☰

Debian 9 服务器上的 Node-RED 无法连接到 MQTT 代理

tag-icon • tag-icon linux networking debian iptables mqtt
Debian 9 服务器上的 Node-RED 无法连接到 MQTT 代理

我的 Node-RED 流程：

[{"id":"6c5780e.7e86f","type":"mqtt in","z":"fa8ef0ce.69a348","name":"","topic":"bs/esp8266/ldr","qos":"2","datatype":"auto","broker":"11952de3.32d7b2","x":320,"y":420,"wires":[["e5ac261a.a24058"]]},{"id":"11952de3.32d7b2","type":"mqtt-broker","z":"","name":"","broker":"localhost","port":"1883","clientid":"","usetls":false,"compatmode":true,"keepalive":"60","cleansession":true,"birthTopic":"","birthQos":"0","birthPayload":"","closeTopic":"","closeQos":"0","closePayload":"","willTopic":"","willQos":"0","willPayload":""}]

我有一个 MQTT 节点连接到 localhost（本地 mosquitto 服务器），还有 4 个节点连接到 HiveMQ 代理。它们都无法连接。

我的 iptables 规则：

Chain INPUT (policy DROP 243 packets, 11542 bytes)
 pkts bytes target     prot opt in     out     source               destination
   34  1700 ACCEPT     all  --  lo     any     anywhere             anywhere
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:1883
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:1883
  735 80016 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:1880
  771 55433 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:3000

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy DROP 156 packets, 11397 bytes)
 pkts bytes target     prot opt in     out     source               destination
   34  1700 ACCEPT     all  --  any    lo      anywhere             anywhere
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:1883
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:1883
 1175 2794K ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:1880
 2369 6542K ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:3000

我可以从另一台机器（安装了 Node-RED 的 Windows 机器）连接到我的 mosquitto 服务器，甚至使用 MQTTS 和证书。

我在想问题可能出在我的 iptables 规则上，但我不确定，而且我是这个领域的新手。提前谢谢您。

编辑：在修改 iptables 规则之前，我可以从 Windows 计算机连接到代理。使用新规则（我最初粘贴在这里的规则）时，它无法连接。我以前只使用过这些规则，当时它仍然有效：

sudo iptables -A INPUT -p tcp --dport 1883--jump ACCEPT
sudo iptables -A INPUT -p tcp --dport 8883--jump ACCEPT

答案1

我的 iptables 规则确实有问题。我按照以下脚本更改了它们（如果需要，请更改 ssh 端口，并添加所需的规则）：

#!/bin/bash

IPTABLES=/sbin/iptables

echo " * flushing old rules"
${IPTABLES} --flush
${IPTABLES} --delete-chain
${IPTABLES} --table nat --flush
${IPTABLES} --table nat --delete-chain

echo " * setting default policies"
${IPTABLES} -P INPUT DROP
${IPTABLES} -P FORWARD DROP
${IPTABLES} -P OUTPUT ACCEPT

echo " * allowing loopback devices"
${IPTABLES} -A INPUT -i lo -j ACCEPT
${IPTABLES} -A OUTPUT -o lo -j ACCEPT

${IPTABLES} -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
${IPTABLES} -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

## BLOCK ABUSING IPs HERE ##
#echo " * BLACKLIST"
#${IPTABLES} -A INPUT -s _ABUSIVE_IP_ -j DROP
#${IPTABLES} -A INPUT -s _ABUSIVE_IP2_ -j DROP

echo " * allowing ssh on port 22"
${IPTABLES} -A INPUT -p tcp --dport 34254  -m state --state NEW -j ACCEPT

echo " * allowing ftp on port 21"
${IPTABLES} -A INPUT -p tcp --dport 21  -m state --state NEW -j ACCEPT

echo " * allowing dns on port 53 udp"
${IPTABLES} -A INPUT -p udp -m udp --dport 53 -j ACCEPT

echo " * allowing dns on port 53 tcp"
${IPTABLES} -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT

echo " * allowing http on port 80"
${IPTABLES} -A INPUT -p tcp --dport 80  -m state --state NEW -j ACCEPT

echo " * allowing https on port 443"
${IPTABLES} -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

echo " * allowing smtp on port 25"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT

echo " * allowing submission on port 587"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT

echo " * allowing imaps on port 993"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT

echo " * allowing pop3s on port 995"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT

echo " * allowing imap on port 143"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT

echo " * allowing pop3 on port 110"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT

echo " * allowing mosquitto on ports 1883 and 8883"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 1883 -j ACCEPT
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 8883 -j ACCEPT

echo " * allowing grafana on port 3000"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 3000 -j ACCEPT

echo " * allowing node-red on port 1880"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 1880 -j ACCEPT

echo " * allowing ping responses"
${IPTABLES} -A INPUT -p ICMP --icmp-type 8 -j ACCEPT

# DROP everything else and Log it
${IPTABLES} -A INPUT -j LOG
${IPTABLES} -A INPUT -j DROP

#
# Save settings
#
echo " * SAVING RULES"

if [[ -d /etc/network/if-pre-up.d ]]; then
    if [[ ! -f /etc/network/if-pre-up.d/iptables ]]; then
        echo -e "#!/bin/bash" > /etc/network/if-pre-up.d/iptables
        echo -e "test -e /etc/iptables.rules && iptables-restore -c /etc/iptables.rules" >> /etc/network/if-pre-up.d/iptables
        chmod +x /etc/network/if-pre-up.d/iptables
    fi
fi

iptables-save > /etc/fwall.rules
iptables-restore -c /etc/fwall.rules

我现在仍然无法从我的 Debian 服务器连接到我自己的 Mosquitto 代理，但这可能是一个凭证问题。我从以下网站获取了此脚本这里。

相关内容