![iptables 不适用于移动宽带](https://linux22.com/image/74295/iptables%20%E4%B8%8D%E9%80%82%E7%94%A8%E4%BA%8E%E7%A7%BB%E5%8A%A8%E5%AE%BD%E5%B8%A6.png)
我使用 VPN 访问互联网。在 iptables 规则的帮助下,当我的 VPN 连接突然终止时,从我的机器到互联网的所有传出流量都会立即丢弃。
iptables 规则适用于有线连接,但当我使用移动宽带时则不起作用。上述规则如下:
#!/bin/bash
echo "Please wait a moment......"
echo "Save original iptables. Apply new iptables rules"
iptables-save > /home/username/vpn/iptables.save
iptables -A INPUT -m conntrack -j DROP --ctstate INVALID
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp -m conntrack -s 123.123.123.123 -i eth0 --sport 443 -j ACCEPT --ctstate ESTABLISHED #example.conf
iptables -A OUTPUT -p tcp -m tcp -m conntrack -d 123.123.123.123 -o eth0 --dport 443 -j ACCEPT --ctstate NEW,ESTABLISHED #example.conf
iptables -A INPUT -p tcp -m tcp -m conntrack -s 123.123.123.123 -i usb0 --sport 443 -j ACCEPT --ctstate ESTABLISHED #example.conf
iptables -A OUTPUT -p tcp -m tcp -m conntrack -d 123.123.123.123 -o usb0 --dport 443 -j ACCEPT --ctstate NEW,ESTABLISHED #example.conf
iptables -A INPUT -i eth0 -j DROP
iptables -A OUTPUT -o eth0 -j REJECT
iptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 80 -j ACCEPT --ctstate NEW,ESTABLISHED
iptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 443 -j ACCEPT --ctstate NEW,ESTABLISHED
iptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 53 -j ACCEPT --ctstate NEW,ESTABLISHED
iptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 53 -j ACCEPT --ctstate NEW,ESTABLISHED
iptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 80 -j ACCEPT --ctstate ESTABLISHED
iptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 443 -j ACCEPT --ctstate ESTABLISHED
iptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 53 -j ACCEPT --ctstate ESTABLISHED
iptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 53 -j ACCEPT --ctstate ESTABLISHED
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -A FORWARD -j DROP
我尝试通过 sudo-ing 和编辑文件来解决问题/etc/udev/rules.d/70-persistent-net.rules包括以下行:
# Mobile Broadband USB dongle
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="MAC address of dongle", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="usb0"
如果对您有帮助,以下是该文件的内容70-持久网络规则
# This file was automatically generated by the /lib/udev/write_net_rules
# program, run by the persistent-net-generator.rules rules file.
#
# You can modify it, as long as you keep each rule on a single
# line, and change only the value of the NAME= key.
# PCI device (r8169)
#SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="MAC address of ethernet card", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"
# Mobile Broadband USB dongle
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="MAC address of dongle", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="usb0"
额外细节
为了让移动宽带在 Debian 7.9 上运行,我执行了以下步骤:
(1) 添加以下行/lib/udev/rules.d/40-usb_modeswitch.rules
# Mobile Broadband USB dongle
ATTRS{idVendor}=="19d2", ATTRS{idProduct}=="0257", RUN+="usb_modeswitch '%b/%k'"
(2) 创建一个名为19d2:0257在/etc/usb_modeswitch.d/包含以下内容:
# Mobile Broadband USB dongle
#
DefaultVendor= 0x19d2
DefaultProduct= 0x0257
TargetVendor= 0x19d2
TargetProduct= 0x0257
MessageContent="55534243123456782400000080000685000000240000000000000000000000"
CheckSuccess=20
(3 为了让网络管理器自动识别设备,我将以下行添加到/etc/rc.local
modprobe usbserial vendor=0x19d2 product=0x0257