ufw 不保护端口

ufw 不保护端口

我已按以下方式配置ufw。令人费解的是,我指示阻止出站和入站的端口却连接上了。为什么?

我当前的 ufw 配置与通过ss -t命令打开端口:

   To                         Action      From
     --                         ------      ----
[ 1] 25,53,80,110,443/tcp       ALLOW OUT   Anywhere (out)
[ 2] 53,67,68/udp               ALLOW OUT   Anywhere (out)
[ 3] 51413/tcp                  ALLOW OUT   Anywhere (out)
[ 4] 51413/udp                  ALLOW OUT   Anywhere (out)
[ 5] 6969/tcp                   ALLOW OUT   Anywhere (out)
[ 6] 1194/udp                   ALLOW OUT   Anywhere (out)
[ 7] 1:24/tcp                   DENY IN     Anywhere
[ 8] 26:52/tcp                  DENY IN     Anywhere
[ 9] 54:79/tcp                  DENY IN     Anywhere
[10] 81:109/tcp                 DENY IN     Anywhere
[11] 111:442/tcp                DENY IN     Anywhere
[12] 444:6968/tcp               DENY IN     Anywhere
[13] 6970:51412/tcp             DENY IN     Anywhere
[14] 51414:65535/tcp            DENY IN     Anywhere
[15] 1:52/udp                   DENY IN     Anywhere
[16] 53:66/udp                  DENY IN     Anywhere
[17] 69:1193/udp                DENY IN     Anywhere
[18] 1195:51412/udp             DENY IN     Anywhere
[19] 51414:65535/udp            DENY IN     Anywhere
[20] 22                         DENY IN     Anywhere
[21] 48567/tcp                  DENY IN     Anywhere
[22] 1194                       ALLOW IN    46.246.37.162
[23] 1:24/tcp                   DENY OUT    Anywhere (out)
[24] 26:52/tcp                  DENY OUT    Anywhere (out)
[25] 54:79/tcp                  DENY OUT    Anywhere (out)
[26] 81:109/tcp                 DENY OUT    Anywhere (out)
[27] 111:142/tcp                DENY OUT    Anywhere (out)
[28] 444:6968/tcp               DENY OUT    Anywhere (out)
[29] 6970:51412/tcp             DENY OUT    Anywhere (out)
[30] 51414:65535/tcp            DENY OUT    Anywhere (out)
[31] 1:52/udp                   DENY OUT    Anywhere (out)
[32] 53:66/udp                  DENY OUT    Anywhere (out)
[33] 68:1193/udp                DENY OUT    Anywhere (out)
[34] 1195:51412/udp             DENY OUT    Anywhere (out)
[35] 51414:65535/udp            DENY OUT    Anywhere (out)
[36] 22/udp                     DENY OUT    Anywhere (out)
[37] 25/tcp                     DENY IN     Anywhere
[38] 53,80,110,443/tcp          DENY IN     Anywhere
[39] 53,67,68/udp               DENY IN     Anywhere
[40] 51413/tcp                  DENY IN     Anywhere
[41] 51413/udp                  DENY IN     Anywhere
[42] 6969/tcp                   DENY IN     Anywhere
[43] 1194/udp                   DENY IN     Anywhere
[44] 32968/tcp                  DENY IN     Anywhere
[45] 32968/tcp                  DENY OUT    Anywhere (out)
[46] 41748/tcp                  DENY IN     Anywhere
[47] 41748/tcp                  DENY OUT    Anywhere (out)
[48] 25,53,80,110,443/tcp (v6)  ALLOW OUT   Anywhere (v6) (out)
[49] 53,67,68/udp (v6)          ALLOW OUT   Anywhere (v6) (out)
[50] 51413/tcp (v6)             ALLOW OUT   Anywhere (v6) (out)
[51] 51413/udp (v6)             ALLOW OUT   Anywhere (v6) (out)
[52] 6969/tcp (v6)              ALLOW OUT   Anywhere (v6) (out)
[53] 1194/udp (v6)              ALLOW OUT   Anywhere (v6) (out)
[54] 1:24/tcp (v6)              DENY IN     Anywhere (v6)
[55] 26:52/tcp (v6)             DENY IN     Anywhere (v6)
[56] 54:79/tcp (v6)             DENY IN     Anywhere (v6)
[57] 81:109/tcp (v6)            DENY IN     Anywhere (v6)
[58] 111:442/tcp (v6)           DENY IN     Anywhere (v6)
[59] 444:6968/tcp (v6)          DENY IN     Anywhere (v6)
[60] 6970:51412/tcp (v6)        DENY IN     Anywhere (v6)
[61] 51414:65535/tcp (v6)       DENY IN     Anywhere (v6)
[62] 1:52/udp (v6)              DENY IN     Anywhere (v6)
[63] 53:66/udp (v6)             DENY IN     Anywhere (v6)
[64] 69:1193/udp (v6)           DENY IN     Anywhere (v6)
[65] 1195:51412/udp (v6)        DENY IN     Anywhere (v6)
[66] 51414:65535/udp (v6)       DENY IN     Anywhere (v6)
[67] 22 (v6)                    DENY IN     Anywhere (v6)
[68] 48567/tcp (v6)             DENY IN     Anywhere (v6)
[69] 1:24/tcp (v6)              DENY OUT    Anywhere (v6) (out)
[70] 26:52/tcp (v6)             DENY OUT    Anywhere (v6) (out)
[71] 54:79/tcp (v6)             DENY OUT    Anywhere (v6) (out)
[72] 81:109/tcp (v6)            DENY OUT    Anywhere (v6) (out)
[73] 111:142/tcp (v6)           DENY OUT    Anywhere (v6) (out)
[74] 444:6968/tcp (v6)          DENY OUT    Anywhere (v6) (out)
[75] 6970:51412/tcp (v6)        DENY OUT    Anywhere (v6) (out)
[76] 51414:65535/tcp (v6)       DENY OUT    Anywhere (v6) (out)
[77] 1:52/udp (v6)              DENY OUT    Anywhere (v6) (out)
[78] 53:66/udp (v6)             DENY OUT    Anywhere (v6) (out)
[79] 68:1193/udp (v6)           DENY OUT    Anywhere (v6) (out)
[80] 1195:51412/udp (v6)        DENY OUT    Anywhere (v6) (out)
[81] 51414:65535/udp (v6)       DENY OUT    Anywhere (v6) (out)
[82] 22/udp (v6)                DENY OUT    Anywhere (v6) (out)
[83] 25/tcp (v6)                DENY IN     Anywhere (v6)
[84] 53,80,110,443/tcp (v6)     DENY IN     Anywhere (v6)
[85] 53,67,68/udp (v6)          DENY IN     Anywhere (v6)
[86] 51413/tcp (v6)             DENY IN     Anywhere (v6)
[87] 51413/udp (v6)             DENY IN     Anywhere (v6)
[88] 6969/tcp (v6)              DENY IN     Anywhere (v6)
[89] 1194/udp (v6)              DENY IN     Anywhere (v6)
[90] 32968/tcp (v6)             DENY IN     Anywhere (v6)
[91] 32968/tcp (v6)             DENY OUT    Anywhere (v6) (out)
[92] 41748/tcp (v6)             DENY IN     Anywhere (v6)
[93] 41748/tcp (v6)             DENY OUT    Anywhere (v6) (out)

ss -t命令输出中,我用 替换了我的 IP 地址00.000.00.000。重要的是,明显关闭的端口显然是打开并正在连接:为什么?

State      Recv-Q Send-Q      Local Address:Port          Peer Address:Port   
ESTAB      0      0           00.000.00.000:37511       64.233.161.189:https   
ESTAB      0      0           00.000.00.000:35895         83.140.66.19:https   
ESTAB      0      0           00.000.00.000:57047       198.252.206.25:https   
ESTAB      0      0               00.000.00.000:38515            127.0.0.1:openvpn 
ESTAB      0      0           00.000.00.000:50483       104.16.110.188:https   
ESTAB      0      0           000.000.00.000:37515        104.16.90.254:https   
ESTAB      0      0           00.000.00.000:57391       104.16.104.204:https   
ESTAB      0      0          00.000.00.000:41273           31.13.71.7:https   
ESTAB      0      0               00.000.00.000:openvpn          127.0.0.1:38515   
ESTAB      0      0           00.000.00.000:40040        173.252.88.66:https   
ESTAB      0      0          00.000.00.000:57155       198.252.206.25:https   
ESTAB      0      0          00.000.00.000:35896         83.140.66.19:https   
ESTAB      0      0          00.000.00.000:40034        173.252.88.66:https   
ESTAB      0      0               00.000.00.000:57680            127.0.0.1:34330   
ESTAB      0      0               00.000.00.000:34330            127.0.0.1:57680   
ESTAB      0      0           00.000.00.000:55154       104.16.113.188:http    
ESTAB      0      0           46.246.62.216:57173       198.252.206.25:https   
ESTAB      0      0           00.000.00.000:41272           31.13.71.7:https   
CLOSE-WAIT 1      0                     ::1:57751                  ::1:ipp     
CLOSE-WAIT 1      0                     ::1:57752                  ::1:ipp     
CLOSE-WAIT 1      0                     ::1:57755                  ::1:ipp     
tarique@tarique-All-Series:~$ 

答案1

使用命令检查默认 ufw 设置

sudo ufw status verbose

保持默认设置拒绝传入和传出的运行命令:

sudo ufw default deny incoming
sudo ufw default deny outgoing

或者

打开文件/etc/default/ufw

vi  /etc/default/ufw

并更改默认设置

DEFAULT_INPUT_POLICY="DROP"
DEFAULT_OUTPUT_POLICY="DROP"

相关内容