iptables help!!!

cida

iptables -A INPUT -i eth0 -m mac --mac-source 00:04:23:17:A5:8D -p tcp --dport 6667 -j ACCEPT

命令执行完毕后没有报错

iptables -L INPUT


ACCEPT     all  --  anywhere             anywhere           MAC 00:04:23:17:A5:8D

看上去也是正常。

但是port 6667 还是不能访问，请高人指点

NeteLife

还有一个udp吧

cida

我去试试看。

cida

ALSO CANNOT

q1208c

iptables-save 帖上来看看。

cida

# Generated by iptables-save v1.2.6a on Wed Feb 18 08:09:46 2004
*nat
REROUTING ACCEPT [3467]
OSTROUTING ACCEPT [84]
:OUTPUT ACCEPT [120]
-A PREROUTING -i eth+ -p icmp -j ACCEPT
COMMIT
# Completed on Wed Feb 18 08:09:46 2004
# Generated by iptables-save v1.2.6a on Wed Feb 18 08:09:46 2004
*filter
:INPUT DROP [202]
:FORWARD DROP [0]
:OUTPUT DROP [0]
:syn-flood - [0]
-A INPUT -i eth0 -p tcp -m tcp --dport 6667 -j LOG --log-prefix "IRC:"
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j syn-flood
-A INPUT -i eth+ -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -i eth+ -f -j LOG --log-prefix "IPT FRAGMENTS: "
-A INPUT -i eth+ -f -j DROP
-A INPUT -i eth+ -p udp -m udp --sport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p udp -m udp --dport 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 67 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 68 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 67 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 68 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 443 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 21 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 21 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 23 -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 23 -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 25 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 25 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 110 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 110 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s 10.10.10.0/255.255.255.0 -i eth+ -p tcp -m tcp --dport 6667 -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 113 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p udp -m udp --dport 113 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 113 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p udp -m udp --sport 113 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p icmp -j ACCEPT
-A INPUT -i eth+ -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -m mac --mac 00:04:23:17:A5:8D -j ACCEPT
-A FORWARD -i eth0 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 21 -j LOG --log-prefix "IPT FTP FWD pkt: " --log-level 6
-A FORWARD -i eth+ -p tcp -m tcp --dport 21 -j ACCEPT
-A FORWARD -i eth+ -p tcp -m tcp --dport 20 -j ACCEPT
-A FORWARD -i eth+ -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT
-A FORWARD -i eth+ -p tcp -m tcp --dport 23 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -i eth+ -p tcp -m tcp --dport 6667 -j ACCEPT
-A FORWARD -i eth0 -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT FWD packet died: " --log-level 6
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth+ -p udp -m udp --dport 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p udp -m udp --sport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --sport 67 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --dport 68 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 67 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 68 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 21 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 21 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 23 -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 23 -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 25 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 25 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 110 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 110 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 6667 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 113 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p udp -m udp --sport 113 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 113 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p udp -m udp --dport 113 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p udp -m udp --sport 32769:65535 --dport 33434:33523 -m state --state NEW -j ACCEPT
-A OUTPUT -o eth+ -p icmp -j ACCEPT
-A syn-flood -m limit --limit 1/sec --limit-burst 4 -j RETURN
-A syn-flood -j DROP
COMMIT
# Completed on Wed Feb 18 08:09:46 2004

阿辉

-m mac --mac-source 00:04:23:17:A5:8D
是只要这一台可以访问吗？

cida

是的

阿辉

你这个PORT是用了什么服务呀？你怎么测试不行的呢？

q1208c

我没细看，因为太多了。

不过，你的前面是 INPUT DROP;OUTPUT DROP;FORWARD DROP.你DROP了那么多，你只给了那个MAC INPUT，没给OUTPUT吧？试试加上OUTPUT。