我意识到我的 IPv6 端口没有经过 iptables，因此很容易受到攻击。我还没有看到任何攻击，但我确信这只是时间问题。因此，我正在尝试加强 ipv6 防火墙。我偶然发现了这个配置规则的脚本ip6tables：
#!/bin/bash
# ip6tables single-host firewall script
# Define your command variables
ipt6="/sbin/ip6tables"
# Flush all rules and delete all chains
# for a clean startup
$ipt6 -F
$ipt6 -X
# Zero out all counters
$ipt6 -Z
# Default policies: deny all incoming
# Unrestricted outgoing
$ipt6 -P INPUT DROP
$ipt6 -P FORWARD DROP
$ipt6 -P OUTPUT ACCEPT
# Must allow loopback interface
$ipt6 -A INPUT -i lo -j ACCEPT
# Reject connection attempts not initiated from the host
$ipt6 -A INPUT -p tcp --syn -j DROP
# Allow return connections initiated from the host
$ipt6 -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Accept all ICMP v6 packets
$ipt6 -A INPUT -p ipv6-icmp -j ACCEPT
# Optional rules to allow other LAN hosts access to services. Delete $ipt6 -A INPUT -p tcp --syn -j DROP
# Allow DHCPv6 from LAN only
$ipt6 -A INPUT -m state --state NEW -m udp -p udp -s fe80::/10 --dport 546 -j ACCEPT
# Allow connections from SSH clients
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
# Allow HTTP and HTTPS traffic
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
# Allow access to SMTP, POP3, and IMAP
$ipt6 -A INPUT -m state --state NEW -p tcp -m multiport --dport 25,110,143 -j ACCEPT
虽然这确实阻止了我想要的操作，但它似乎也不允许 80 和 443 端口？
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
当我尝试从另一台服务器访问时，它就挂起了：
curl -v -6 http://backups.foo.org:80
* Rebuilt URL to: http://backups.foo.org:80/
* Trying 2a00:1098:80:a1::1...
* TCP_NODELAY set
ipv4 工作正常：
curl -v -4 http://backups.foo.org:80
* Rebuilt URL to: http://backups.foo.org:80/
* Trying 93.93.135.111...
* TCP_NODELAY set
* Connected to backups.foo.org (93.93.135.169) port 80 (#0)
> GET / HTTP/1.1
> Host: backups.foo.org
> User-Agent: curl/7.58.0
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< Server: nginx
< Date: Tue, 23 Feb 2021 07:52:32 GMT
< Content-Type: text/html
< Content-Length: 162
< Connection: keep-alive
< Location: https://backups.foo.org/
<
<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx</center>
</body>
</html>
* Connection #0 to host backups.foo.org left intact
我遗漏了什么？基本上，我只想阻止敏感服务（MySQL、Exim、SMTP 等）上的 ipv6 端口。
更新：根据建议，我已删除：
$ipt6 -A INPUT -p tcp --syn -j DROP
然后再次运行脚本，ip6tables现在如下所示：
root@backups:~# ip6tables --list -n
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all ::/0 ::/0
ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED
ACCEPT icmpv6 ::/0 ::/0
ACCEPT udp fe80::/10 ::/0 state NEW udp dpt:546
ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:22
ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:80
ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:443
ACCEPT tcp ::/0 ::/0 state NEW multiport dports 25,110,143
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
我已经测试过了：
curl -6 backups.foo.org
curl: (7) Failed to connect to backups.foo.org port 80: Connection refused
再次，它与 一起工作-4。奇怪的是它从这里开始工作：
https://tools.keycdn.com/ipv6-ping
我可以从同一台服务器 ping 通，并且工作正常：
ping backups.foo.org
PING backups.chambresdhotes.org(2a00:1098:80:a1::1 (2a00:1098:80:a1::1)) 56 data bytes
64 bytes from 2a00:1098:80:a1::1 (2a00:1098:80:a1::1): icmp_seq=1 ttl=59 time=1.08 ms
64 bytes from 2a00:1098:80:a1::1 (2a00:1098:80:a1::1): icmp_seq=2 ttl=59 time=1.03 ms
^X^C
根据要求，输出ip6tables-save如下：
ip6tables-save
# Generated by ip6tables-save v1.6.1 on Tue Feb 23 08:57:59 2021
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [78:6090]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -s fe80::/10 -p udp -m state --state NEW -m udp --dport 546 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m multiport --dports 25,110,143 -j ACCEPT
COMMIT
更新2：
根据要求，输出来自 ss -lnpt。有趣的是，我没有在那里看到端口 80。
LISTEN 0 100 [::]:993 [::]:*
LISTEN 0 100 [::]:995 [::]:*
LISTEN 0 128 [::]:22122 [::]:*
LISTEN 0 100 [::]:110 [::]:*
LISTEN 0 128 ::1]:783 [::]:*
LISTEN 0 100 [::]:143 [::]:*
LISTEN 0 128 [::]:55413 [::]:*
LISTEN 0 128 *:8181 *:*
LISTEN 0 128 ::1]:53 [::]:*
LISTEN 0 128 [::]:55414 [::]:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 [::1]:8953 [::]:*
但有趣的是，它显示了netstat：
sudo netstat -tulpan | grep nginx
tcp 0 0 0.0.0.0:9183 0.0.0.0:* LISTEN 1133/nginx: master
tcp 0 0 93.93.135.169:80 0.0.0.0:* LISTEN 1161/nginx: master
tcp 0 0 127.0.0.1:8084 0.0.0.0:* LISTEN 1161/nginx: master
tcp 0 0 93.93.135.169:443 0.0.0.0:* LISTEN 1161/nginx: master
tcp6 0 0 :::80 :::* LISTEN 1161/nginx: master
tcp6 0 0 :::443 :::* LISTEN 1161/nginx: master
udp 0 0 127.0.0.1:51104 127.0.0.53:53 ESTABLISHED 1135/nginx: worker
答案1
这是一个教训，不要在不理解任何一行内容的情况下使用安全脚本。
我怀疑这部分是罪魁祸首：
# Reject connection attempts not initiated from the host
$ipt6 -A INPUT -p tcp --syn -j DROP
它实际上会禁用所有传入的 TCPv6 通信。它还必须禁用所有“相关”的 TCPv6 通信（例如，“活动”FTP），因为它出现在 ctstate 行之前。
只需将其删除即可。它毫无用处。无论如何，所有不匹配的数据包都会被策略丢弃，那么为什么要在链的早期丢弃任何东西，而不留下选择性启用服务的可能性？我不明白为什么这行会出现在脚本中。