![IPTables 链仅返回,如通过 iRedMail 设置的](https://linux22.com/image/685195/IPTables%20%E9%93%BE%E4%BB%85%E8%BF%94%E5%9B%9E%EF%BC%8C%E5%A6%82%E9%80%9A%E8%BF%87%20iRedMail%20%E8%AE%BE%E7%BD%AE%E7%9A%84%20.png)
我不想问这个问题,但我很确定我已经正确配置了 iRedMail 作为我的电子邮件服务器/VPS re dovecot、postfix 等的主机(尽管所有事情几乎都是通过它们的安装脚本自动完成的)。
虽然我根本不是防火墙专家,但我也不完全傻,因此我一直在试图弄清楚为什么我无法通过 pop、imap、smtp 等通过外部电子邮件客户端的各个端口连接到邮件服务器。
我无法远程 telnet 到任何端口,但可以从本地访问它们,所以我认为这一定是防火墙问题,这让我得出当前的结论:防火墙进程可能有错误?
这些是一些命令的结果:
[root@server user]# telnet localhost 110
Trying ::1...
Connected to localhost.
Escape character is '^]'.
+OK Dovecot ready.
只是为了确认它能正常工作:
[root@server user]# dovecot -n | grep protocols
protocols = pop3 imap sieve lmtp
ssl_protocols = !SSLv2 !SSLv3
然后是 IP 表输出:
[root@server user]# iptables -S
-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N FORWARD_IN_ZONES
-N FORWARD_IN_ZONES_SOURCE
-N FORWARD_OUT_ZONES
-N FORWARD_OUT_ZONES_SOURCE
-N FORWARD_direct
-N FWDI_public
-N FWDI_public_allow
-N FWDI_public_deny
-N FWDI_public_log
-N FWDO_public
-N FWDO_public_allow
-N FWDO_public_deny
-N FWDO_public_log
-N INPUT_ZONES
-N INPUT_ZONES_SOURCE
-N INPUT_direct
-N IN_public
-N IN_public_allow
-N IN_public_deny
-N IN_public_log
-N OUTPUT_direct
-N f2b-default
-N f2b-dovecot
-N f2b-postfix
-N f2b-roundcube
-A INPUT -p tcp -m multiport --dports 80,443,25,587,110,995,143,993,4190 -j f2b-postfix
-A INPUT -p tcp -m multiport --dports 80,443,25,587,110,995,143,993,4190 -j f2b-dovecot
-A INPUT -p tcp -m multiport --dports 80,443,25,587,110,995,143,993,4190 -j f2b-roundcube
-A INPUT -p tcp -j f2b-default
-A INPUT -p tcp -j f2b-default
-A INPUT -p tcp -m multiport --dports 80,443,25,587,110,995,143,993,4190 -j f2b-postfix
-A INPUT -p tcp -m multiport --dports 80,443,25,587,110,995,143,993,4190 -j f2b-dovecot
-A INPUT -p tcp -m multiport --dports 80,443,25,587,110,995,143,993,4190 -j f2b-roundcube
-A INPUT -p tcp -j f2b-default
-A INPUT -p tcp -j f2b-default
-A INPUT -i lo -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 7822 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 7822 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 7822 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8001 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
-A f2b-default -j RETURN
-A f2b-default -j RETURN
-A f2b-default -j RETURN
-A f2b-default -j RETURN
-A f2b-dovecot -j RETURN
-A f2b-dovecot -j RETURN
-A f2b-postfix -j RETURN
-A f2b-postfix -j RETURN
-A f2b-roundcube -j RETURN
-A f2b-roundcube -j RETURN
或者不同的观点。
[root@server log]# iptables -nvL
Chain INPUT (policy DROP 8296 packets, 397K bytes)
pkts bytes target prot opt in out source destination
19567 2390K f2b-postfix tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
19567 2390K f2b-dovecot tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
19567 2390K f2b-roundcube tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
106K 13M f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
106K 13M f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19567 2390K f2b-postfix tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
19567 2390K f2b-dovecot tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
19567 2390K f2b-roundcube tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
106K 13M f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
106K 13M f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
46957 7004K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/0 tcp dpt:7822
0 0 ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/0 tcp dpt:7822
0 0 ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/0 tcp dpt:7822
0 0 ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/0 tcp dpt:22
396 25848 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
8718 1575K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20
43508 3858K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
21 1248 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10000
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8000
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8000
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8000
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8001
748 43552 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:996
7 444 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 112K packets, 80M bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD_IN_ZONES (0 references)
pkts bytes target prot opt in out source destination
Chain FORWARD_IN_ZONES_SOURCE (0 references)
pkts bytes target prot opt in out source destination
Chain FORWARD_OUT_ZONES (0 references)
pkts bytes target prot opt in out source destination
Chain FORWARD_OUT_ZONES_SOURCE (0 references)
pkts bytes target prot opt in out source destination
Chain FORWARD_direct (0 references)
pkts bytes target prot opt in out source destination
Chain FWDI_public (0 references)
pkts bytes target prot opt in out source destination
Chain FWDI_public_allow (0 references)
pkts bytes target prot opt in out source destination
Chain FWDI_public_deny (0 references)
pkts bytes target prot opt in out source destination
Chain FWDI_public_log (0 references)
pkts bytes target prot opt in out source destination
Chain FWDO_public (0 references)
pkts bytes target prot opt in out source destination
Chain FWDO_public_allow (0 references)
pkts bytes target prot opt in out source destination
Chain FWDO_public_deny (0 references)
pkts bytes target prot opt in out source destination
Chain FWDO_public_log (0 references)
pkts bytes target prot opt in out source destination
Chain INPUT_ZONES (0 references)
pkts bytes target prot opt in out source destination
Chain INPUT_ZONES_SOURCE (0 references)
pkts bytes target prot opt in out source destination
Chain INPUT_direct (0 references)
pkts bytes target prot opt in out source destination
Chain IN_public (0 references)
pkts bytes target prot opt in out source destination
Chain IN_public_allow (0 references)
pkts bytes target prot opt in out source destination
Chain IN_public_deny (0 references)
pkts bytes target prot opt in out source destination
Chain IN_public_log (0 references)
pkts bytes target prot opt in out source destination
Chain OUTPUT_direct (0 references)
pkts bytes target prot opt in out source destination
Chain f2b-default (4 references)
pkts bytes target prot opt in out source destination
422K 50M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain f2b-dovecot (2 references)
pkts bytes target prot opt in out source destination
39134 4779K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain f2b-postfix (2 references)
pkts bytes target prot opt in out source destination
39134 4779K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain f2b-roundcube (2 references)
pkts bytes target prot opt in out source destination
39134 4779K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
正如我所说,我不是专家,但对我来说,它似乎捕获了“电子邮件”端口领域中的所有流量,然后将其发送到 f2b* 规则,但随后只是给出一个 RETURN。它从未接受过任何内容。
或者,流量是否被发送到实际的 fail2ban 程序进行分析,然后决定如何处理它?
抱歉,我问了个比较简单的问题。
干杯,史蒂夫
答案1
您可以在 iptables 配置中看到这样的条目:
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8001 -j ACCEPT
这些规则从外部打开端口。如您所见,您的邮件服务没有打开端口。您应该添加它们以从外部连接到端口。
答案2
感谢您的建议。虽然最初的问题没有完全解决,但引导问题确实帮助我进一步弄清楚了问题。我确信我不是唯一一个将来可能遇到这个问题的人,所以我发布了我的答案。
正在发生的事情是(正如我所怀疑的),在 iptables 中,有一些规则可以捕获选定端口上的流量,然后通过 fail2ban 运行该流量,如果它不在禁止列表中,则仅返回它。
因此,由于这个原因(并已确认),不允许流量通过,因为从技术上讲没有端口开放。
从那时起,我已经解决了这个问题,并且通过向 iptables 添加如下所示的额外规则来工作。
iptables -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
此处解释了其正确工作原理:https://www.digitalocean.com/community/tutorials/how-fail2ban-works-to-protect-services-on-a-linux-server
您可以在此处阅读有关添加开放端口的信息:https://www.digitalocean.com/community/tutorials/how-to-set-up-a-basic-iptables-firewall-on-centos-6
如果您使用 iRedMail,他们会有一个开放端口列表:http://www.iredmail.org/docs/network.ports.html