![只允许 SSH 传入和传出](https://linux22.com/image/98915/%E5%8F%AA%E5%85%81%E8%AE%B8%20SSH%20%E4%BC%A0%E5%85%A5%E5%92%8C%E4%BC%A0%E5%87%BA.png)
我试图只允许SSH
防火墙上的传入和传出,但问题是FTP
即使我DROP
在脚本末尾也可以使用
# Incoming SSH
$iptables -A INPUT -p tcp --dport ssh -j ACCEPT
# Outgoing SSH
$iptables -A OUTPUT -p tcp --dport ssh -j ACCEPT
我的方式DROP
是:
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
iptables -A FORWARD -j DROP
的结果iptables -L
:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT udp -- anywhere anywhere udp dpt:bootpc
DROP all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
DROP all -- anywhere anywhere
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT udp -- anywhere anywhere udp dpt:domain ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:domain ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
DROP all -- anywhere anywhere
脚本:
#!/bin/bash
iptables=/usr/sbin/iptables
$iptables -F
$iptables -P INPUT
$iptables -P OUTPUT
$iptables -X
$iptables -F -t nat
$iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT -o lo -j ACCEPT
$iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
$iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
$iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
$iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
$iptables -A OUTPUT --p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
$iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
答案1
INPUT
your和chain的第一行OUTPUT
接受所有内容。您可以使用这两个命令删除它们
iptables -D INPUT 1
iptables -D OUTPUT 1
但在运行它们之前,请确保您仍然具有访问权限(最好是在控制台上)。
现在您已经提供了脚本,可以建议替代方案
#!/bin/bash -e
PATH=/usr/sbin:$PATH
# Reset to a sane state, even if just temporarily
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
# Erase all the rules
iptables -F
iptables -t nat -F
# Simple NAT rule for outgoing traffic
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow the return half of established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow incoming and outgoing ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
# You probably want other stuff permitted here such as DNS on 53/udp and 53/tcp
# and maybe NTP on 123/udp
# iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
# iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
# iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
# Default policy is to discard all traffic
iptables -P INPUT DROP
iptables -P OUTPUT DROP