论坛徽章:: 0

电梯直达

1楼 [收藏(0)] [报告]

发表于 2006-12-20 00:24 |只看该作者 |倒序浏览

我在cent系统上做了iptable
具体规则如下：
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j DROP
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j DROP
-A RH-Firewall-1-INPUT -p 50 -j DROP

-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 25 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 110 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 119 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 143 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 1080 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 3128 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 8080 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 1111 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 1935 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.203 --dport 3306 -j DROP

-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 80 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 21 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 25 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 110 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 119 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 143 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 1080 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 3128 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 8080 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 3306 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 1935 -j DROP
-A RH-Firewall-1-INPUT -p tcp -d 192.168.1.204 --dport 1111 -j ACCEPT

# -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
# -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -M tcp -p tcp --dport 1935 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -M tcp -p tcp --dport 1111 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -M tcp -p tcp --dport 3306 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -M tcp -p tcp --dport 8080 -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

我修改了配置文件后重新加载了iptable服务：/etc/rc.d/init.d/iptables restart,可是用Xscan扫描我的服务器还是扫描出我系统开放了25、110、119、143、1080、3128的服务；并提示这些服务存在一定的安全隐患。
我后来还运行了/sbin/iptables -F /sbin/iptables -X /sbin/iptables -Z,可是我通过客户端还是能telnet到服务器的25、110、119、143、1080、3128的端口服务。。。。

各位大哥，帮我看看是不是我的iptable文件有问题，还是我少执行了什么脚本！！！

急急急！！！！

platinum

广告杀手

论坛徽章:: 0

2楼 [报告]

发表于 2006-12-20 00:50 |只看该作者

贴出异常情况下的下列内容
ifconfig
iptables-save

实战分享：从技术角度谈机器学习入门| 【大话IT】RadonDB低门槛向MySQL集群下战书 | ChinaUnix打赏功能已上线！ | 新一代分布式关系型数据库RadonDB知多少？

zhou001sheng

稍有积蓄

论坛徽章:: 0

3楼 [报告]

发表于 2006-12-20 16:14 |只看该作者

我的ifconfig如下：
eth0    Link encap:Ethernet  HWaddr 00:0C:29:3E:0B:08
      inet addr:192.168.1.203  Bcast:192.168.1.255  Mask:255.255.255.0
      inet6 addr: fe80::20c:29ff:fe3e:b08/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:229 errors:0 dropped:0 overruns:0 frame:0
      TX packets:108 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:26449 (25.8 KiB)  TX bytes:5930 (5.7 KiB)
      Interrupt:10 Base address:0x1400

eth0:0 Link encap:Ethernet  HWaddr 00:0C:29:3E:0B:08
      inet addr:192.168.1.204  Bcast:192.168.1.255  Mask:255.255.255.0
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      Interrupt:10 Base address:0x1400

lo       Link encap:Local Loopback
      inet addr:127.0.0.1  Mask:255.0.0.0
      inet6 addr: ::1/128 Scope:Host
      UP LOOPBACK RUNNING  MTU:16436  Metric:1
      RX packets:66 errors:0 dropped:0 overruns:0 frame:0
      TX packets:66 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0
      RX bytes:5544 (5.4 KiB)  TX bytes:5544 (5.4 KiB)

iptables-save如下：

# Generated by iptables-save v1.2.11 on Wed Dec 20 16:43:41 2006
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [107:8494]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j DROP
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j DROP
-A RH-Firewall-1-INPUT -p ipv6-crypt -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 25 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 110 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 119 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 143 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 1080 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 3128 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 8080 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 1111 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 1935 -j ACCEPT
-A RH-Firewall-1-INPUT -d 192.168.1.203 -p tcp -m tcp --dport 3306 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 80 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 21 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 25 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 110 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 119 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 143 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 1080 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 3128 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 8080 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 3306 -j ACCEPT
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 1935 -j DROP
-A RH-Firewall-1-INPUT -d 192.168.1.204 -p tcp -m tcp --dport 1111 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 1935 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 1111 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Dec 20 16:43:41 2006