iptables 配置问题。军哥帮忙！

yurec 发表于 2017-5-10 16:48:56

80端等端口不能访问

# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source             destination
ACCEPT all--0.0.0.0/0          0.0.0.0/0          ctstate RELATED,ESTABLISHED
ACCEPT all--0.0.0.0/0          0.0.0.0/0
INPUT_directall--0.0.0.0/0          0.0.0.0/0
INPUT_ZONES_SOURCEall--0.0.0.0/0          0.0.0.0/0
INPUT_ZONESall--0.0.0.0/0          0.0.0.0/0
DROP    all--0.0.0.0/0          0.0.0.0/0          ctstate INVALID
REJECT all--0.0.0.0/0          0.0.0.0/0          reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target prot opt source             destination
ACCEPT all--0.0.0.0/0          0.0.0.0/0          ctstate RELATED,ESTABLISHED
ACCEPT all--0.0.0.0/0          0.0.0.0/0
FORWARD_directall--0.0.0.0/0          0.0.0.0/0
FORWARD_IN_ZONES_SOURCEall--0.0.0.0/0          0.0.0.0/0
FORWARD_IN_ZONESall--0.0.0.0/0          0.0.0.0/0
FORWARD_OUT_ZONES_SOURCEall--0.0.0.0/0          0.0.0.0/0
FORWARD_OUT_ZONESall--0.0.0.0/0          0.0.0.0/0
DROP    all--0.0.0.0/0          0.0.0.0/0          ctstate INVALID
REJECT all--0.0.0.0/0          0.0.0.0/0          reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source             destination
OUTPUT_directall--0.0.0.0/0          0.0.0.0/0

Chain FORWARD_IN_ZONES (1 references)
target prot opt source             destination
FWDI_publicall--0.0.0.0/0          0.0.0.0/0
FWDI_publicall--0.0.0.0/0          0.0.0.0/0

Chain FORWARD_IN_ZONES_SOURCE (1 references)
target prot opt source             destination

Chain FORWARD_OUT_ZONES (1 references)
target prot opt source             destination
FWDO_publicall--0.0.0.0/0          0.0.0.0/0
FWDO_publicall--0.0.0.0/0          0.0.0.0/0

Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target prot opt source             destination

Chain FORWARD_direct (1 references)
target prot opt source             destination

Chain FWDI_public (2 references)
target prot opt source             destination
FWDI_public_logall--0.0.0.0/0          0.0.0.0/0
FWDI_public_denyall--0.0.0.0/0          0.0.0.0/0
FWDI_public_allowall--0.0.0.0/0          0.0.0.0/0
ACCEPT icmp --0.0.0.0/0          0.0.0.0/0

Chain FWDI_public_allow (1 references)
target prot opt source             destination

Chain FWDI_public_deny (1 references)
target prot opt source             destination

Chain FWDI_public_log (1 references)
target prot opt source             destination

Chain FWDO_public (2 references)
target prot opt source             destination
FWDO_public_logall--0.0.0.0/0          0.0.0.0/0
FWDO_public_denyall--0.0.0.0/0          0.0.0.0/0
FWDO_public_allowall--0.0.0.0/0          0.0.0.0/0

Chain FWDO_public_allow (1 references)
target prot opt source             destination
ACCEPT all--0.0.0.0/0          0.0.0.0/0

Chain FWDO_public_deny (1 references)
target prot opt source             destination

Chain FWDO_public_log (1 references)
target prot opt source             destination

Chain INPUT_ZONES (1 references)
target prot opt source             destination
IN_publicall--0.0.0.0/0          0.0.0.0/0
IN_publicall--0.0.0.0/0          0.0.0.0/0

Chain INPUT_ZONES_SOURCE (1 references)
target prot opt source             destination

Chain INPUT_direct (1 references)
target prot opt source             destination

Chain IN_public (2 references)
target prot opt source             destination
IN_public_logall--0.0.0.0/0          0.0.0.0/0
IN_public_denyall--0.0.0.0/0          0.0.0.0/0
IN_public_allowall--0.0.0.0/0          0.0.0.0/0
ACCEPT icmp --0.0.0.0/0          0.0.0.0/0

Chain IN_public_allow (1 references)
target prot opt source             destination
ACCEPT udp--0.0.0.0/0          0.0.0.0/0          udp dpt:4500 ctstate NEW
ACCEPT udp--0.0.0.0/0          0.0.0.0/0          udp dpt:1701 ctstate NEW
ACCEPT tcp--0.0.0.0/0          0.0.0.0/0          tcp dpt:22 ctstate NEW
ACCEPT udp--0.0.0.0/0          0.0.0.0/0          udp dpt:500 ctstate NEW
ACCEPT ah --0.0.0.0/0          0.0.0.0/0          ctstate NEW
ACCEPT esp--0.0.0.0/0          0.0.0.0/0          ctstate NEW

Chain IN_public_deny (1 references)
target prot opt source             destination

Chain IN_public_log (1 references)
target prot opt source             destination

Chain OUTPUT_direct (1 references)
target prot opt source             destination
# 我在服务器上安装了wget --no-check-certificate https://raw.githubusercontent.com/teddysun/across/master/l2tp.sh导致无法访问80 等端口。按照https://www.vpser.net/security/linux-iptables.html#允许本地回环接口(即运行本机访问本机)
iptables -A INPUT -i lo -j ACCEPT
# 允许已建立的或相关连的通行
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#允许所有本机向外的访问
iptables -A OUTPUT -j ACCEPT
# 允许访问22端口
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#允许访问80端口
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
#允许访问443端口
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
#允许FTP服务的21和20端口
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 20 -j ACCEPT
#如果有其他端口的话，规则也类似，稍微修改上述语句就行
#允许ping
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
#禁止其他未允许的规则访问
iptables -A INPUT -j REJECT#（注意：如果22端口未加入允许规则，SSH链接会直接断开。）
iptables -A FORWARD -j REJECT添加了端口还是无法访问。。
但是我将规则全部清空以后可以正常访问。iptables -F
iptables -X
iptables -Z求助军哥帮助。。。看看iptables 配置是哪里出错了。

[ 本帖最后由 yurec 于 2017-5-10 16:53 编辑 ]

licess 发表于 2017-5-10 20:30:17

80端口允许规则-A 用 -I 添加后看一下

页: [1]

VPS侦探论坛's Archiver

iptables 配置问题。军哥帮忙！