☰

为什么我无法添加任何 iptables 规则？

tag-icon • tag-icon iptables dd-wrt
为什么我无法添加任何 iptables 规则？

为什么我无法添加任何 iptables 规则？

root@ROUTER:~# iptables -L INPUT -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
6934 685K ACCEPT 0 -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 DROP udp -- ppp0 any anywhere anywhere udp dpt:route
0 0 DROP udp -- br0 any anywhere anywhere udp dpt:route
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:route
2 120 logaccept tcp -- any any anywhere ROUTER tcp dpt:22
0 0 DROP icmp -- ppp0 any anywhere anywhere
0 0 DROP igmp -- any any anywhere anywhere
5 350 ACCEPT 0 -- lo any anywhere anywhere state NEW
568 35947 logaccept 0 -- br0 any anywhere anywhere state NEW
339 38020 DROP 0 -- any any anywhere anywhere

然后我尝试添加一条规则：

root@ROUTER:~# /usr/sbin/iptables -I INPUT -i ppp0 -m multiport --dport 21,22,23,53,67,80,443 -j DROP

但它没有被添加到列表中：

root@ROUTER:~# iptables -L INPUT -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
6992 690K ACCEPT 0 -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 DROP udp -- ppp0 any anywhere anywhere udp dpt:route
0 0 DROP udp -- br0 any anywhere anywhere udp dpt:route
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:route
2 120 logaccept tcp -- any any anywhere ROUTER tcp dpt:22
0 0 DROP icmp -- ppp0 any anywhere anywhere
0 0 DROP igmp -- any any anywhere anywhere
5 350 ACCEPT 0 -- lo any anywhere anywhere state NEW
569 36007 logaccept 0 -- br0 any anywhere anywhere state NEW
343 38428 DROP 0 -- any any anywhere anywhere

我尝试再次添加规则：

root@ROUTER:~# /usr/sbin/iptables -I INPUT -i ppp0 --dport 21 -j DROP

并查看是否有任何变化：

root@ROUTER:~# iptables -L INPUT -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
7142 704K ACCEPT 0 -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 DROP udp -- ppp0 any anywhere anywhere udp dpt:route
0 0 DROP udp -- br0 any anywhere anywhere udp dpt:route
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:route
2 120 logaccept tcp -- any any anywhere ROUTER tcp dpt:22
0 0 DROP icmp -- ppp0 any anywhere anywhere
0 0 DROP igmp -- any any anywhere anywhere
5 350 ACCEPT 0 -- lo any anywhere anywhere state NEW
574 36309 logaccept 0 -- br0 any anywhere anywhere state NEW
346 38780 DROP 0 -- any any anywhere anywhere

但没有..:D

版本信息：

root@ROUTER:~# iptables -V
iptables v1.3.7

为什么？

固件：DD-WRT v24-sp2 (08/07/10) 标准

答案1

iptables -I INPUT -i ppp0 --dport 21 -j DROP在语法上是错误的（它缺乏协议规范），因此我们可以假设它只是默默地失败了。这个是正确的：

iptables -I INPUT -i ppp0 --dport 21 -j DROP -p tcp

所以不妨尝试一下。

相关内容