- 论坛徽章:
- 0
|
问题:我把FTP服务器改为被动模式,默认端口是30000-50000,以下是我的iptables记录,一但启用,FTP就无法访问了,看看能否找出问题
sshdport=22
#get DNS
if [ -s /etc/resolv.conf ];then
nameserver1=`cat /etc/resolv.conf |grep nameserver |awk 'NR==1{print $2 }'`
nameserver2=`cat /etc/resolv.conf |grep nameserver |awk 'NR==2{print $2 }'`
fi
IPT="/sbin/iptables"
# initialise
$IPT -F
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
#$IPT -P OUTPUT DROP
$IPT -A INPUT -i lo -p all -j ACCEPT
$IPT -A OUTPUT -o lo -p all -j ACCEPT
$IPT -N BlockIP
$IPT -I INPUT -j BlockIP
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -F
#$IPT -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
#$IPT -A INPUT -f -j DROP
#$IPT -A INPUT -m state --state INVALID -j DROP
#$IPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
#$IPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
#$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
#$IPT -A INPUT -p udp -m udp --dport 631 -j ACCEPT
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT
$IPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
$IPT -A INPUT -j REJECT --reject-with icmp-host-prohibited
$IPT -A INPUT -p tcp -m state --state INVALID,NEW,RELATED,ESTABLISHED -m tcp --dport 8080 -j ACCEPT
#apache daili
$IPT -A OUTPUT -m state --state INVALID -j DROP
$IPT -A OUTPUT -p tcp -m state --state ESTABLISHED -m tcp --sport 110 -j ACCEPT
$IPT -A OUTPUT -p tcp -m state --state ESTABLISHED -m tcp --sport 8080 -j ACCEPT
$IPT -A OUTPUT -p tcp -m state --state ESTABLISHED -m tcp --sport 80 -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 8080 -s 192.168.252.132 -d 192.168.252.132 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 8080 -s 192.168.252.132 -d 192.168.252.132 -j ACCEPT
$IPT -A INPUT -p tcp -j LOG --log-prefix "IPTABLES TCP-IN: "
#FTP
$IPT -A INPUT -p tcp --sport 20 -j ACCEPT
$IPT -A INPUT -p tcp --sport 21 -j ACCEPT
$IPT -A INPUT -p tcp --dport 30000:50000 -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED -j ACCEPT
#ping
$IPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
$IPT -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
$IPT -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
$IPT -A OUTPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
#dns
# DNS
[ ! -z "$nameserver1" ] && $IPT -A OUTPUT -p udp -m udp -d $nameserver1 --dport 53 -j ACCEPT
[ ! -z "$nameserver2" ] && $IPT -A OUTPUT -p udp -m udp -d $nameserver2 --dport 53 -j ACCEPT
我实在找不出问题了。 |
|