☰

运行 iptables 脚本时无法访问网站！

tag-icon • tag-icon linux security iptables http https
运行 iptables 脚本时无法访问网站！

我编写了保护我的机器的脚本：

#!/bin/bash

ssh=1.1.1.1
http='1.1.1.1 2.2.2.2'

# Clear any previous rules.
iptables -F

# Default drop policy.
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

#iptables -A INPUT  -p tcp -m state --state NEW,ESTABLISHED     -j ACCEPT
#iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

iptables -N SSH_CHECK
iptables -N HTTP_CHECK
iptables -A INPUT -p tcp --dport 22 -j SSH_CHECK
iptables -A INPUT -p tcp --dport 80 -j HTTP_CHECK
iptables -A INPUT -p tcp --dport 443 -j HTTP_CHECK

iptables -A SSH_CHECK -s $ssh -j ACCEPT -m comment --comment "Allowing $ssh to ssh from his IP"
for web in $http; do
    iptables -A HTTP_CHECK -s $web -j ACCEPT -m comment --comment "Allowing $web to visit my HTTP/S server"
done

#Allowing http[s] from inside to outside
iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sport 80,443 -m state --state ESTABLISHED -j ACCEPT

#Allow ssh from inside to outside
iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

#Allow working on localhost
iptables -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

#Allow ping from inside to outside
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

的输出iptables -L -v是：

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 SSH_CHECK  tcp  --  any    any     anywhere             anywhere             tcp dpt:ssh
    0     0 HTTP_CHECK  tcp  --  any    any     anywhere             anywhere             tcp dpt:http
    0     0 HTTP_CHECK  tcp  --  any    any     anywhere             anywhere             tcp dpt:https
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             multiport sports http,https state ESTABLISHED
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             tcp spt:ssh state ESTABLISHED
    0     0 ACCEPT     all  --  lo     any     localhost            localhost           
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-reply

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  any    eth0    anywhere             anywhere             multiport dports http,https state NEW,ESTABLISHED
    0     0 ACCEPT     tcp  --  any    eth0    anywhere             anywhere             tcp dpt:ssh state NEW,ESTABLISHED
    0     0 ACCEPT     all  --  any    lo      localhost            localhost           
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request

Chain HTTP_CHECK (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     1.1.1.1              anywhere             /* Allowing 1.1.1.1 to visit my HTTP/S server */
    0     0 ACCEPT     all  --  any    any     2.2.2.2              anywhere             /* Allowing 2.2.2.2 to visit my HTTP/S server */

Chain SSH_CHECK (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     1.1.1.1              anywhere             /* Allowing 1.1.1.1 to ssh from his IP */

1) 我想使用此策略打开网站，但不能。为什么？我该如何修复它？ 2）当我在脚本中取消注释时，这些规则是什么？

#iptables -A INPUT  -p tcp -m state --state NEW,ESTABLISHED     -j ACCEPT
#iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

答案1

您无法访问 DNS，这是使用名称解析 Web 访问所必需的。

我会通过以下方式改变规则：

#!/bin/bash

ssh=1.1.1.1
http='1.1.1.1 2.2.2.2'
if=eth0

# Clear any previous rules.
iptables -F

# Default drop policy.
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Allow all related and established packets
iptables -A INPUT  -p tcp -m state --state RELATED,ESTABLISHED     -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state RELATED,ESTABLISHED     -j ACCEPT

#iptables -A INPUT  -p tcp -m state --state NEW,ESTABLISHED     -j ACCEPT
#iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

iptables -N SSH_CHECK
iptables -N HTTP_CHECK
iptables -A INPUT -p tcp --dport 22 -j SSH_CHECK
iptables -A INPUT -p tcp --dport 80 -j HTTP_CHECK
iptables -A INPUT -p tcp --dport 443 -j HTTP_CHECK

iptables -A SSH_CHECK -s $ssh -j ACCEPT -m comment --comment "Allowing $ssh to ssh from his IP"
for web in $http; do
    iptables -A HTTP_CHECK -s $web -j ACCEPT -m comment --comment "Allowing $web to visit my HTTP/S server"
done

#Allowing http[s] from inside to outside
iptables -A OUTPUT -o $if -p tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT
# Allow DNS - you might want to limit this to a few know, trusted servers
iptables -A OUTPUT -o $if -p udp --dport 53 -j ACCEPT

#Allow ssh from inside to outside
iptables -A OUTPUT -o $if -p tcp --dport 22 -m state --state NEW -j ACCEPT

#Allow working on localhost, using any IP
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#Allow ping from inside to outside
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT

注释掉的规则：

  • 第一个将允许所有传入的 TCP 连接。
  • 第二个似乎试图阻止使用除了SYN数据包之外的任何东西建立新的TCP连接，这并不是特别有意义......（我对此并不完全确定，它假设唯一!适用于直接之后，因为这似乎是常见的做事方式）这个问题的答案有一些细节 更多信息请访问 freezetux

相关内容