任何人都可以帮我检查我的iptables规则（运行新的 Tor 中继服务器）吗？
我正在运行 Debian GNU/Linux 11 (bullseye)，已完全更新。
默认情况下，我将 INPUT 链中的所有内容都删除，SSH 端口受到审查，所以如果您看到XXYYZ...我将其更改为自定义端口，以便机器人比仅仅点击 22 做更多的工作。
我现在将复制粘贴该rules.v4文件：
# Latest revision on 2021-Jul-25
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
--append INPUT --match conntrack --ctstate NEW --protocol tcp ! --syn --match comment --comment "protection: non-syn packets" --jump DROP
--append INPUT --match conntrack --ctstate INVALID --match comment --comment "protection: malformed packets" --jump DROP
--append INPUT --in-interface lo --match comment --comment "loopback: compulsory" --jump ACCEPT
--append INPUT --protocol icmp --icmp-type echo-request --match limit --limit 2/second --limit-burst 5 --match comment --comment "ICMP: ping only" --jump ACCEPT
--append INPUT --match conntrack --ctstate RELATED,ESTABLISHED --match comment --comment "Tor: traffic" --jump ACCEPT
--append INPUT --match conntrack --ctstate NEW,ESTABLISHED --protocol tcp --match tcp --destination-port XXYYZ --match comment --comment "SSH: global obfuscated" --jump ACCEPT
--append INPUT --protocol tcp --match tcp --destination-port 9001 --match comment --comment "Tor: OR" --jump ACCEPT
--append INPUT --protocol tcp --match tcp --destination-port 9030 --match comment --comment "Tor: Dir" --jump ACCEPT
COMMIT
大约一天正常运行时间的当前输出为：
# iptables -L INPUT -v --line-numbers
Chain INPUT (policy DROP 29718 packets, 3008K bytes)
num pkts bytes target prot opt in out source destination
1 234 131K DROP tcp -- any any anywhere anywhere ctstate NEW tcp flags:!FIN,SYN,RST,ACK/SYN /* protection: non-syn packets */
2 374 45284 DROP all -- any any anywhere anywhere ctstate INVALID /* protection: malformed packets */
3 96 4800 ACCEPT all -- lo any anywhere anywhere /* loopback: compulsory */
4 24 902 ACCEPT icmp -- any any anywhere anywhere icmp echo-request limit: avg 2/sec burst 5 /* ICMP: ping only */
5 3736K 2726M ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED /* Tor: traffic */
6 30 1800 ACCEPT tcp -- any any anywhere anywhere ctstate NEW,ESTABLISHED tcp dpt:XXYYZ /* SSH: global obfuscated */
7 12493 743K ACCEPT tcp -- any any anywhere anywhere tcp dpt:9001 /* Tor: OR */
8 7948 423K ACCEPT tcp -- any any anywhere anywhere tcp dpt:9030 /* Tor: Dir */
服务器似乎工作得很好，但我可能只是过度自信，因为缺乏更好的词。
答案1
供你参考：
*filter
-N RNNS
-A RNNS -p tcp ! --syn -j REJECT --reject-with tcp-reset
# accept (new) syn
-A RNNS -j ACCEPT
-N ALLOW
# tcp (r)eset (n)ew but (n)ot (s)yn
# -j RNNS is fine too since the chain has a "fallback" verdict at the end
-A ALLOW -p tcp --dport 9001 -g RNNS
-A ALLOW -p tcp --dport 9030 -g RNNS
-A ALLOW -p tcp --dport 12345 -g RNNS
# for (new) udp, just accept
-A ALLOW -p udp --dport 54321 -j ACCEPT
# others' fate will be determined by the chain policy of INPUT
# because we came to this chain by -g
# but well, -g ALLOW was the last rule anyway, so -j would have worked too
# and you can -j DROP here anyway
-P INPUT DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
# -A INPUT -m conntrack --ctstate INVALID ! -p tcp -j DROP
# could only be of conntrack state NEW; oh well, also see UNTRACKED
-A INPUT -i lo -j ACCEPT
# -A INPUT -i lo -g RNNS
-A INPUT -p icmp --icmp-type echo-request -m limit --limit 2/second --limit-burst 5 -j ACCEPT
# chain policy; optimization / optional
-A INPUT -p icmp -j RETURN
# won't be ICMP
-A INPUT -g ALLOW
-P FORWARD DROP
-P OUTPUT ACCEPT
COMMIT
请注意，同一链中规则的顺序可能很重要，但毫无逻辑关系的规则之间的顺序当然不会（参见链ALLOW），尽管作为“优化”，我们优先考虑更“重要的匹配” “ / 可能是真的（请参阅链--ctstate中的前两个规则INPUT）。