iptables 有的规则不生效 【以解决】

小丶力丫

回复 20# jerryjzm


    [root@mail log]# tcpdump -s 0 -i eth0 tcp port 5555
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
14:52:57.110361 IP 221.221.14.250.52448 > mail.personal-agent: Flags [S], seq 520751417, win 8192, options [mss 1452,nop,wscale 2,nop,nop,sackOK], length 0
14:52:57.110387 IP mail.personal-agent > 221.221.14.250.52448: Flags [S.], seq 181985768, ack 520751418, win 5840, options [mss 1460,nop,nop,sackOK,nop,wscale 6], length 0
14:52:57.112113 IP 221.221.14.250.52449 > mail.personal-agent: Flags [S], seq 851926951, win 8192, options [mss 1452,nop,wscale 2,nop,nop,sackOK], length 0
14:52:57.112132 IP mail.personal-agent > 221.221.14.250.52449: Flags [S.], seq 175699562, ack 851926952, win 5840, options [mss 1460,nop,nop,sackOK,nop,wscale 6], length 0
14:52:57.130322 IP 221.221.14.250.52448 > mail.personal-agent: Flags [.], ack 1, win 16698, length 0
14:52:57.135040 IP 221.221.14.250.52448 > mail.personal-agent: Flags [P.], seq 1:250, ack 1, win 16698, length 249
14:52:57.135063 IP mail.personal-agent > 221.221.14.250.52448: Flags [.], ack 250, win 108, length 0
14:52:57.147088 IP 221.221.14.250.52449 > mail.personal-agent: Flags [.], ack 1, win 16698, length 0
14:53:01.709779 IP mail.personal-agent > 221.221.14.250.52449: Flags [S.], seq 175699562, ack 851926952, win 5840, options [mss 1460,nop,nop,sackOK,nop,wscale 6], length 0
14:53:01.747511 IP 221.221.14.250.52449 > mail.personal-agent: Flags [.], ack 1, win 16698, options [nop,nop,sack 1 {0:1}], length 0
14:54:01.807696 IP mail.personal-agent > 221.221.14.250.52449: Flags [F.], seq 1, ack 1, win 92, length 0
14:54:01.827149 IP 221.221.14.250.52449 > mail.personal-agent: Flags [.], ack 2, win 16698, length 0
^C
12 packets captured
12 packets received by filter

jerryjzm

221.221.14.250.52448 > mail.personal-agent
[root@mytest ~]# more /etc/services |grep personal-agent
personal-agent  5555/tcp                        # Personal Agent
personal-agent  5555/udp                        # Personal Agent

从上面的信息，你的机器已经和服务器的5555端口，建立连接，这个数据包已经抵达了服务，具体你的服务（web）能否正常应答，那就是web服务自身的问题了。

jerryjzm

我测试了，如果被防火墙拦截了，其抓包的报文（服务器端抓包），就如下图

[root@remote ~]# tcpdump -s 0 -i eth1 tcp port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes



15:45:41.679518 IP 111.208.59.*.38038 > 111.208.59.*.http: S 537479061:537479061(0) win 5840 <mss 1460,sackOK,timestamp 3345040404 0,nop,wscale 7>
15:45:44.678222 IP 111.208.59.*.38038 > 111.208.59.*.http: S 537479061:537479061(0) win 5840 <mss 1460,sackOK,timestamp 3345043404 0,nop,wscale 7>
15:45:50.678785 IP 111.208.59.*.38038 > 111.208.59.*.http: S 537479061:537479061(0) win 5840 <mss 1460,sackOK,timestamp 3345049404 0,nop,wscale 7>
15:46:02.677909 IP 111.208.59.*.38038 > 111.208.59.*.http: S 537479061:537479061(0) win 5840 <mss 1460,sackOK,timestamp 3345061404 0,nop,wscale 7>
15:46:26.678152 IP 111.208.59.*.38038 > 111.208.59.*.http: S 537479061:537479061(0) win 5840 <mss 1460,sackOK,timestamp 3345085404 0,nop,wscale 7>

5 packets captured
5 packets received by filter
0 packets dropped by kernel

小丶力丫

回复 23# jerryjzm


    如果我的WEB不正常，，那么我每次访问6666端口也就可以，我将5555端口修改为7777还是一样，


  现在我怀疑，是不是cacti开启防火墙后出现了什么权限问题，，

chenyx

cacti只是web程序,没有特殊的权限要求
这样,你的6666不是没有问题吗,暂时停止6666,把cacti的那个端口改成6666,测试

linuxzk

iptables -A input -p tcp --dport 80 -j accept 你把80端口开启试试！

king_819

这跟iptables没有关系的，还是检查你apache的配置，查看apache的日志文件，看有无报错信息，顺便把你apache关于多端口的配置文件贴出来

小丶力丫

回复 25# chenyx


    修改成6666也不能访问，，

chenyx

6666也不行,那就不是iptables的问题了.
你查看下apache的日志吧

小丶力丫

回复 27# king_819


    我肯定开启了，5555端口， 我防火墙如果关闭就可以访问，，开启就不行了，，

Listen xxx.xxx.xxx.xxx:6666
Listen xxx.xxx.xxx.xxx:5555

<VirtualHost xxx.xxx.xxx.xxx:6666>
    ServerAdmin webmaster@dummy-host.example.com
    DocumentRoot /var/www/extsuite/extmail/html/
    ServerName mail.aaa.com
    ScriptAlias /extmail/cgi /var/www/extsuite/extmail/cgi
    Alias /extmail /var/www/extsuite/extmail/html
    ScriptAlias /extman/cgi /var/www/extsuite/extman/cgi
    Alias /extman  /var/www/extsuite/extman/html
    SuexecUserGroup postfix postfix
    ErrorLog logs/dummy-host.example.com-error_log
    CustomLog logs/dummy-host.example.com-access_log common
</VirtualHost>
<VirtualHost xxx.xxx.xxx.xxx:5555>
DocumentRoot /var/www/html/cacti/
ServerName mail.aaa.com
ErrorLog logs/dummy-host.example.com-error_log
CustomLog logs/dummy-host.example.com-access_log common
</VirtualHost>