☰

为什么这个 iptables 配置会阻止 munin 工作？

tag-icon • tag-icon centos iptables munin centos6.5
为什么这个 iptables 配置会阻止 munin 工作？

我已经创建了一个 iptables 配置，我以为我理解了，但是它似乎阻止了 munin 生成图表，我不确定为什么。如果我禁用 iptables，munin 将按预期生成图表。我已包含我的 iptables 配置和 munin 配置。有人看到 munin 是如何被阻止的吗？Munin 应该只在环回设备上连接和监听。

iptables 配置：

*filter

# Drop everything by default
:INPUT DROP [0:0]

# We are not routing packets
:FORWARD DROP [0:0]

# Don't filter output
:OUTPUT ACCEPT [0:0]

# Add the fail2ban chain
:fail2ban-SSH - [0:0]

# Drop NULL packets
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# Reject a syn-flood attack
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# Drop XMAS packets
-A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# We want the response packets...
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Accept all from loopback
-A INPUT -i lo -j ACCEPT

# Send packets for port 22 to fail2ban, it may drop them
-A INPUT -p tcp -m tcp --dport 22 -j fail2ban-SSH
-A fail2ban-SSH -j RETURN
# If fail2ban didn't drop it let it on through
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

# HTTP(S)
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

munin配置的相关部分：

# A list of addresses that are allowed to connect.  This must be a
# regular expression, since Net::Server does not understand CIDR-style
# network notation unless the perl module Net::CIDR is installed.  You
# may repeat the allow line as many times as you'd like

allow ^127\.0\.0\.1$
allow ^::1$

# Which address to bind to;
host *
# host 127.0.0.1

# And which port
port 4949

答案1

来自 iptables 的手册页：

每个数据包仅经过三个链中的一个（环回流量除外，它涉及 INPUT 和 OUTPUT 链）；

换句话说，环回流量确实被 iptables 捕获，正如您现在发现的那样……

我建议做如下事情：

-A INPUT -p tcp -m tcp -s 127.0.0.1 -d 127.0.0.1 --dport 4949 -j ACCEPT

相关内容