您好,任何人都可以帮助我理解为什么第15行在我的iptables文件中失败了.我正在使用CentOS 6.
[root@dbserver ~]# service iptables restart iptables: Flushing firewall rules: [ OK ] iptables: Setting chains to policy ACCEPT: filter [ OK ] iptables: Unloading modules: [ OK ] iptables: Applying firewall rules: iptables-restore: line 15 Failed [Failed]
我的iptables文件如下：
# Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT #-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 80 -j ACCEPT -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 53 -j ACCEPT -A RH-Firewall-1-INPUT -m udp -p tcp --dport 53 -j ACCEPT -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 443 -j ACCEPT -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 25 -j ACCEPT -A RH-Firewall-1-INPUT -s 192.168.1.1/254 -m state --state NEW -p tcp --dport 22 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT
我现在只是试图允许从本地网络访问机器.
任何帮助将非常感激.谢谢.
编辑：
根据第一个答案,已将COMMIT移至文件末尾,但仍然收到错误…
# Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 80 -j ACCEPT -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 53 -j ACCEPT -A RH-Firewall-1-INPUT -m udp -p tcp --dport 53 -j ACCEPT -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 443 -j ACCEPT -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 25 -j ACCEPT -A RH-Firewall-1-INPUT -s 192.168.1.0/255 -m state --state NEW -p tcp --dport 22 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT COMMIT
错误：
[root@dbserver ~]# service iptables restart iptables: Flushing firewall rules: [ OK ] iptables: Setting chains to policy ACCEPT: filter [ OK ] iptables: Unloading modules: [ OK ] iptables: Applying firewall rules: iptables-restore: line 13 Failed [Failed]
解决方法
简单 – 您需要将COMMIT移动到文件末尾.
COMMIT告诉iptables您已完成声明并希望将配置发送到内核.它结束了你的声明.你告诉iptables要COMMIT,然后你在没有新声明的情况下给出新规则,因此你的错误.
这是您的配置的更新和工作(不一定是最佳)版本：http://gist.github.com/3818123.我将总结一些问题：
>您的输入链RH-Firewall-1-INPUT不存在.你是从其他地方复制和粘贴的吗？>您的一些规则在您的默认拒绝规则之后下降.即使语法采用,规则也行不通.> 192.168.1.1/254甚至没有接近有效的CIDR寻址.你的意思是192.168.1.0/24吗？>你有-A RH-Firewall-1-INPUT -m udp -p tcp,这没有任何意义 – 我假设你的意思是-A INPUT -m udp -p udp.
