![iptables,所有端口都打开了吗?我该如何删除这一行?](https://linux22.com/image/694192/iptables%EF%BC%8C%E6%89%80%E6%9C%89%E7%AB%AF%E5%8F%A3%E9%83%BD%E6%89%93%E5%BC%80%E4%BA%86%E5%90%97%EF%BC%9F%E6%88%91%E8%AF%A5%E5%A6%82%E4%BD%95%E5%88%A0%E9%99%A4%E8%BF%99%E4%B8%80%E8%A1%8C%EF%BC%9F.png)
我配置防火墙已经很久了,现在我发现可能有一个错误,这是 iptables -L 的输入部分
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
DROP tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere tcp dpt:urd
ACCEPT tcp -- anywhere anywhere tcp dpt:pop3
ACCEPT tcp -- anywhere anywhere tcp dpt:pop3s
ACCEPT tcp -- anywhere anywhere tcp dpt:imap
ACCEPT tcp -- anywhere anywhere tcp dpt:imaps
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
你看到那条线了吗?
ACCEPT all -- anywhere anywhere
没有任何参数,这是否意味着所有端口都打开了?我该如何更改此行?
答案1
如果您是手动管理iptables
,则需要使用将规则写入文件iptables-save(8)
:
# iptables-save > /tmp/iptables.txt
根据需要编辑规则,然后使用iptables-restore(8)
:
# iptables-restore /tmp/iptables.txt
查看iptables
文档 ( apropos iptables
) 和在线博客文章,了解如何使用 配置状态防火墙iptables
。例如“迈向完美规则”,作者:Jan Engelhardt。
答案2
如果你运行:
iptables -L --line-numbers
您将获得一个行号参考:
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
2 fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh
3 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
4 DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
5 DROP tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
6 DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
7 ACCEPT all -- anywhere anywhere
8 ACCEPT tcp -- anywhere anywhere tcp dpt:http
9 ACCEPT tcp -- anywhere anywhere tcp dpt:https
[...]
然后你可以运行
iptables -D INPUT 7