我的局域网上有一台 RaspberryPi，其默认进出转发策略为 DENY。我想开放四个 IP 地址的出站并允许响应返回，但不接受来自外部的新连接。
我不明白为什么大多数传出连接被阻止，而有些则在几秒钟后被允许。从日志中查看以下内容：
[Sat Nov 24 15:37:56 2018] IPTABLES:DROP: IN= OUT=eth0 SRC=10.0.0.40 DST=104.24.15.89 LEN=176 TOS=0x00 PREC=0x00 TTL=64 ID=3938 DF PROTO=TCP SPT=36512 DPT=80 WINDOW=115 RES=0x00 ACK PSH FIN URGP=0
[Sat Nov 24 15:38:03 2018] IPTABLES:ACCEPT:IN= OUT=eth0 SRC=10.0.0.40 DST=104.24.15.89 LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=34819 DF PROTO=TCP SPT=36708 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0
[Sat Nov 24 15:38:03 2018] IPTABLES:ACCEPT:IN=eth0 OUT= MAC=b8:27:eb:c2:4a:fc:a4:2b:8c:96:76:e5:08:00:45:00:00:30:00:00:40:00:38:06:c1:2f SRC=104.24.15.89 DST=10.0.0.40 LEN=48 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=80 DPT=36708 WINDOW=29200 RES=0x00 ACK SYN URGP=0
[Sat Nov 24 15:38:03 2018] IPTABLES:DROP: IN= OUT=eth0 SRC=10.0.0.40 DST=104.24.15.89 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=34820 DF PROTO=TCP SPT=36708 DPT=80 WINDOW=115 RES=0x00 ACK URGP=0
[Sat Nov 24 15:38:03 2018] IPTABLES:DROP: IN= OUT=eth0 SRC=10.0.0.40 DST=104.24.15.89 LEN=176 TOS=0x00 PREC=0x00 TTL=64 ID=34821 DF PROTO=TCP SPT=36708 DPT=80 WINDOW=115 RES=0x00 ACK PSH URGP=0
我是这样制定规则的：
iptables -I OUTPUT 4 -d 104.24.14.89 -m conntrack --ctstate NEW -j LOG_ACCEPT
iptables -I OUTPUT 5 -d 104.24.15.89 -m conntrack --ctstate NEW -j LOG_ACCEPT
iptables -I OUTPUT 6 -d 107.170.105.41 -m conntrack --ctstate NEW -j LOG_ACCEPT
iptables -I OUTPUT 7 -d 64.30.224.206 -m conntrack --ctstate NEW -j LOG_ACCEPT
iptables -I INPUT 4 -s 104.24.14.89 -m conntrack --ctstate ESTABLISHED -j LOG_ACCEPT
iptables -I INPUT 5 -s 104.24.15.89 -m conntrack --ctstate ESTABLISHED -j LOG_ACCEPT
iptables -I INPUT 6 -s 107.170.105.41 -m conntrack --ctstate ESTABLISHED -j LOG_ACCEPT
iptables -I INPUT 7 -s 64.30.224.206 -m conntrack --ctstate ESTABLISHED -j LOG_ACCEPT
这些都是规则：
root@notremusique(rw):~# iptables -L --line-numbers
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all -- 10.0.0.0/24 anywhere
2 ACCEPT all -- localhost anywhere
3 ACCEPT udp -- anywhere anywhere udp spt:ntp
4 LOG_ACCEPT all -- 104.24.14.89 anywhere ctstate ESTABLISHED
5 LOG_ACCEPT all -- 104.24.15.89 anywhere ctstate ESTABLISHED
6 LOG_ACCEPT all -- 107.170.105.41 anywhere ctstate ESTABLISHED
7 LOG_ACCEPT all -- lastfm-api-vip1.phx1.cbsig.net anywhere ctstate ESTABLISHED
8 LOG_DROP all -- anywhere anywhere
Chain FORWARD (policy DROP)
num target prot opt source destination
Chain OUTPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all -- anywhere 10.0.0.0/24
2 ACCEPT all -- anywhere localhost
3 ACCEPT udp -- anywhere anywhere udp dpt:ntp
4 LOG_ACCEPT all -- anywhere 104.24.14.89 ctstate NEW
5 LOG_ACCEPT all -- anywhere 104.24.15.89 ctstate NEW
6 LOG_ACCEPT all -- anywhere 107.170.105.41 ctstate NEW
7 LOG_ACCEPT all -- anywhere lastfm-api-vip1.phx1.cbsig.net ctstate NEW
8 LOG_ACCEPT all -- anywhere 134.25.4.0/24
9 LOG_DROP all -- anywhere anywhere
Chain LOG_ACCEPT (9 references)
num target prot opt source destination
1 LOG all -- anywhere anywhere LOG level info prefix "IPTABLES:ACCEPT:"
2 ACCEPT all -- anywhere anywhere
Chain LOG_DROP (2 references)
num target prot opt source destination
1 LOG all -- anywhere anywhere LOG level info prefix "IPTABLES:DROP: "
2 DROP all -- anywhere anywhere
root@notremusique(rw):~#
答案1
在 中OUTPUT，您允许 cstate NEW，但不允许ESTABLISHED。
结果是，连接的初始数据包将会通过，但所有其他数据包将被丢弃。