☰

IPTables 仅允许现有的 http 连接

tag-icon • tag-icon linux iptables
IPTables 仅允许现有的 http 连接

我正在尝试在 apache 网络主机上配置 IPTables 防火墙，并且我提出了一些规则，这些规则看起来像扩展已在 Centos 框上配置的链：

target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 
ACCEPT     icmp --  anywhere             anywhere            icmp any 
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pcsync-https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ndmp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:submission 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:10050 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

虽然它允许以前访问过该盒子的用户建立 http 连接（我猜是现有连接），但为什么它拒绝新的连接呢？

一旦防火墙被关闭，所有网站内容都会恢复正常，所以我不明白。

答案1

它仅允许指定新的连接，即：

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp

它将允许与端口 80、443、110、143、25 建立新连接。

相关内容