![`systemctl restart iptables` 会阻止一切](https://linux22.com/image/680678/%60systemctl%20restart%20iptables%60%20%E4%BC%9A%E9%98%BB%E6%AD%A2%E4%B8%80%E5%88%87.png)
通过 ssh 连接到 Fedora 23 服务器,并决定在添加新规则后重新启动 iptables:。systemctl restart iptables
但是iptables
从未重新启动,或者重新启动非常慢(我等了 3 个多小时),导致阻止所有连接,迫使我去数据中心重新启动系统。重新启动后一切似乎都正常,所以我尝试systemctl restart iptables
再次运行。同样的事情发生了。所有连接都被阻止,iptables -L
列出所有规则需要很长时间。为什么重新启动 iptables 会导致这种情况?在 Fedora 上重新启动的更安全方法是什么iptables
?
继承人的输出iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
DROP tcp -- anywhere pages33.mit.io tcp dpt:ssh state NEW recent: UPDATE seconds: 120 hit_count: 6 name: sshold2 side: source mask: 255.255.255.255
tcp -- anywhere pages33.mit.io tcp dpt:ssh state NEW recent: SET name: sshold2 side: source mask: 255.255.255.255
DROP tcp -- anywhere order.mit.io tcp dpt:ssh state NEW recent: UPDATE seconds: 120 hit_count: 6 name: sshold side: source mask: 255.255.255.255
tcp -- anywhere order.mit.io tcp dpt:ssh state NEW recent: SET name: sshold side: source mask: 255.255.255.255
DROP all -- loopback/8 anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -f 192.168.1.0/24 anywhere
ACCEPT all -f 10.0.1.0/24 anywhere
ACCEPT all -f 10.0.1.0/24 anywhere
ACCEPT all -f 10.0.1.0/24 anywhere
ACCEPT all -f 10.0.1.0/24 anywhere
ACCEPT all -f 10.0.1.0/24 anywhere
swatch_rejects all -- anywhere anywhere
ACCEPT tcp -- anywhere order.mit.io tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere multiport dports 50000:60000
ACCEPT tcp -- anywhere clic.brg.mit.io tcp dpt:http
ACCEPT tcp -- anywhere clic.brg.mit.io tcp dpt:https
ACCEPT tcp -- 123.123.123.0/21 lol.al.mit.io tcp dpt:http
ACCEPT tcp -- 123.123.123.0/21 lol.al.mit.io tcp dpt:https
ACCEPT tcp -- anywhere lol.al.mit.io source IP range xxxxx tcp dpt:http
ACCEPT tcp -- anywhere lol.al.mit.io source IP range xxxxx tcp dpt:https
ACCEPT tcp -- anywhere lol.al.mit.io source IP range xxxxx tcp dpt:http
ACCEPT tcp -- anywhere lol.al.mit.io source IP range xxxxx tcp dpt:https
ACCEPT tcp -- anywhere lol.al.mit.io source IP range xxxxx tcp dpt:http
ACCEPT tcp -- anywhere lol.al.mit.io source IP range xxxxx tcp dpt:https
DROP tcp -- anywhere lol.al.mit.io tcp dpt:http
DROP tcp -- anywhere lol.al.mit.io tcp dpt:https
ACCEPT tcp -- anywhere order.mit.io tcp dpt:ssh
ACCEPT tcp -- anywhere pages33.mit.io tcp dpt:ssh
ACCEPT tcp -- anywhere order.mit.io tcp dpt:http
ACCEPT tcp -- anywhere order.mit.io tcp dpt:https
ACCEPT udp -- anywhere anywhere udp dpt:ircu
ACCEPT udp -- anywhere anywhere udp dpt:ircu-2
ACCEPT udp -- anywhere pages.mit.io udp dpt:bootps
ACCEPT udp -- anywhere pages.mit.io udp dpt:bootpc
ACCEPT tcp -- anywhere pages.mit.io tcp dpt:bootps
ACCEPT tcp -- anywhere pages.mit.io tcp dpt:bootpc
ACCEPT !icmp -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
DROP all -- anywhere anywhere ctstate NEW
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain swatch_rejects (1 references)
target prot opt source destination