iptables 允许在运行 ddwrt 的 chillispot 上使用 80 和 443

iptables 允许在运行 ddwrt 的 chillispot 上使用 80 和 443

我在设置时遇到了问题。这就是我想做的。我在 dd-wrt ​​上运行着 Chillispot (hotpsot)。一切都设置好了,但客户端只需要 80 和 443 通过热点。我找到了这个 dd-wrt ​​教程,但似乎不起作用。

http://www.dd-wrt.com/wiki/index.php/Iptables#Allow_HTTP_traffic_only_to_specific_domain.28s.29

最初我尝试将选项放在顶部,但没有成功。然后我刷新了 iptables 并只设置了这三个。我可以看到 pkts 数量在增长,但出于某种原因,我可以浏览。

root@DD-WRT:~# iptables -nvL FORWARD
Chain FORWARD (policy ACCEPT 3105 packets, 2442K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1629  230K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           multiport dports 21,80,443 
 2346 2792K ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
  328 46420 DROP       0    --  *      *       0.0.0.0/0            0.0.0.0/0    

这是来自路由器的一些信息,chillispot 是 tun0 接口。

root@DD-WRT:~# iptables -vnL FORWARD --line-numbers
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     47   --  *      vlan1   192.168.8.0/24       0.0.0.0/0           
2        0     0 ACCEPT     tcp  --  *      vlan1   192.168.8.0/24       0.0.0.0/0           tcp dpt:1723 
3       32  1851 ACCEPT     0    --  tun0   *       0.0.0.0/0            0.0.0.0/0           state NEW 
4        0     0 ACCEPT     0    --  br0    br0     0.0.0.0/0            0.0.0.0/0           
5       48  2408 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 TCPMSS clamp to PMTU 
6      756  452K lan2wan    0    --  *      *       0.0.0.0/0            0.0.0.0/0           
7      756  452K ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
8        0     0 TRIGGER    0    --  vlan1  br0     0.0.0.0/0            0.0.0.0/0           TRIGGER type:in match:0 relate:0 
9        0     0 trigger_out  0    --  br0    *       0.0.0.0/0            0.0.0.0/0           
10       0     0 ACCEPT     0    --  br0    *       0.0.0.0/0            0.0.0.0/0           state NEW 
11       0     0 DROP       0    --  *      *       0.0.0.0/0            0.0.0.0/0           
12       0     0 DROP       0    --  br0    *       0.0.0.0/0            0.0.0.0/0           
13       0     0 DROP       0    --  *      br0     0.0.0.0/0            0.0.0.0/0

接口:

root@DD-WRT:~# ifconfig -a
br0       Link encap:Ethernet  HWaddr 00:12:17:CF:80:5F  
          inet addr:192.168.8.1  Bcast:192.168.8.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2371 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1862 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:259721 (253.6 KiB)  TX bytes:254862 (248.8 KiB)

br0:0     Link encap:Ethernet  HWaddr 00:12:17:CF:80:5F  
          inet addr:169.254.255.1  Bcast:169.254.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0      Link encap:Ethernet  HWaddr 00:12:17:CF:80:5F  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5050 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2508 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1066410 (1.0 MiB)  TX bytes:376001 (367.1 KiB)
          Interrupt:5 

eth1      Link encap:Ethernet  HWaddr 00:12:17:CF:80:61  
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:729 errors:0 dropped:0 overruns:0 frame:114693
          TX packets:697 errors:2 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:107869 (105.3 KiB)  TX bytes:473134 (462.0 KiB)
          Interrupt:4 Base address:0x1000 

etherip0  Link encap:Ethernet  HWaddr 1E:13:B7:09:CC:8C  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING MULTICAST  MTU:16436  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1210 (1.1 KiB)  TX bytes:1210 (1.1 KiB)

teql0     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:192.168.182.1  P-t-P:192.168.182.1  Mask:255.255.255.0
          UP POINTOPOINT RUNNING  MTU:1500  Metric:1
          RX packets:662 errors:0 dropped:0 overruns:0 frame:0
          TX packets:587 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:10 
          RX bytes:92167 (90.0 KiB)  TX bytes:427657 (417.6 KiB)

vlan0     Link encap:Ethernet  HWaddr 00:12:17:CF:80:5F  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2371 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1864 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:269558 (263.2 KiB)  TX bytes:262680 (256.5 KiB)

vlan1     Link encap:Ethernet  HWaddr 00:12:17:CF:80:60  
          inet addr:10.3.2.47  Bcast:10.255.255.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2675 errors:0 dropped:0 overruns:0 frame:0
          TX packets:645 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:705429 (688.8 KiB)  TX bytes:102197 (99.8 KiB)

路由表:

root@DD-WRT:~# netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.182.0   0.0.0.0         255.255.255.0   U         0 0          0 tun0
10.3.2.0        0.0.0.0         255.255.255.0   U         0 0          0 vlan1
192.168.8.0     0.0.0.0         255.255.255.0   U         0 0          0 br0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 br0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         10.3.2.1        0.0.0.0         UG        0 0          0 vlan1

非常感谢您的帮助。

TIA,阿伦

答案1

说实话,我还没仔细考虑你的设置细节,因为我要去睡觉了,但我看到有一个桥处于活动状态。桥在第 2 级捕获数据包,这可能意味着你的规则没有完全按照你的预期执行。在我的设置中,我需要使用 physdev 模块根据入站/出站接口进行过滤。只是想提一下这一点;可能会让你省去一些麻烦。

相关内容