为什么 IP 表拒绝规则中明确指定为 OK 的某些内容？

2024-5-31 • tag-icon

我有一条首要规则：

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
... other rules, non-involving tap777 ...
-A INPUT -i tap777 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i tap777 -p udp -m udp --dport 53 -j ACCEPT

我在日志中看到了这一点：

Oct 25 04:09:43 ip-xxx-xx-xx-xxx 1 kernel: [ 1824.841222] iptables denied: IN=tap777 OUT= MAC=xx:xx:c6:93:91:bb:b8:ae:ed:7b:d1:83:08:xx SRC=10.20.1.141 DST=10.20.1.1 LEN=343 TOS=0x00 PREC=0x00 TTL=128 ID=4977 PROTO=UDP SPT=68 DPT=67 LEN=323

在我看来，拒绝与规则完全一样。相同的 dport、相同的 proto、相同的在接口。所以我只想知道这是否与它不是正确的链有关？

sudo iptables -L给出：

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             127.0.0.0/8          reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
ACCEPT     udp  --  anywhere             anywhere             udp dpt:11900
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere

有人能告诉我为什么会这样吗？或者有什么可以尝试的吗？谢谢！

答案1

LOG 全部 -- 任何地方任何地方限制：平均 5/分钟突发 5 LOG 级别调试前缀“iptables 被拒绝：”

正在限制数据包并因此拒绝日志。将其置于输入链的倒数第二位。它肯定会开始工作。希望这有帮助！请支持并将答案标记为有帮助或已回答。谢谢 :)

答案1

相关内容