☰

iptables 不适用于移动宽带

tag-icon • tag-icon linux networking iptables vpn
iptables 不适用于移动宽带

我使用 VPN 访问互联网。在 iptables 规则的帮助下，当我的 VPN 连接突然终止时，从我的机器到互联网的所有传出流量都会立即丢弃。

iptables 规则适用于有线连接，但当我使用移动宽带时则不起作用。上述规则如下：

#!/bin/bash

echo "Please wait a moment......"
echo "Save original iptables. Apply new iptables rules"

iptables-save > /home/username/vpn/iptables.save

iptables -A INPUT -m conntrack -j DROP --ctstate INVALID
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp -m conntrack -s 123.123.123.123 -i eth0 --sport 443 -j ACCEPT  --ctstate ESTABLISHED #example.conf
iptables -A OUTPUT -p tcp -m tcp -m conntrack -d 123.123.123.123 -o eth0 --dport 443 -j ACCEPT --ctstate NEW,ESTABLISHED #example.conf
iptables -A INPUT -p tcp -m tcp -m conntrack -s 123.123.123.123 -i usb0 --sport 443 -j ACCEPT  --ctstate ESTABLISHED #example.conf
iptables -A OUTPUT -p tcp -m tcp -m conntrack -d 123.123.123.123 -o usb0 --dport 443 -j ACCEPT --ctstate NEW,ESTABLISHED #example.conf
iptables -A INPUT -i eth0 -j DROP
iptables -A OUTPUT -o eth0 -j REJECT
iptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 80 -j ACCEPT  --ctstate NEW,ESTABLISHED
iptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 443 -j ACCEPT  --ctstate NEW,ESTABLISHED
iptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 53 -j ACCEPT  --ctstate NEW,ESTABLISHED
iptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 53 -j ACCEPT  --ctstate NEW,ESTABLISHED
iptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 80 -j ACCEPT  --ctstate ESTABLISHED
iptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 443 -j ACCEPT  --ctstate ESTABLISHED
iptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 53 -j ACCEPT  --ctstate ESTABLISHED
iptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 53 -j ACCEPT  --ctstate ESTABLISHED
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -A FORWARD -j DROP

我尝试通过 sudo-ing 和编辑文件来解决问题/etc/udev/rules.d/70-persistent-net.rules包括以下行：

# Mobile Broadband USB dongle
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="MAC address of dongle", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="usb0"

如果对您有帮助，以下是该文件的内容70-持久网络规则

# This file was automatically generated by the /lib/udev/write_net_rules
# program, run by the persistent-net-generator.rules rules file.
#
# You can modify it, as long as you keep each rule on a single
# line, and change only the value of the NAME= key.

# PCI device (r8169)
#SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="MAC address of ethernet card", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

# Mobile Broadband USB dongle
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="MAC address of dongle", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="usb0"

额外细节

为了让移动宽带在 Debian 7.9 上运行，我执行了以下步骤：

(1) 添加以下行/lib/udev/rules.d/40-usb_modeswitch.rules

# Mobile Broadband USB dongle
ATTRS{idVendor}=="19d2", ATTRS{idProduct}=="0257", RUN+="usb_modeswitch '%b/%k'"

(2) 创建一个名为19d2:0257在/etc/usb_modeswitch.d/包含以下内容：

# Mobile Broadband USB dongle
#
DefaultVendor= 0x19d2
DefaultProduct= 0x0257
TargetVendor= 0x19d2
TargetProduct= 0x0257
MessageContent="55534243123456782400000080000685000000240000000000000000000000"
CheckSuccess=20

（3 为了让网络管理器自动识别设备，我将以下行添加到/etc/rc.local

modprobe usbserial vendor=0x19d2 product=0x0257

相关内容