以下是我在ubuntu云服务器上的iptable规则:
猫/etc/iptables.rules:
*filter
:INPUT DROP [598:41912]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [456:35354]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state -i eth0 --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -s mycompany.dyndns.com -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s mycompany.dyndns.com -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s mycompany.dyndns.com -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -j DROP
COMMIT
我没有在上述 iptable 规则中打开 ftp 端口 21,但我可以通过 ftp 连接到服务器。怎么办?
nmap 服务器 IP
Not shown: 987 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
53/tcp open domain
80/tcp open http
111/tcp open rpcbind
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
389/tcp open ldap
445/tcp filtered microsoft-ds
10000/tcp open java-or-OTGfileshare
2401/tcp open cvspserver
3306/tcp open mysql
Nmap done: 1 IP address (1 host up) scanned in 17.46 seconds
为什么这么多端口显示为打开。我很清楚这些服务正在服务器上运行,但是当它没有包含在 iptable 规则中时,它如何列出或连接(ftp)这些端口?
需要帮忙...
The following script will be running at every 5 mins on cloud servers to update their iptables for the dyndns domain name:
#!/bin/bash
#
# A script to update iptable records for dynamic dns hosts.
# Written by: Dave Horner (http://dave.thehorners.com)
# Released into public domain.
#
# Run this script in your cron table to update ips.
#
# You might want to put all your dynamic hosts in a sep. chain.
# That way you can easily see what dynamic hosts are trusted.
#
# create the chain in iptables.
/sbin/iptables -N dynamichosts
# insert the chain into the input chain @ the head of the list.
/sbin/iptables -I INPUT 1 -j dynamichosts
# flush all the rules in the chain
/sbin/iptables -F dynamichosts
HOST=$1
HOSTFILE="/root/host-$HOST"
CHAIN="dynamichosts" # change this to whatever chain you want.
IPTABLES="/sbin/iptables"
# check to make sure we have enough args passed.
if [ "${#@}" -ne "1" ]; then
echo "$0 hostname"
echo "You must supply a hostname to update in iptables."
exit
fi
# lookup host name from dns tables
IP=`/usr/bin/dig +short $HOST | /usr/bin/tail -n 1`
if [ "${#IP}" = "0" ]; then
echo "Couldn't lookup hostname for $HOST, failed."
exit
fi
OLDIP=""
if [ -a $HOSTFILE ]; then
OLDIP=`cat $HOSTFILE`
# echo "CAT returned: $?"
fi
# save off new ip.
echo $IP>$HOSTFILE
echo "Updating $HOST in iptables."
if [ "${#OLDIP}" != "0" ]; then
echo "Removing old rule ($OLDIP)"
`$IPTABLES -D $CHAIN -s $OLDIP/32 -j ACCEPT`
fi
echo "Inserting new rule ($IP)"
`$IPTABLES -A $CHAIN -s $IP/32 -j ACCEPT`
这是云服务器上“ipables -L”的输出。
dynamichosts all -- anywhere anywhere
dynamichosts all -- anywhere anywhere
dynamichosts all -- anywhere anywhere
dynamichosts all -- anywhere anywhere
dynamichosts all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:www
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- APKGS-AP-dynamic-145.136.165.59.airtelbroadband.in anywhere tcp dpt:ssh
ACCEPT tcp -- APKGS-AP-dynamic-145.136.165.59.airtelbroadband.in anywhere tcp dpt:10000
ACCEPT tcp -- APKGS-AP-dynamic-145.136.165.59.airtelbroadband.in anywhere tcp dpt:mysql
DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain dynamichosts (937 references)
target prot opt source destination
ACCEPT all -- Telemedia-AP-dynamic-145.86.175.59.airtelbroadband.in anywhere
这里的 airtelbroadband 是我的(dyndns 域名)。我认为之前发布的脚本创建了新的链,并且从这个域开始一切都是允许的 - 是这样吗?可能允许的端口 ssh、webmin、mysql 和 www 是无用的条目。但我希望这个域只允许使用这些端口,当我从我的 dyndns 域系统检查时,我可以让 nmap 只列出云服务器上允许的端口。还有其他帮助吗……?
答案1
这个问题与https://serverfault.com/questions/188550/iptables-nmap-on-ubuntu
正如那里的人们所建议的那样,您的防火墙规则对云服务器本身(-A INPUT -i lo -j ACCEPT
)或您的“airtelbroadband”机器有特殊例外(您正在运行的脚本允许来自选定的 dyndns IP 的所有流量)。
所以,你需要nmap
逃离不同的 IP 地址(例如,只需使用云端的另一台机器)
如果您想限制来自“airtelbroadband”主机的访问(例如,出于测试目的),则可以将脚本中的最后一行替换为要应用的规则列表。例如,以下几行将仅允许来自您的主主机的 SSH、HTTP/HTTPS 和 MySQL 连接:
$IPTABLES -A $CHAIN -s $IP/32 -p tcp --dport 22 -j ACCEPT
$IPTABLES -A $CHAIN -s $IP/32 -p tcp --dport 80 -j ACCEPT
$IPTABLES -A $CHAIN -s $IP/32 -p tcp --dport 443 -j ACCEPT
$IPTABLES -A $CHAIN -s $IP/32 -p tcp --dport 3306 -j ACCEPT
警告:这个很,非常, 非常很容易通过破坏防火墙规则(尤其是使用自动脚本)将自己锁定在正在运行的主机之外。考虑从第三台主机进行测试。
答案2
根据你的输出iptables -L
,似乎没有任何内容读取你的/etc/iptables.rules
文件。请注意,ACCEPT all -- anywhere anywhere
匹配将允许任何内容进入。
您可能想要添加一些内容来/etc/rc.local
调用iptables-restore < /etc/iptables.rules
。不过,请小心不要将自己锁定在系统之外。:)