)
target prot opt source destination
Chain ufw-reject-output (1 references)
target prot opt source destination
Chain ufw-skip-to-policy-forward (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw-skip-to-policy-input (7 references)
target prot opt source destination
DROP all -- anywhere anywhere
Chain ufw-skip-to-policy-output (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw-track-forward (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere ctstate NEW
ACCEPT udp -- anywhere anywhere ctstate NEW
Chain ufw-track-input (1 references)
target prot opt source destination
Chain ufw-track-output (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere ctstate NEW
ACCEPT udp -- anywhere anywhere ctstate NEW
Chain ufw-user-forward (1 references)
target prot opt source destination
Chain ufw-user-input (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT udp -- anywhere anywhere multiport dports 2300:2305
ACCEPT udp -- anywhere anywhere multiport dports 2380:2385
ACCEPT tcp -- anywhere anywhere tcp dpt:27015
ACCEPT udp -- anywhere anywhere udp dpt:27015
ACCEPT udp -- anywhere anywhere multiport dports 27000:27014
ACCEPT udp -- anywhere anywhere multiport dports 27016:27030
ACCEPT udp -- anywhere anywhere udp dpt:4380
ACCEPT tcp -- anywhere anywhere tcp dpt:28015
ACCEPT udp -- anywhere anywhere udp dpt:28015
ACCEPT udp -- anywhere anywhere multiport dports 28000:28014
ACCEPT udp -- anywhere anywhere multiport dports 28016:28030
ACCEPT udp -- anywhere anywhere udp dpt:26901
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:26902
ACCEPT tcp -- anywhere anywhere tcp dpt:42367
ACCEPT udp -- anywhere anywhere udp dpt:42367
Chain ufw-user-limit (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] "
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain ufw-user-limit-accept (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw-user-logging-forward (0 references)
target prot opt source destination
Chain ufw-user-logging-input (0 references)
target prot opt source destination
Chain ufw-user-logging-output (0 references)
target prot opt source destination
Chain ufw-user-output (1 references)
target prot opt source destination
当我尝试从外部跟踪路由时（gra-3a-a9.fr.eu是不是我的机器):
traceroute to 123.123.12.123 (123.123.12.123), 30 hops max, 60 byte packets
1 * * *
2 weservit.openpeering.telecity2.jointtransit.nl (217.170.23.236) 1.679 ms 1.626 ms 1.699 ms
3 telecity-ixr.openpeering.nl (217.170.0.244) 2.192 ms 2.174 ms 2.250 ms
4 * * *
5 gra-g2-a9.fr.eu (213.251.128.28) 10.383 ms 10.367 ms 10.342 ms
6 gra-3a-a9.fr.eu (37.187.231.88) 9.001 ms gra-3b-a9.fr.eu (37.187.231.92) 9.386 ms 9.331 ms
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *
我尝试做了一个小实验：
// SERVER:
user@server:~$ sudo ufw status verbose | grep 42367
42367 ALLOW IN Anywhere
42367 (v6) ALLOW IN Anywhere (v6)
user@server:~$ netcat -ul 42367
^C
user@server:~$ netcat -l 42367
b
it does work
user@server:~$ netcat -ul 42367
c
it does work
^C
user@server:~$
// CLIENT:
user@client:~$ netcat -u 123.123.12.123 42367
a
it doesnt work
^C
user@client:~$ netcat 123.123.12.123 42367
b
it does work
^C
user@client:~$ netcat -u 123.123.12.123 42367
c
it does work
^C
user@client:~$
我几乎可以肯定，我在配置过程中跳过了一些非常重要（而且很愚蠢）的事情，这就是它不起作用的原因。问题是：我跳过了什么，现在它导致 UDP 无法正常工作？
如果需要任何其他信息-请评论。
提前感谢你的回答！抱歉发了这么长的帖子，没有重点。
答案1
我留下答案是因为有人可能会遇到同样的问题。
好的，从结果来看，traceroute数据包在我的服务器之前被“阻止”了。这可能意味着两件事：我的防火墙或之前的服务器上对传出的数据包进行了过滤。
根据建议@BenVoigt我使用iptables -vL命令并比较了每条规则的字节数。经过几次尝试，我几乎确定问题与我的防火墙配置无关。
我的下一步是联系 ISP。经过几条消息，我们终于找到了数据包丢失的原因。在他们的配置面板的某个深渊深处隐藏着一个 UDP 数据包过滤选项，默认情况下处于打开状态。关闭它解决了问题。
是的，基本上就是这样。正如我在第一篇文章中所说，我知道解决方案很简单。