☰

通过 IPTables 的 PPTP

tag-icon • tag-icon iptables firewall pptp
通过 IPTables 的 PPTP

我最近在运行 iptables 的网络上实现了 Raspberry Pi 防火墙/网关。

自从实施以来，我无法在工作中连接到基于 Windows 的 PPTP 服务器。

我以为我有一个“允许一切出去”的规则，但我想不是。下面列出了整个 iptables 脚本。

PATH=/usr/sbin:/sbin:/bin:/usr/bin

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

iptables -A FORWARD -i eth1 -o eth1 -j REJECT

echo 1 > /proc/sys/net/ipv4/ip_forward

这是我的 iptables -L -vn 的结果； iptables -t nat -L -vn：

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
   21  1572 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0            state NEW
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    9   656 ACCEPT     all  --  eth1   eth0    0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  eth1   eth0    0.0.0.0/0            0.0.0.0/0            tcp dpt:1723 state NEW,ESTABLISHED
    0     0 ACCEPT     tcp  --  eth0   eth1    0.0.0.0/0            0.0.0.0/0            tcp spt:1723 state RELATED,ESTABLISHED
    0     0 ACCEPT     47   --  eth1   eth1    0.0.0.0/0            0.0.0.0/0            state NEW,ESTABLISHED
    0     0 ACCEPT     47   --  eth0   eth1    0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    9   498 ACCEPT     all  --  eth0   eth1    0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  eth1   eth1    0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   11  1212 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW,ESTABLISHED
Chain PREROUTING (policy ACCEPT 1 packets, 64 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1723 to:192.168.1.51
    0     0 DNAT       47   --  eth1   *       0.0.0.0/0            0.0.0.0/0            to:192.168.1.51

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    1    64 MASQUERADE  all  --  *      eth1    0.0.0.0/0            0.0.0.0/0

答案1

尝试这个：

modprobe ip_nat_pptp

即使所有规则都非常宽松，我也无法从 LAN 进行连接。

相关内容