我在连接服务器时遇到问题（这意味着我无法连接到任何 IP 或端口），问题似乎与 CSF 有关。我卸载了 CSF（通过运行 /etc/csf/uninstall.sh）并重新启动了服务器。我仍然无法连接。我运行了iptables -F然后service iptables save。然后我能够连接，但是一旦我重新启动服务器，我又被阻止了。我运行iptables -L以查看是否还有任何规则，我得到了以下信息：
Chain INPUT (policy DROP)
target prot opt source destination
spooflist all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
DROP all -f anywhere anywhere
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 5/min burst 7 LOG level warning prefix `NULL Packets'
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
DROP tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN limit: avg 5/min burst 7 LOG level warning prefix `XMAS Packets'
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN
LOG tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN limit: avg 5/min burst 7 LOG level warning prefix `Fin Packets Scan'
DROP tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
DROP all -- anywhere anywhere PKTTYPE = broadcast
DROP all -- anywhere anywhere PKTTYPE = multicast
DROP all -- anywhere anywhere state INVALID
ACCEPT tcp -- 21.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET 18.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET tcp dpt:ssh
ACCEPT tcp -- 21.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET 18.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET tcp dpt:ndmp
ACCEPT tcp -- 21.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET 18.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET tcp dpt:http
ACCEPT tcp -- 21.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET 18.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET tcp dpt:https
ACCEPT icmp -- anywhere anywhere icmp echo-request state NEW,RELATED,ESTABLISHED limit: avg 30/sec burst 5
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable limit: avg 30/sec burst 5
ACCEPT icmp -- anywhere anywhere icmp redirect limit: avg 30/sec burst 5
ACCEPT icmp -- anywhere anywhere icmp time-exceeded limit: avg 30/sec burst 5
LOG all -- anywhere anywhere limit: avg 5/min burst 7 LOG level warning
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
spooflist all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED
Chain spooflist (2 references)
target prot opt source destination
LOG all -- loopback/8 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- loopback/8 anywhere
LOG all -- 192.168.0.0/16 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 192.168.0.0/16 anywhere
LOG all -- 172.16.0.0/12 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 172.16.0.0/12 anywhere
LOG all -- 10.0.0.0/8 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 10.0.0.0/8 anywhere
LOG all -- link-local/16 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- link-local/16 anywhere
LOG all -- default/8 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- default/8 anywhere
LOG all -- 240.0.0.0/4 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 240.0.0.0/4 anywhere
LOG all -- 255.255.255.255 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 255.255.255.255 anywhere
LOG all -- 168.254.0.0/16 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 168.254.0.0/16 anywhere
LOG all -- base-address.mcast.net/4 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- base-address.mcast.net/4 anywhere
LOG all -- 240.0.0.0/5 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 240.0.0.0/5 anywhere
LOG all -- 248.0.0.0/5 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 248.0.0.0/5 anywhere
LOG all -- 192.0.2.0/24 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 192.0.2.0/24 anywhere
我运行lsmod|grep ip查看了加载了哪些 IPTables 模块，它似乎与我所有其他服务器都相同：
ipt_REJECT 2351 0
ipt_LOG 5845 0
ip6t_REJECT 4628 2
nf_conntrack_ipv6 8337 2
nf_defrag_ipv6 27236 1 nf_conntrack_ipv6
nf_conntrack 80390 2 nf_conntrack_ipv6,xt_state
ip6table_filter 2889 1
ip6_tables 18732 1 ip6table_filter
ipv6 334740 25 ip6t_REJECT,nf_conntrack_ipv6,nf_defrag_ipv6
这是启动时运行的服务列表（也是/etc/rc/rc.local默认文件）
auditd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
blk-availability 0:off 1:on 2:on 3:on 4:on 5:on 6:off
cgconfig 0:off 1:off 2:off 3:off 4:off 5:off 6:off
crond 0:off 1:off 2:on 3:on 4:on 5:on 6:off
ip6tables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
lvm2-monitor 0:off 1:on 2:on 3:on 4:on 5:on 6:off
mysql 0:off 1:off 2:on 3:on 4:on 5:on 6:off
named 0:off 1:off 2:on 3:on 4:on 5:on 6:off
netconsole 0:off 1:off 2:off 3:off 4:off 5:off 6:off
netfs 0:off 1:off 2:off 3:on 4:on 5:on 6:off
network 0:off 1:off 2:on 3:on 4:on 5:on 6:off
portreserve 0:off 1:off 2:on 3:on 4:on 5:on 6:off
postfix 0:off 1:off 2:on 3:on 4:on 5:on 6:off
restorecond 0:off 1:off 2:off 3:off 4:off 5:off 6:off
rsyslog 0:off 1:off 2:on 3:on 4:on 5:on 6:off
sshd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
udev-post 0:off 1:on 2:on 3:on 4:on 5:on 6:off
更多说明：
- 我曾在该服务器上安装过 KVM 和 OpenVZ，但后来删除了它们。我没有看到任何会导致规则加载的内容，但也许我看得不够仔细？
- 我没有看到任何会影响 IPTables 的 crontab 规则。
我尝试了各种方法来删除它们，但重启后它们仍然出现。有什么想法吗？
答案1
我发现问题出在启动时加载的一个脚本。我这个脚本被调用/etc/rc.local以使互联网能够与 OpenVZ 容器正常工作。我删除了脚本，现在我可以连接到服务器了。