在 CentOS 6 上配置 Iptables 将我锁定

Question

我正在以 root 身份运行以下 bash 脚本来配置 iptables（我通过 SSH 登录）：

#!/bin/bash

# Delete all existing rules
iptables --flush

# Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Allow port 80 (http)
iptables -A INPUT -p tcp --sport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

# Allow port 443 (https)
iptables -A INPUT -p tcp --sport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

# Allow port 8443
iptables -A INPUT -p tcp --sport 8443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 8443 -j ACCEPT

# Allow port 22 (ssh)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p udp --sport 22 -j ACCEPT

# Allow port 25 (smtp)
iptables -A INPUT -p tcp --sport 25 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

# Allow port 110 (pop)
iptables -A INPUT -p tcp --sport 110 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 110 -j ACCEPT

# Allow port 995
iptables -A INPUT -p tcp --sport 995 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 995 -j ACCEPT

# Allow port 143 (imap)
iptables -A INPUT -p tcp --sport 143 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 143 -j ACCEPT

# Allow port 993
iptables -A INPUT -p tcp --sport 993 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 993 -j ACCEPT

# Allow port 465 (smtp)
iptables -A INPUT -p tcp --sport 465 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT

# Allow port 8447
iptables -A INPUT -p tcp --sport 8447 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 8447 -j ACCEPT

# Ping rate limit (from outside)
iptables -A INPUT -p icmp -m icmp --icmp-type address-mask-request -j REJECT
iptables -A INPUT -p icmp -m icmp --icmp-type timestamp-request -j REJECT
iptables -A INPUT -p icmp -m icmp -m limit --limit 1/second -j ACCEPT

# Prevent DoS attack
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

# Loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# User feedback
service iptables save
echo "Rules set, restarting iptables..."
service iptables restart
echo "Finished configuring iptables"

该脚本会立即执行并将我踢出 SSH - 所有端口也都已关闭（80、443、21 等）。如果我将默认链策略更改为：

# Set default chain policies
iptables -P INPUT REJECT
iptables -P FORWARD REJECT
iptables -P OUTPUT REJECT

它工作正常，我可以通过端口 80 和 SSH (22) 进入。但是，运行iptables --list显示以下内容：

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:http
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:pcsync-https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:pop3
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:pop3s
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:imap
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:imaps
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:urd
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:8447
REJECT     icmp --  anywhere             anywhere            icmp address-mask-request reject-with icmp-port-unreachable
REJECT     icmp --  anywhere             anywhere            icmp timestamp-request reject-with icmp-port-unreachable
ACCEPT     icmp --  anywhere             anywhere            icmp any limit: avg 1/sec burst 5
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http limit: avg 25/min burst 100
ACCEPT     all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pcsync-https
ACCEPT     udp  --  anywhere             anywhere            udp spt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3s
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imaps
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:urd
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:8447
ACCEPT     all  --  anywhere             anywhere

...所有默认策略都设置为 ACCEPT。谁能告诉我为什么会这样？

Answer 1

你的规则有很多很多错误。从错误的运动/dport 到指定 udp 而不是 TCP。您也忘记了 DNS。服务 iptables restart 也是不必要的。

忘记所有的输出规则，只要有一个规则，允许在 INPUT 和 OUTPUT 顶部的已建立连接上的所有传出流量。

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 

然后只向 INPUT 添加规则，并在其中使用 dport，而不是运动。

并为 dns 添加一条输出规则，使邮件和 ssh 再次工作。再次使用 dport。

ping 速率限制是无用的。它们根本无法阻止 DOS/DDOS：数据包仍会到达您的服务器。所以不要管这些。恕我直言，http 速率限制应该在应用程序中处理，而不是在防火墙中处理，但这更多是意见而不是事实。

Answer 2

除其他外，这条线

iptables -A OUTPUT -p udp --sport 22 -j ACCEPT

是你的问题。您只允许端口 22 上的 UDP 数据包。它应该是

iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT