Всем привет.
вот правила что стоят на моем серваке.
# Generated by iptables-save v1.4.14 on Tue Mar 4 01:16:18 2014*filter:INPUT ACCEPT [72:2304]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [294:27903]:ADDRESS-FILTER - [0:0]:LINWIZ-INPUT - [0:0]:REJECT-PKT - [0:0]-A INPUT -j LINWIZ-INPUT-A ADDRESS-FILTER -s 192.168.33.33/32 -j RETURN-A ADDRESS-FILTER -s 217.115.xxx.xxx/32 -j RETURN-A ADDRESS-FILTER -j REJECT-PKT-A LINWIZ-INPUT -i lo -j ACCEPT-A LINWIZ-INPUT -s 127.0.0.0/8 -j DROP-A LINWIZ-INPUT -d 127.0.0.0/8 -j DROP-A LINWIZ-INPUT -s 217.115.xxx.xxx/32 -j DROP-A LINWIZ-INPUT -j ADDRESS-FILTER-A LINWIZ-INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT-A LINWIZ-INPUT -p tcp -m tcp --dport 22 -j ACCEPT-A LINWIZ-INPUT -p tcp -m tcp --dport 80 -j ACCEPT-A LINWIZ-INPUT -p tcp -m tcp --dport 443 -j ACCEPT-A LINWIZ-INPUT -j REJECT-PKT-A REJECT-PKT -p tcp -m tcp -j REJECT --reject-with tcp-reset-A REJECT-PKT -p udp -m udp -j REJECT --reject-with icmp-port-unreachable-A REJECT-PKT -p icmp -m icmp --icmp-type 8 -j REJECT --reject-with icmp-host-unreachableCOMMIT# Completed on Tue Mar 4 01:16:18 2014# Generated by iptables-save v1.4.14 on Tue Mar 4 01:16:18 2014*mangle:PREROUTING ACCEPT [1707:110463]:INPUT ACCEPT [1689:109887]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [1296:114899]:POSTROUTING ACCEPT [1296:114899]COMMIT# Completed on Tue Mar 4 01:16:18 2014
Проблема в том что у меня сервак не ходит в инет, ему доступны только сетки из адрес фильтра.
Какое правило не пускает меня в сеть?Для создания правил использовал ссылка
Вот скрипт с сайта:
# Created: Tue Mar 4 06:24:54 2014# By : LinWiz://ServerFirewall, 1.09# URL : http://www.lowth.com/LinWiz/1.09## This file is provided under the terms of the GNU General Public# License which governs your rights to use and redistribute it, and# highlights the fact that it is provided with NO WARRANTY what so ever.# The full text of the license can be viewed on line at ..# http://www.lowth.com/LinWiz/1.09/COPYING.txt# Do not use this file if you disagree with these terms.### This facility is available free of charge. If you have found it# useful, please consider helping to keep it free by using the# www.lowth.com website as your gateway to Amazon.com or Amazon.co.uk# when you buy books, music, computers etc from them. This costs you# nothing extra - but Amazon pays Lowth.com a small commission on any# purchases you make via this route. This goes to help funding the# continued development of LinWiz and related tools.## Please use the following links to get to the Amazon site## http://www.lowth.com/LinWiz/us-shop (USA and Canadian purchases)# http://www.lowth.com/LinWiz/uk-shop (UK and European)## If you live elsewhere - just choose the one nearest to you.# Thank YouIPTABLES=/sbin/iptables# Flush, Init and Zero the 'built-in' chains$IPTABLES -F INPUT; $IPTABLES -P INPUT ACCEPT; $IPTABLES -Z INPUT$IPTABLES -F FORWARD; $IPTABLES -P FORWARD ACCEPT; $IPTABLES -Z FORWARD$IPTABLES -F OUTPUT; $IPTABLES -P OUTPUT ACCEPT; $IPTABLES -Z OUTPUT# Setup user-defined chains$IPTABLES -X$IPTABLES -N ADDRESS-FILTER;$IPTABLES -N LINWIZ-INPUT;$IPTABLES -N REJECT-PKT;$IPTABLES -N SYN-FLOOD;$IPTABLES -A INPUT -j LINWIZ-INPUT####################################################################### Allow all loopback interface traffic$IPTABLES -A LINWIZ-INPUT -i lo -j ACCEPT# Block all attempts to spoof the loopback address$IPTABLES -A LINWIZ-INPUT -s 127.0.0.0/8 -j DROP$IPTABLES -A LINWIZ-INPUT -d 127.0.0.0/8 -j DROP# Block all attempts to spoof the local IP address$IPTABLES -A LINWIZ-INPUT -s 217.115.xxx.xxx -j DROP# Block Syn Flood attacks$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --syn -j SYN-FLOOD# Ensure that TCP connections start with syn packets$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP# Allow session continuation traffic$IPTABLES -A LINWIZ-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT# Call the IP and MAC address filtering chain$IPTABLES -A LINWIZ-INPUT -j ADDRESS-FILTER# Allow ICMP ping requests from allowed hosts$IPTABLES -A LINWIZ-INPUT -p icmp -m icmp --icmp-type ping -j ACCEPT# Allow selected TCP/IP and/or UDP services$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 22 -j ACCEPT$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 80 -j ACCEPT$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 443 -j ACCEPT$IPTABLES -A LINWIZ-INPUT -p udp -m udp --dport 53 -j ACCEPT# Block all other TCP/IP and UDP traffic$IPTABLES -A LINWIZ-INPUT -j REJECT-PKT####################################################################### Syn flood filtering chain$IPTABLES -A SYN-FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN$IPTABLES -A SYN-FLOOD -j DROP####################################################################### Chain used to reject all TCP/IP, UDP and ICMP/PING packets$IPTABLES -A REJECT-PKT -p tcp -m tcp -j REJECT --reject-with tcp-reset$IPTABLES -A REJECT-PKT -p udp -m udp -j REJECT --reject-with icmp-port-unreachable$IPTABLES -A REJECT-PKT -p icmp -m icmp --icmp-type ping -j REJECT --reject-with icmp-host-unreachable####################################################################### IP and MAC address filtering chain$IPTABLES -A ADDRESS-FILTER -s 192.168.33.33 -j RETURN$IPTABLES -A ADDRESS-FILTER -s 217.115.xxx.xxx -j RETURN$IPTABLES -A ADDRESS-FILTER -j REJECT-PKT
При его выполнении выдало
iptables: No chain/target/match by that name.
Задача как таковая была разрешить порты 80,22,443 для определенных сеток а для остальных все закрыть.
iptables -A LINWIZ-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPTiptables: No chain/target/match by that name.
Решил задачку, скрипт который я выкладывал рабочий, не был подгружен 1 из модулей iptables