![TCP:一台PC可以连接到另一台PC的监听端口,但反之则不行](https://linux22.com/image/98900/TCP%EF%BC%9A%E4%B8%80%E5%8F%B0PC%E5%8F%AF%E4%BB%A5%E8%BF%9E%E6%8E%A5%E5%88%B0%E5%8F%A6%E4%B8%80%E5%8F%B0PC%E7%9A%84%E7%9B%91%E5%90%AC%E7%AB%AF%E5%8F%A3%EF%BC%8C%E4%BD%86%E5%8F%8D%E4%B9%8B%E5%88%99%E4%B8%8D%E8%A1%8C.png)
我有一个本地网络(无论是 VPN 还是真正的本地网络并不重要 - 我都尝试过)。
一台运行 Linux Mint 的计算机打开一个套接字
mint$ nc -l 4242
运行 OpenSUSE 的第二个可以连接并向套接字发送消息:
suse$ nc 10.8.0.10 4242
但是,如果我尝试在 Suse 上打开套接字并从 Mint 进行连接 - 连接将无法建立。我ufw
在 Suse 上根本没有安装防火墙。
我尝试将 TCP 数据包从 Mint 发送到 Windows PC,效果很好,所以我猜问题出在 Suse 机器上。
我也尝试过选择更高的端口号(例如 55555)以防万一,但没有成功。
iptables -L -v
关于苏塞:
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
272 23240 ACCEPT all -- lo any anywhere anywhere
28 5183 ACCEPT all -- any any anywhere anywhere ctstate ESTABLISHED
0 0 ACCEPT icmp -- any any anywhere anywhere ctstate RELATED
15 4984 input_ext all -- any any anywhere anywhere
0 0 LOG all -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-IN-ILL-TARGET "
0 0 DROP all -- any any anywhere anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-FWD-ILL-ROUTING "
Chain OUTPUT (policy ACCEPT 47 packets, 7142 bytes)
pkts bytes target prot opt in out source destination
272 23240 ACCEPT all -- any lo anywhere anywhere
Chain forward_ext (0 references)
pkts bytes target prot opt in out source destination
Chain input_ext (1 references)
pkts bytes target prot opt in out source destination
2 1956 DROP all -- any any anywhere anywhere PKTTYPE = broadcast
0 0 ACCEPT icmp -- any any anywhere anywhere icmp source-quench
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-request
13 3028 DROP all -- any any anywhere anywhere PKTTYPE = multicast
0 0 DROP all -- any any anywhere anywhere PKTTYPE = broadcast
0 0 LOG tcp -- any any anywhere anywhere limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
0 0 LOG icmp -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
0 0 LOG udp -- any any anywhere anywhere limit: avg 3/min burst 5 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
0 0 DROP all -- any any anywhere anywhere
Chain reject_func (0 references)
pkts bytes target prot opt in out source destination
0 0 REJECT tcp -- any any anywhere anywhere reject-with tcp-reset
0 0 REJECT udp -- any any anywhere anywhere reject-with icmp-port-unreachable
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-proto-unreachable
什么可能导致此问题?
答案1
使用这个命令:
sudo iptables -I INPUT -p tcp --dport 4242 -j ACCEPT
suse 链的最后一行INPUT
是:
0 0 DROP all -- any any anywhere anywhere
这意味着DROP
所有INPUT
数据包,使用此命令
sudo iptables -I INPUT -p tcp --dport 4242 -j ACCEPT
我们I
为接受输入数据包顶部和运行之前DROP
规则插入新规则
并且此规则不适用于新连接:
ACCEPT all -- any any anywhere anywhere ctstate ESTABLISHED
因为该统计数据的ESTABLISHED
意思是:
相关 - 连接是新的,但与已允许的另一个连接相关。 ESTABLISHED - 连接已建立。