![iptables 不允许 1194 上的传出数据包](https://linux22.com/image/592357/iptables%20%E4%B8%8D%E5%85%81%E8%AE%B8%201194%20%E4%B8%8A%E7%9A%84%E4%BC%A0%E5%87%BA%E6%95%B0%E6%8D%AE%E5%8C%85.png)
我正在尝试设置 openvpn 并且取得了一些进展。
我还没有到测试隧道的阶段——我首先要确保通过防火墙的所有端口都设置正确。
如果我通过 telnet 端口 1194 连接到启用了 iptables 的服务器,并运行 tcpdump,我会得到:
22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>
22:39:28.934723 IP ip.openvpn > xxx.56236: R 0:0(0) ack 4157464469 win 0
但是如果我重新打开 iptables,它似乎只能获取数据包,但不会发送回复:
22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>
知道为什么吗?我的 iptables 如下所示:
[root@westc01-01-01 sysconfig]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp multiport ports http
ACCEPT tcp -- anywhere anywhere tcp multiport ports https
ACCEPT tcp -- anywhere anywhere tcp multiport ports submission
ACCEPT tcp -- anywhere anywhere tcp multiport ports imap
ACCEPT tcp -- anywhere anywhere tcp multiport ports imaps
ACCEPT tcp -- anywhere anywhere tcp multiport ports smtps
ACCEPT tcp -- anywhere anywhere tcp multiport ports smtp
ACCEPT tcp -- anywhere anywhere tcp multiport ports ms-wbt-server
ACCEPT tcp -- anywhere anywhere tcp multiport ports 8884
ACCEPT udp -- anywhere anywhere udp multiport ports domain
ACCEPT tcp -- anywhere westc01-01-01.local tcp multiport ports ndmp
ACCEPT gre -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:pptp
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
ACCEPT udp -- anywhere anywhere state NEW,RELATED,ESTABLISHED udp dpt:openvpn
答案1
为什么不改变这些规则的顺序呢?
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
ACCEPT udp -- anywhere anywhere state NEW,RELATED,ESTABLISHED udp dpt:openvpn