我在CentOS 5.6机器上遇到了IPtables的问题,以前工作正常,我不能完全确定何时开始发生这种情况,因为当我在端口上允许新的IP时我才注意到这个问题.
基本上,当我尝试停止,启动或重启时,我得到以下内容：
- Flushing firewall rules: [ OK ]
- Setting chains to policy ACCEPT: security raw nat mangle filter [Failed]
- Unloading iptables modules: [ OK ]
出于某种原因,无论我做什么,我都无法重新配置规则.我已经尝试完全卸载IPtables(通过yum),但即使在系统重启后,它仍然只允许连接到问题开始之前打开的端口,并过滤其他所有内容.
我真的在我的智慧结束,iptables状态显示完全空链,但仍然没有外部连接的喜悦.
任何想法,将不胜感激.如果您希望我提供更多信息,请告诉我.
提前致谢,
山姆.
编辑：/ etc / sysconfig / iptables的内容(由于删除并重新安装了iptables,它基本上是空的).
- # Firewall configuration written by system-config-securitylevel
- # Manual customization of this file is not recommended.
- *filter
- :INPUT ACCEPT [0:0]
- :FORWARD ACCEPT [0:0]
- :OUTPUT ACCEPT [0:0]
- COMMIT
编辑2：
如果我运行/etc/init.d/iptables停止我得到：
- Flushing firewall rules: [ OK ]
- Setting chains to policy ACCEPT: security raw nat mangle filter [Failed]
- Unloading iptables modules: [ OK ]
而空的规则：
- $iptables -L -n -v
- Chain INPUT (policy ACCEPT 81 packets,6575 bytes)
- pkts bytes target prot opt in out source destination
- Chain FORWARD (policy ACCEPT 0 packets,0 bytes)
- pkts bytes target prot opt in out source destination
- Chain OUTPUT (policy ACCEPT 72 packets,4133 bytes)
- pkts bytes target prot opt in out source destination
但它仍然阻止和过滤端口.
同样,开始的结果是：
- /etc/init.d/iptables start
- Flushing firewall rules: [ OK ]
- Setting chains to policy ACCEPT: security raw nat mangle filter [Failed]
- Unloading iptables modules: [ OK ]
- Applying iptables firewall rules: [ OK ]
- iptables -L -n -v
- Chain INPUT (policy DROP 0 packets,0 bytes)
- pkts bytes target prot opt in out source destination
- 207 54155 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
- 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 reject-with tcp-reset
- 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
- 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
- 4 228 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
- 2 116 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110
- 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143
- 1 52 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:993
- 2 128 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:995
- 0 0 ACCEPT tcp -- * * -sanitized- 0.0.0.0/0 tcp dpt:22
- 0 0 ACCEPT tcp -- * * 192.168.0.0/16 0.0.0.0/0 tcp dpt:22
- 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
- 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 code 0
- 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
- Chain FORWARD (policy DROP 0 packets,0 bytes)
- pkts bytes target prot opt in out source destination
- 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
- 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 reject-with tcp-reset
- 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
- 0 0 ACCEPT all -- lo lo 0.0.0.0/0 0.0.0.0/0
- 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
- Chain OUTPUT (policy DROP 0 packets,0 bytes)
- pkts bytes target prot opt in out source destination
- 158 25662 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
- 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 reject-with tcp-reset
- 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
- 0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
- 33 2351 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
但我仍然无法连接SSH端口22(我使用的是串口控制台).
这个帖子有一个适合我的解决方案：
http://forum.linode.com/viewtopic.php?t=6981&postdays=0&postorder=asc&start=0
解决方案是将以下行添加到/etc/init.d/iptables
- echo -n $"${IPTABLES}: Setting chains to policy $policy: "
- ret=0
- for i in $tables; do
- echo -n "$i "
- case "$i" in
- + security)
- + $IPTABLES -t filter -P INPUT $policy \
- + && $IPTABLES -t filter -P OUTPUT $policy \
- + && $IPTABLES -t filter -P FORWARD $policy \
- + || let ret+=1
- + ;;
- raw)
- $IPTABLES -t raw -P PREROUTING $policy \
- && $IPTABLES -t raw -P OUTPUT $policy \
- || let ret+=1
- ;;
