树莓派 + Owncloud + Iptables

2024-6-18 • tag-icon

我有一台 Raspberry Pi，我用它将我的私人文件存储在云端（如 Dropbox）

我使用整个教程来配置 Pihttps://www.pestmeester.nl/

Ip表按照教程配置：

*filter 
#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT

#  Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#  Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

# Allows SMTP access
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 465 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT

# Allows pop and pops connections
# -A INPUT -p tcp --dport 110 -j ACCEPT
# -A INPUT -p tcp --dport 995 -j ACCEPT

# Allows imap and imaps connections
-A INPUT -p tcp --dport 143 -j ACCEPT
-A INPUT -p tcp --dport 993 -j ACCEPT

#  Allow SSH connections
#  The -dport number should be the same port number you set in     sshd_config
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

#  Allow ping
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT

iptables -L 显示链输入（策略接受）目标 prot opt 源目标 fail2ban-ssh tcp -- 任何地方任何地方多端口 dports ssh 接受所有 -- 任何地方任何地方拒绝所有 -- 任何地方 loopback/8 拒绝 icmp 端口不可达接受所有 -- 任何地方任何地方状态相关，已建立接受 tcp -- 任何地方任何地方 tcp dpt：http 接受 tcp -- 任何地方任何地方 tcp dpt：https 接受 tcp -- 任何地方任何地方 tcp dpt：smtp 接受 tcp -- 任何地方任何地方 tcp dpt：urd 接受 tcp -- 任何地方任何地方 tcp dpt：submission 接受 tcp -- 任何地方任何地方 tcp dpt：imap2 接受 tcp -- 任何地方任何地方 tcp dpt：imaps 接受 tcp -- 任何地方任何地方状态新 tcp dpt：ssh 接受 icmp -- 任何地方任何地方 icmp echo-request LOG 全部 -- 任何地方任何地方限制：平均 5/分钟突发 5 LOG 级别调试前缀“iptables 被拒绝：”DROP 全部 -- 任何地方任何地方

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

和 iptables-save

# Generated by iptables-save v1.4.21 on Fri Jun 30 12:43:24 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: "                     --log-level 7
-A INPUT -j DROP
-A FORWARD -j DROP
-A OUTPUT -j ACCEPT
-A fail2ban-ssh -j RETURN
COMMIT

现在我的问题是：在系统日志中我有很多类似的条目： Jun 30 12:00:46 raspberrypi kernel: [6978137.058941] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:c8:1f:66:21:0d:62:08:00:45:00:01:9b:16:66:00:00:80:11:af:dc SRC=192.168.178.103 DST=255.255.255.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=5734 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:01:10 raspberrypi kernel: [6978160.864968] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:99:b5:ec:e0:08:00:45:00:01:9b:47:8b:00:00:80:11:7f:06 SRC=192.168.178.24 DST=255.255.255.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=18315 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:01:10 raspberrypi kernel: [6978160.865463] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:99:b5:ec:e0:08:00:45:00:01:9b:6f:9b:00:00:80:11:e3:4d SRC=192.168.178.24 DST=192.168.178.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=28571 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:01:40 raspberrypi kernel: [6978190.866330] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:99:b5:ec:e0:08:00:45:00:01:9b:47:8c:00:00:80:11:7f:05 SRC=192.168.178.24 DST=255.255.255.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=18316 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:01:40 raspberrypi kernel: [6978190.866884] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:99:b5:ec:e0:08:00:45:00:01:9b:6f:ae:00:00:80:11:e3:3a SRC=192.168.178.24 DST=192.168.178.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=28590 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:01:46 raspberrypi kernel: [6978197.138692] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:c8:1f:66:21:0d:62:08:00:45:00:01:9b:16:6e:00:00:80:11:af:d4 SRC=192.168.178.103 DST=255.255.255.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=5742 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:02:10 raspberrypi kernel: [6978220.883154] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:99:b5:ec:e0:08:00:45:00:01:9b:47:8d:00:00:80:11:7f:04 SRC=192.168.178.24 DST=255.255.255.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=18317 PROTO=UDP SPT=17500 DPT=17500 LEN=391

有时 pi 会断开连接，唯一能恢复连接的方法就是重启服务管理器，这两个问题会相互关联吗？我该怎么做才能正确配置 ip 表？有了这么多条目的日志，我真的无法检测到 owncloud 存在的问题。

我真的希望有人能帮助我

答案1

您可以拒绝 Raspi 上的 Dropbox 广播。17500 端口由另一台机器上的 Dropbox 使用。

因此在 LOG 规则之前添加：-A INPUT -p udp --dport 17500 -j DROP

然后 raspi 将断开连接而不记录它们。

答案1

相关内容