只允许 SSH 传入和传出

Question

我试图只允许SSH防火墙上的传入和传出，但问题是FTP即使我DROP在脚本末尾也可以使用

# Incoming SSH
$iptables -A INPUT -p tcp --dport ssh -j ACCEPT

# Outgoing SSH
$iptables -A OUTPUT -p tcp --dport ssh -j ACCEPT

我的方式DROP是：

iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
iptables -A FORWARD -j DROP

的结果iptables -L：

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpc
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
DROP       all  --  anywhere             anywhere       

脚本：

#!/bin/bash
iptables=/usr/sbin/iptables

$iptables -F

$iptables -P INPUT
$iptables -P OUTPUT
$iptables -X

$iptables -F -t nat

$iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT -o lo -j ACCEPT

$iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
$iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

$iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
$iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
$iptables -A OUTPUT --p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
$iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

Answer 1

INPUTyour和chain的第一行OUTPUT接受所有内容。您可以使用这两个命令删除它们

iptables -D INPUT 1
iptables -D OUTPUT 1

但在运行它们之前，请确保您仍然具有访问权限（最好是在控制台上）。

---

现在您已经提供了脚本，可以建议替代方案

#!/bin/bash -e
PATH=/usr/sbin:$PATH

# Reset to a sane state, even if just temporarily
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT

# Erase all the rules
iptables -F
iptables -t nat -F

# Simple NAT rule for outgoing traffic
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow the return half of established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow incoming and outgoing ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT

# You probably want other stuff permitted here such as DNS on 53/udp and 53/tcp
# and maybe NTP on 123/udp
# iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
# iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
# iptables -A OUTPUT -p udp --dport 123 -j ACCEPT

# Default policy is to discard all traffic
iptables -P INPUT DROP
iptables -P OUTPUT DROP