☰

TCP：一台PC可以连接到另一台PC的监听端口，但反之则不行

tag-icon • tag-icon networking tcp socket netcat
TCP：一台PC可以连接到另一台PC的监听端口，但反之则不行

我有一个本地网络（无论是 VPN 还是真正的本地网络并不重要 - 我都尝试过）。

一台运行 Linux Mint 的计算机打开一个套接字

mint$ nc -l 4242

运行 OpenSUSE 的第二个可以连接并向套接字发送消息：

suse$ nc 10.8.0.10 4242

但是，如果我尝试在 Suse 上打开套接字并从 Mint 进行连接 - 连接将无法建立。我ufw在 Suse 上根本没有安装防火墙。

我尝试将 TCP 数据包从 Mint 发送到 Windows PC，效果很好，所以我猜问题出在 Suse 机器上。

我也尝试过选择更高的端口号（例如 55555）以防万一，但没有成功。

iptables -L -v关于苏塞：

Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination         
 272 23240 ACCEPT     all  --  lo     any     anywhere             anywhere            
  28  5183 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate ESTABLISHED
   0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED
  15  4984 input_ext  all  --  any    any     anywhere             anywhere            
   0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-IN-ILL-TARGET "
   0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination         
   0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-FWD-ILL-ROUTING "

Chain OUTPUT (policy ACCEPT 47 packets, 7142 bytes)
pkts bytes target     prot opt in     out     source               destination         
 272 23240 ACCEPT     all  --  any    lo      anywhere             anywhere            

Chain forward_ext (0 references)
pkts bytes target     prot opt in     out     source               destination         

Chain input_ext (1 references)
pkts bytes target     prot opt in     out     source               destination         
   2  1956 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = broadcast
   0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp source-quench
   0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request
  13  3028 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = multicast
   0     0 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = broadcast
   0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
   0     0 LOG        icmp --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
   0     0 LOG        udp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
   0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain reject_func (0 references)
pkts bytes target     prot opt in     out     source               destination         
   0     0 REJECT     tcp  --  any    any     anywhere             anywhere             reject-with tcp-reset
   0     0 REJECT     udp  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable
   0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-proto-unreachable

什么可能导致此问题？

答案1

使用这个命令：

sudo iptables -I INPUT -p tcp --dport 4242 -j ACCEPT

suse 链的最后一行INPUT是：

   0     0 DROP       all  --  any    any     anywhere             anywhere

这意味着DROP所有INPUT数据包，使用此命令

sudo iptables -I INPUT -p tcp --dport 4242 -j ACCEPT

我们I为接受输入数据包顶部和运行之前DROP规则插入新规则

并且此规则不适用于新连接：

ACCEPT     all  --  any    any     anywhere             anywhere             ctstate ESTABLISHED

因为该统计数据的ESTABLISHED意思是：

相关 - 连接是新的，但与已允许的另一个连接相关。 ESTABLISHED - 连接已建立。

相关内容