我以 root 身份运行以下 bash 脚本来配置 iptables（我通过 SSH 登录）：
#!/bin/bash
# Delete all existing rules
iptables --flush
# Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# Allow port 80 (http)
iptables -A INPUT -p tcp --sport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
# Allow port 443 (https)
iptables -A INPUT -p tcp --sport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
# Allow port 8443
iptables -A INPUT -p tcp --sport 8443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 8443 -j ACCEPT
# Allow port 22 (ssh)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p udp --sport 22 -j ACCEPT
# Allow port 25 (smtp)
iptables -A INPUT -p tcp --sport 25 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
# Allow port 110 (pop)
iptables -A INPUT -p tcp --sport 110 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 110 -j ACCEPT
# Allow port 995
iptables -A INPUT -p tcp --sport 995 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 995 -j ACCEPT
# Allow port 143 (imap)
iptables -A INPUT -p tcp --sport 143 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 143 -j ACCEPT
# Allow port 993
iptables -A INPUT -p tcp --sport 993 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 993 -j ACCEPT
# Allow port 465 (smtp)
iptables -A INPUT -p tcp --sport 465 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT
# Allow port 8447
iptables -A INPUT -p tcp --sport 8447 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 8447 -j ACCEPT
# Ping rate limit (from outside)
iptables -A INPUT -p icmp -m icmp --icmp-type address-mask-request -j REJECT
iptables -A INPUT -p icmp -m icmp --icmp-type timestamp-request -j REJECT
iptables -A INPUT -p icmp -m icmp -m limit --limit 1/second -j ACCEPT
# Prevent DoS attack
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
# Loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# User feedback
service iptables save
echo "Rules set, restarting iptables..."
service iptables restart
echo "Finished configuring iptables"
该脚本执行后立即将我踢出 SSH - 所有端口也关闭（80、443、21 等）。如果我将默认链策略更改为：
# Set default chain policies
iptables -P INPUT REJECT
iptables -P FORWARD REJECT
iptables -P OUTPUT REJECT
它运行正常，我可以通过端口 80 和 SSH (22) 进入。但是，运行时iptables --list显示以下内容：
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:http
ACCEPT tcp -- anywhere anywhere tcp spt:https
ACCEPT tcp -- anywhere anywhere tcp spt:pcsync-https
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp spt:smtp
ACCEPT tcp -- anywhere anywhere tcp spt:pop3
ACCEPT tcp -- anywhere anywhere tcp spt:pop3s
ACCEPT tcp -- anywhere anywhere tcp spt:imap
ACCEPT tcp -- anywhere anywhere tcp spt:imaps
ACCEPT tcp -- anywhere anywhere tcp spt:urd
ACCEPT tcp -- anywhere anywhere tcp spt:8447
REJECT icmp -- anywhere anywhere icmp address-mask-request reject-with icmp-port-unreachable
REJECT icmp -- anywhere anywhere icmp timestamp-request reject-with icmp-port-unreachable
ACCEPT icmp -- anywhere anywhere icmp any limit: avg 1/sec burst 5
ACCEPT tcp -- anywhere anywhere tcp dpt:http limit: avg 25/min burst 100
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:pcsync-https
ACCEPT udp -- anywhere anywhere udp spt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere tcp dpt:pop3
ACCEPT tcp -- anywhere anywhere tcp dpt:pop3s
ACCEPT tcp -- anywhere anywhere tcp dpt:imap
ACCEPT tcp -- anywhere anywhere tcp dpt:imaps
ACCEPT tcp -- anywhere anywhere tcp dpt:urd
ACCEPT tcp -- anywhere anywhere tcp dpt:8447
ACCEPT all -- anywhere anywhere
... 所有默认策略都设置为“接受”。谁能告诉我为什么会发生这种情况？
答案1
您的规则中有很多错误。从错误地指定 sport/dport 到指定 udp 而不是 TCP。您还忘记了 DNS。service iptables restart 也是不必要的。
忘记所有输出规则，只需制定一条规则，允许在 INPUT 和 OUTPUT 顶部建立的连接上的所有传出流量。
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
然后仅向 INPUT 添加规则，并在其中使用 dport，而不是 sport。
并为 dns 添加输出规则，使邮件和 ssh 再次工作。再次使用 dport。
ping 速率限制如下无用。它们根本无法阻止 DOS/DDOS：数据包仍会到达您的服务器。所以不要理会这些。在我看来，http 速率限制应该由应用程序而不是防火墙来处理，但这只是个人观点，而不是事实。
答案2
除此之外，还有这一行
iptables -A OUTPUT -p udp --sport 22 -j ACCEPT
是你的问题。你只允许 UDP 数据包在端口 22 上发送。应该
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
答案3
您的规则中的另一个缺陷是，不接受 ICMP 过大错误。