我以为我的 iptables 规则运行良好，直到我做了一个apt-get update，结果我收到Temporary failure resolving了 中所有网站的错误消息sources.list。但是，当我禁用 iptables 时，apt-get update它运行正常。
我的/etc/resolv.conf文件包含：
nameserver 199.195.255.68
nameserver 199.195.255.69
我的 iptables 规则：
*filter
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
# Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allows HTTP and HTTPS connections from anywhere (the normal ports for websites)
-A INPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT
# THE dport NUMBER IS THE SAME ONE YOU SET UP IN THE SSHD_CONFIG FILE 642/25042
-A INPUT -p tcp --dport 642 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --sport 642 -m state --state ESTABLISHED -j ACCEPT
# Allow outbound DNS
-A OUTPUT -p udp -s EX_IP --sport 1024:65535 -d 199.195.255.68 --dport 53 -j ACCEPT
-A INPUT -p udp -s 199.195.255.68 --sport 53 -d EX_IP --dport 1024:65535 -j ACCEPT
-A OUTPUT -p tcp -s EX_IP --sport 1024:65535 -d 199.195.255.69 --dport 53 -j ACCEPT
-A INPUT -p tcp -s 199.195.255.69 --sport 53 -d EX_IP --dport 1024:65535 -j ACCEPT
# Help prevent DoS Attacks
-A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
# Kill SYN attacks
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP
# Drop fragments
-A INPUT -f -j DROP
# Drop XMAS packets
-A INPUT -p tcp --tcp-flags ALL ALL -j DROP
# Drop NULL packets
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP
# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
# Log iptables denied calls (access via 'dmesg' command)
# Logging CHAIN
-N LOGGING
-A INPUT -j LOGGING
-A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTABLES Dropped: " --log-level 6
-A LOGGING -j DROP
COMMIT
其中 EX_IP 是服务器的外部 IP 地址。
输出为iptables -vL：
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
0 0 REJECT all -- !lo any anywhere 127.0.0.0/8 reject-with icmp-port-unreachable
952 70158 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
1 64 ACCEPT tcp -- any any anywhere anywhere multiport dports http,https state NEW,ESTABLISHED
1 64 ACCEPT tcp -- any any anywhere anywhere tcp dpt:642 state NEW,ESTABLISHED
0 0 ACCEPT udp -- any any 199.195.255.68 copernicus udp spt:domain dpts:1024:65535
0 0 ACCEPT tcp -- any any 199.195.255.69 copernicus tcp spt:domain dpts:1024:65535
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:http limit: avg 25/min burst 100
0 0 DROP tcp -- any any anywhere anywhere tcpflags:! FIN,SYN,RST,ACK/SYN state NEW
0 0 DROP all -f any any anywhere anywhere
0 0 DROP tcp -- any any anywhere anywhere tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
0 0 DROP tcp -- any any anywhere anywhere tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE
4 160 ACCEPT icmp -- any any anywhere anywhere icmp echo-request
14 991 LOGGING all -- any any anywhere anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy DROP 72 packets, 4736 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any lo anywhere anywhere
700 325K ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- any any anywhere anywhere multiport sports http,https state ESTABLISHED
0 0 ACCEPT tcp -- any any anywhere anywhere tcp spt:642 state ESTABLISHED
0 0 ACCEPT udp -- any any copernicus 199.195.255.68 udp spts:1024:65535 dpt:domain
0 0 ACCEPT tcp -- any any copernicus 199.195.255.69 tcp spts:1024:65535 dpt:domain
Chain LOGGING (1 references)
pkts bytes target prot opt in out source destination
14 991 LOG all -- any any anywhere anywhere limit: avg 2/min burst 5 LOG level info prefix "IPTables Packet Dropped: "
14 991 DROP all -- any any anywhere anywhere
你能告诉我哪条（些）规则搞砸了事情，为什么？或者哪条（些）规则缺失了，为什么？
谢谢
更新-添加规则：
-A OUTPUT -p tcp --sport 1024:65535 --dport 80 -j ACCEPT
-A OUTPUT -p udp -s EX_IP --sport 1024:65535 -d 199.195.255.68 --dport 53 -j ACCEPT
-A INPUT -p udp -s 199.195.255.68 --sport 53 -d EX_IP --dport 1024:65535 -j ACCEPT
-A OUTPUT -p tcp -s EX_IP --sport 1024:65535 -d 199.195.255.69 --dport 53 -j ACCEPT
-A INPUT -p tcp -s 199.195.255.69 --sport 53 -d EX_IP --dport 1024:65535 -j ACCEPT
日志条目错误：
May 7 13:03:00 hostname vmunix: IPTables Packet Dropped: IN= OUT=venet0 SRC=EX_IP DST=205.185.112.68 LEN=73 TOS=0x00 PREC=0x00 TTL=64 ID=1255 DF PROTO=UDP SPT=59037 DPT=53 LEN=53
答案1
我发现您的出站 DNS 规则存在三个问题：
- DNS 查询有时具有源端口 53。您的 ACCEPT 规则与此不匹配。
- 第一对规则适用于 UDP，第二对规则适用于 TCP。您应该为 DNS 设置八条规则，以覆盖两个 IP 地址的出站和入站方向的 TCP 和 UDP。
- DNS 规则是唯一具有明确源 IP 地址的规则。如果这不是正确的地址，数据包将与规则不匹配，您的 DNS 查询将不起作用。如果您有一个默认网关，允许您的内部地址通过 NAT 访问互联网，则使用的源地址可能不是规则中的外部地址。
为了帮助调试，值得在 OUTPUT 链的末尾添加一条规则，以便在策略丢弃数据包之前记录所有内容，因为它在上面的统计数据中已经执行了 72 次。
答案2
您不允许出站 HTTP 连接。由于您有此规则，我假设您正在运行 Web 服务器sport。
-A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT
您需要使用此规则，dport而不是sport像您已经拥有的那样（尽管该规则是多余的，因为您已经在 OUTPUT 规则中接受了 ESTABLISHED 流量）