为什么？我防火墙拒绝所有input还是无法阻止dhcpd服务

waily

为什么呢，我默认的input策略改为drop了


然后，ssh，ping啊什么都不行了，就是dhcpd怎么还能收到dhcp的报文并分配地址出去，我疯掉了！

yanu

Iptables对ISC DHCP Server无效。


https://lists.netfilter.org/pipe ... 002-May/023826.html

Derrik Pates touched on this earlier in the thread, but I'll try and
clarify a bit.

The DNCP server of the ISC (Internet Software Consortium,
http://www.isc.org) uses a different type of network access in Linux,
so to speak.  Normally, when programs need network access, they open
up an Internet socket of the correct protocol (TCP/UDP), which gets
any packets destined for it and can send packets after the kernel has
applied all IP Tables rules to them.  So if you have a policy of
DROP/REJECT or you have a rule that matches a packet to.from this
socket that DROP/REJECTs it, the socket will not receive or be able to
send that packet.

However, the ISC DHCP server uses an Internet Socket of protocol Raw
instead of TCP or UDP.  This facility, naturally, is only available to
root (uid 0, really), and receives packets before the IP Tables
processing.  It also receives all Internet packet headers as well, so
it gets to do additional processing.

But because Raw sockets get packets before the IP Tables processing,
the ISC DHCP server is able to obtain an IP address through DHCP.

More information (possibly not in a useful state) can be found in the
man pages for socket, ip, tcp, udp,
http://nodevice.com/sections/ManIndex/man1275.html, and, of course,
the source code.

taojie2000

回复 1# waily


      清空所有规则     

      input  output 策略 ---- drop

      然后开放固定服务的端口

taojie2000

回复 1# waily


    http://bbs.chinaunix.net/thread-2211285-1-1.html      搜下论坛有这么个老的讨论帖子  白金版主的     果然

waily

谢谢各位，看来iptables是真的无效了，那有什么办法可以临时封住dhcpd呢

taojie2000

回复 5# waily


    为什么封dhcp?  不想用dhcp  禁用这个服务

    或 dhcp里面ip指定

waily

回复 4# taojie2000


    终于看完了，多谢，好歹有个方向了

waily

回复 6# taojie2000


    是有个特殊需求，要求特定时段dhcpd服务在正常运行，但又不能让它收到dhcpd报文