IPtables 菜鸟问题求答 （白金大师请进~）

welldrong

/sbin/iptables -A FORWARD -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -i eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT

以上两句有何用途？

虽然我自己也搞了个IPTABLES的防火墙，但对IPTABLES的精髓还不了解。我自己做的那个防火墙有个比较奇怪的现象，就是向外网转发时不时中断……大概6~8个包又自动恢复正常了。情况就象下面这样：
C:\>ping www.21cn.com -t

Pinging www.cdn.21cn.com [61.140.60.90] with 32 bytes o

Reply from 61.140.60.90: bytes=32 time=11ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=18ms TTL=241
Reply from 61.140.60.90: bytes=32 time=17ms TTL=241
Reply from 61.140.60.90: bytes=32 time=17ms TTL=241
Request timed out.
Reply from 61.140.60.90: bytes=32 time=9ms TTL=241
Reply from 61.140.60.90: bytes=32 time=30ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=23ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=11ms TTL=241
Reply from 61.140.60.90: bytes=32 time=9ms TTL=241
Reply from 61.140.60.90: bytes=32 time=9ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=9ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=18ms TTL=241
Reply from 61.140.60.90: bytes=32 time=11ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=18ms TTL=241
Reply from 61.140.60.90: bytes=32 time=19ms TTL=241
Request timed out.
Reply from 61.140.60.90: bytes=32 time=24ms TTL=241
Reply from 61.140.60.90: bytes=32 time=21ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=11ms TTL=241
Reply from 61.140.60.90: bytes=32 time=11ms TTL=241
Reply from 61.140.60.90: bytes=32 time=11ms TTL=241
Reply from 61.140.60.90: bytes=32 time=16ms TTL=241
Reply from 61.140.60.90: bytes=32 time=19ms TTL=241
Reply from 61.140.60.90: bytes=32 time=17ms TTL=241
Reply from 61.140.60.90: bytes=32 time=11ms TTL=241
Reply from 61.140.60.90: bytes=32 time=9ms TTL=241
Reply from 61.140.60.90: bytes=32 time=20ms TTL=241
Reply from 61.140.60.90: bytes=32 time=19ms TTL=241
Reply from 61.140.60.90: bytes=32 time=20ms TTL=241
Reply from 61.140.60.90: bytes=32 time=18ms TTL=241
Request timed out.
Request timed out.
Reply from 61.140.60.90: bytes=32 time=11ms TTL=241
Reply from 61.140.60.90: bytes=32 time=13ms TTL=241
Reply from 61.140.60.90: bytes=32 time=9ms TTL=241
Reply from 61.140.60.90: bytes=32 time=23ms TTL=241
Reply from 61.140.60.90: bytes=32 time=26ms TTL=241
Reply from 61.140.60.90: bytes=32 time=13ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=15ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Reply from 61.140.60.90: bytes=32 time=10ms TTL=241
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Reply from 61.140.60.90: bytes=32 time=23ms TTL=241
Reply from 61.140.60.90: bytes=32 time=28ms TTL=241
Request timed out.
Request timed out.


请问是配置有问题吗？以下是配置（基于安全考虑，把地址用x.x.x.x代替）：

#!/bin/sh



echo "1" >/proc/sys/net/ipv4/ip_forward

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -s x.x.x.x -j SNAT --to-source x.x.x.x
iptables -t nat -A POSTROUTING -o eth1 -m iprange --src-range x.x.x.x-x.x.x.x-j SNAT --to-source x.x.x.x
iptables -A FORWARD -m iprange --src-range x.x.x.x-x.x.x.x -m ipp2p --edk --kazaa --bit -j DROP
iptables -A FORWARD -p tcp -m iprange --src-range x.x.x.x-x.x.x.x -m ipp2p --ares -j DROP
iptables -A FORWARD -p udp -m iprange --src-range x.x.x.x-x.x.x.x -m ipp2p --kazaa -j DROP

[ 本帖最后由 welldrong 于 2006-6-13 16:13 编辑 ]

schevalier

什么意思。

platinum

原因很多
网线问题、网络问题、Linux 问题、对方网络问题、对方服务器问题等
其中，你的策略也有问题，但不是造成这个现象的原因

btw: 不要叫我大师

welldrong

原帖由 platinum 于 2006-6-13 23:50 发表
原因很多
网线问题、网络问题、Linux 问题、对方网络问题、对方服务器问题等
其中，你的策略也有问题，但不是造成这个现象的原因

btw: 不要叫我大师

还没有回答我帖子开头那两句是什么意思，有什么作用呢。另外，我的策略有什么问题？请白金不吝赐教~

platinum

1. 
   
2. /sbin/iptables -A FORWARD -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
   
3. /sbin/iptables -A FORWARD -i eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT
   

复制代码

就是允许分别从 eth1 和 eth2 进来的，经过 Linux 的，状态为 ESTABLISHED 和 RELATED 的包通过
多用于不允许某些地方主动访问，而允许数据包被动进入的情况