☰

列出规则时 Iptables 挂起

tag-icon • tag-icon firewall iptables
列出规则时 Iptables 挂起

如果我执行 iptables -L 列出 iptables 中的所有规则，它会随机挂在不同的 IP 地址上，然后继续打印列表。它会挂起几秒钟，每次都在不同的 IP 地址上。我的一般规则列在下面。然后我有几个本地 IP 和几个允许的远程 IP。是否有我忘记的与查找相关的规则？

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     udp  --  anywhere             anywhere            udp dpt:25
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

答案1

该iptables命令将尝试对 IP 地址进行反向查找。这将产生您所描述的行为。您可以使用标志来禁止反向查找-n，这就是为什么我总是列出这样的规则：

iptables -vnL

这一事实和许多其他有用的信息可以在iptables手册页中找到。相关部分如下-n：

-L, --list [chain]
List all rules in the selected chain. If no chain is selected, all chains
are listed. Like every other iptables command, it applies to the specified
table (filter is the default), so NAT rules get listed by

  iptables -t nat -n -L

Please note that it is often used with the -n option, in order to avoid
long reverse DNS lookups. It is legal to specify the -Z (zero) option as
well, in which case the chain(s) will be atomically listed and zeroed. The
exact output is affected by the other arguments given. The exact rules are
suppressed until you use

  iptables -L -v

相关内容