为什么我被这些 ufw 规则锁定在我的机器之外?

为什么我被这些 ufw 规则锁定在我的机器之外?

我有一台服务器,ip 192.168.1.200

我的目标是:

  1. 我应该能够从任何地方通过端口 22 登录我的服务器
  2. 从 192.168.1.200 内部我应该能够通过端口 443 和 80 访问互联网
  3. 从 192.168.1.200 内部我应该能够访问 DNS
  4. 从内部 192.168.1.200 我应该无法访问专用网络: 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
  5. 任何地方的任何东西都应该能够通过端口 443 或端口 80 访问 192.168.0.200

当我重新启动 192.168.1.200 时,我无法再访问它,我必须手动登录它并禁用 ufw

谁能建议我做错了什么?

谢谢!

ubuntu:~> sudo ufw status verbose
WARN: uid is 0 but '/etc' is owned by 501
Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)

Anywhere                   DENY OUT    10.0.0.0/8
Anywhere                   DENY OUT    172.16.0.0/12
Anywhere                   DENY OUT    192.168.0.0/16
53                         ALLOW OUT   Anywhere
80/tcp                     ALLOW OUT   Anywhere
443/tcp                    ALLOW OUT   Anywhere
53 (v6)                    ALLOW OUT   Anywhere (v6)
80/tcp (v6)                ALLOW OUT   Anywhere (v6)
443/tcp (v6)               ALLOW OUT   Anywhere (v6)

ubuntu:~> sudo reboot

Connection to 192.168.1.200 closed by remote host.
Connection to 192.168.1.200 closed.
foo@M1-Mac-mini ~ % ssh [email protected]

iptables-nvL

Chain INPUT (policy DROP 4 packets, 208 bytes)
pkts bytes target     prot opt in     out     source               destination
43  2920 ufw-before-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
43  2920 ufw-before-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4   208 ufw-after-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4   208 ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4   208 ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4   208 ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
0     0 ufw-before-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-before-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-after-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-after-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-reject-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-track-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
30  5156 ufw-before-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
30  5156 ufw-before-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-after-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-after-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-reject-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-track-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-after-forward (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-after-input (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137
0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:138
0     0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:139
0     0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:445
0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:68
0     0 ufw-skip-to-policy-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
pkts bytes target     prot opt in     out     source               destination
4   208 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-output (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-forward (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
0     0 ufw-user-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-input (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
38  2624 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
0     0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
5   296 ufw-not-local  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251          udp dpt:5353
0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            239.255.255.250      udp dpt:1900
5   296 ufw-user-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-logging-forward (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-input (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-output (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-output (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
25  4140 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
5  1016 ufw-user-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-logging-allow (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
pkts bytes target     prot opt in     out     source               destination
0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID limit: avg 3/min burst 10
0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
pkts bytes target     prot opt in     out     source               destination
5   296 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
0     0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-reject-forward (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-reject-input (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-reject-output (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-skip-to-policy-forward (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-input (7 references)
pkts bytes target     prot opt in     out     source               destination
0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-output (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-track-forward (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-track-input (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-track-output (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-forward (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-input (1 references)
pkts bytes target     prot opt in     out     source               destination
1    88 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22 /* 'dapp_OpenSSH' */
0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443

Chain ufw-user-limit (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-user-logging-forward (0 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-input (0 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-output (0 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-output (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 DROP       all  --  *      *       10.0.0.0/8           0.0.0.0/0
0     0 DROP       all  --  *      *       172.16.0.0/12        0.0.0.0/0
5  1016 DROP       all  --  *      *       192.168.0.0/16       0.0.0.0/0
0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443

答案1

经过多次尝试和错误,这似乎解决了我的要求:

  • 允许来自 Internet 的 HTTP/HTTPS 和 DNS 请求
  • 允许向 Internet 发出 HTTP/HTTPS 和 DNS 请求
  • 拒绝访问任何专用网络 允许从任何地方通过 SSH 进行访问

首先,运行 ufw 的要求检查:

sh /usr/share/ufw/check-requirements

命令:

sudo ufw deny out to 169.254.0.0/16
sudo ufw deny out to 192.168.0.0/16
sudo ufw deny out to 198.18.0.0/15
sudo ufw deny out to 172.16.0.0/12
sudo ufw deny out to 100.64.0.0/10
sudo ufw deny out to 10.0.0.0/8
sudo ufw allow out 53/tcp
sudo ufw allow out 53/udp
sudo ufw allow out http
sudo ufw allow out https
sudo ufw allow in http
sudo ufw allow in https
sudo ufw allow in 22/tcp
sudo ufw default deny incoming
sudo ufw default deny outgoing

状态输出:

ubuntu:~> sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
80/tcp                     ALLOW IN    Anywhere
443                        ALLOW IN    Anywhere
22/tcp                     ALLOW IN    Anywhere
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443 (v6)                   ALLOW IN    Anywhere (v6)
22/tcp (v6)                ALLOW IN    Anywhere (v6)

169.254.0.0/16             DENY OUT    Anywhere
192.168.0.0/16             DENY OUT    Anywhere
198.18.0.0/15              DENY OUT    Anywhere
172.16.0.0/12              DENY OUT    Anywhere
100.64.0.0/10              DENY OUT    Anywhere
10.0.0.0/8                 DENY OUT    Anywhere
53/tcp                     ALLOW OUT   Anywhere
53/udp                     ALLOW OUT   Anywhere
80/tcp                     ALLOW OUT   Anywhere
443                        ALLOW OUT   Anywhere
53/tcp (v6)                ALLOW OUT   Anywhere (v6)
53/udp (v6)                ALLOW OUT   Anywhere (v6)
80/tcp (v6)                ALLOW OUT   Anywhere (v6)
443 (v6)                   ALLOW OUT   Anywhere (v6)

并且: sudo iptables -nvL

Chain INPUT (policy DROP 12 packets, 2040 bytes)
 pkts bytes target     prot opt in     out     source               destination
 2659  862K ufw-before-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2659  862K ufw-before-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2223  756K ufw-after-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2223  756K ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2223  756K ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2223  756K ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ufw-before-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ufw-before-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ufw-after-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ufw-after-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ufw-reject-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ufw-track-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 2799  351K ufw-before-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2799  351K ufw-before-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2374  280K ufw-after-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2374  280K ufw-after-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2374  280K ufw-reject-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2374  280K ufw-track-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-after-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-after-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:138
    0     0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:139
    0     0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:445
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:68
    0     0 ufw-skip-to-policy-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
   10  1700 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 ufw-user-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
   42  2876 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
   12  2040 ufw-not-local  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251          udp dpt:5353
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            239.255.255.250      udp dpt:1900
   12  2040 ufw-user-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
   26  4760 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ufw-user-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-logging-allow (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID limit: avg 3/min burst 10
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
 pkts bytes target     prot opt in     out     source               destination
   12  2040 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-reject-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-reject-input (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-reject-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-skip-to-policy-forward (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-input (7 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-output (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-track-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-track-input (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-track-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22

Chain ufw-user-limit (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-user-logging-forward (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-input (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-output (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            169.254.0.0/16
    0     0 DROP       all  --  *      *       0.0.0.0/0            192.168.0.0/16
    0     0 DROP       all  --  *      *       0.0.0.0/0            198.18.0.0/15
    0     0 DROP       all  --  *      *       0.0.0.0/0            172.16.0.0/12
    0     0 DROP       all  --  *      *       0.0.0.0/0            100.64.0.0/10
    0     0 DROP       all  --  *      *       0.0.0.0/0            10.0.0.0/8
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:443

相关内容