由 prolife 在 05-25-2003 23:49 发表:
看看IPTABLES对本机(单机)的安全设置，
机子上网，QQ，都行，但外面不能PING我，也不能访问我的FTP，ssh，，，，，，
我已经加了让外面访问本机ftp,ssh那两条语句呀，怎么不行，
试了一个上午，还是不管用，怎么看那些规则都没写错呀，然倒是顺序有错，还是？？？
itables -F OUTPUT
iptables -F FORWARD
iptables -F INPUT
iptables -P INPUT DROP
iptables -A INPUT -p tcp --dport 21 -i ppp0 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -i ppp0 -j ACCEPT
iptables -A INPUT -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -p tcp --dport 21 -i ppp0 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -i ppp0 -j ACCEPT
由 prolife 在 05-25-2003 23:50 发表:
呵呵，错了，楼上最后两行红字在firewall脚本里是没有了，发贴的时候搞错掉~~~
由 prolife 在 05-25-2003 23:52 发表:
我再发一篇吧，
itables -F OUTPUT
iptables -F FORWARD
iptables -F INPUT
iptables -P INPUT DROP
iptables -A INPUT -p tcp --dport 21 -i ppp0 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -i ppp0 -j ACCEPT
iptables -A INPUT -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
由 prolife 在 05-26-2003 00:08 发表:
这是iptables -L后的结果：
[root@walin root]# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Lokkit-0-50-INPUT (0 references)
target prot opt source destination
ACCEPT udp -- dns.fz.fj.cn anywhere udp spt:domain dpts:1025:65535
ACCEPT udp -- dns.smptt.fj.cn anywhere udp spt:domain dpts:1025:65535
ACCEPT udp -- 192.168.0.1 anywhere udp spt:domain dpts:1025:65535
ACCEPT all -- anywhere anywhere
REJECT tcp -- anywhere anywhere tcp dpts:0:1023 flags:SYN,RST,ACK/SYN reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:nfs flags:SYN,RST,ACK/SYN reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpts:0:1023 reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpt:nfs reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpts:x11:6009 flags:SYN,RST,ACK/SYN reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:xfs flags:SYN,RST,ACK/SYN reject-with icmp-port-unreachable
由 juliaugong 在 05-26-2003 00:49 发表:
第一