☰

即使我允许，IPTables 也会阻止所有到 http 的传出流量

tag-icon • tag-icon linux iptables firewall
即使我允许，IPTables 也会阻止所有到 http 的传出流量

我使用以下代码来允许 DNS 请求和端口的传出流量443，22并且80

但是，所有到端口的流量都443因80某种原因被阻止

# Allowing DNS lookups (tcp, udp port 53) to server '8.8.8.8'
/sbin/iptables -A OUTPUT -p udp -d 8.8.8.8 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p udp -s 8.8.8.8 --sport 53 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -d 8.8.8.8 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p tcp -s 8.8.8.8 --sport 53 -m state --state ESTABLISHED -j ACCEPT

# Allowing DNS lookups (tcp, udp port 53) to server '127.0.0.53'
/sbin/iptables -A OUTPUT -p udp -d 127.0.0.53 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p udp -s 127.0.0.53 --sport 53 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -d 127.0.0.53 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p tcp -s 127.0.0.53 --sport 53 -m state --state ESTABLISHED -j ACCEPT


 # allow all and everything on localhost
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT

# Allowing new and established incoming connections to port 22, 80, 443
/sbin/iptables -A INPUT -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -m multiport --sports 22,80,443 -m state --state ESTABLISHED -j ACCEPT

# Allow all outgoing connections to port 22
/sbin/iptables -A OUTPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# Allow outgoing icmp connections (pings,...)
/sbin/iptables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections to port 123 (ntp syncs)
/sbin/iptables -A OUTPUT -p udp --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -j LOG -m limit --limit 12/min --log-level 4 --log-prefix IP INPUT drop:
/sbin/iptables -A INPUT -j DROP
/sbin/iptables -A OUTPUT -j LOG -m limit --limit 12/min --log-level 4 --log-prefix IP OUTPUT drop:
/sbin/iptables -A OUTPUT -j DROP

 # Set default policy to 'DROP'
/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT DROP

我可以在系统日志中看到以下内容，

Sep 28 08:17:06 ip-172-31-57-142 kernel: [  486.605568] IP OUTPUT drop: IN= OUT=eth0 SRC=172.31.57.142 DST=172.217.7.206 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30718 DF PROTO=TCP SPT=37026 DPT=443 WINDOW=62727 RES=0x00 SYN URGP=0
Sep 28 08:17:07 ip-172-31-57-142 kernel: [  487.617296] IP OUTPUT drop: IN= OUT=eth0 SRC=172.31.57.142 DST=172.217.7.206 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30719 DF PROTO=TCP SPT=37026 DPT=443 WINDOW=62727 RES=0x00 SYN URGP=0

我不确定我做错了什么。

答案1

让我们只看其中的一部分，您希望在端口 tcp/22 上允许 ssh 的出站连接

# Allowing new and established incoming connections to port 22, 80, 443
/sbin/iptables -A INPUT -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -m multiport --sports 22,80,443 -m state --state ESTABLISHED -j ACCEPT

# Allow all outgoing connections to port 22
/sbin/iptables -A OUTPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

第一对规则并不执行注释中所说的操作。第二对应该可以用，但过于慷慨。所有四个规则都是几乎正确，但最终不够正确。相反，只要保持简单

# Allow outgoing connections to port tcp/22
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT

# Allow return traffic for established connections
iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT

相关内容