22端口限制 git_正在搭 git 服务， iptables 允许 22 端口，然而策略并没有生效

稍微遇到看上去有些奇怪的 bug 了。

前几天自己用 docker 搭了个 gogs 服务给团队里的人用，安装时过程顺利，如下是 docker 容器的端口转发：

[email protected]:~$ sudo docker container port ydcgit

22/tcp -> 0.0.0.0:22

3000/tcp -> 0.0.0.0:60003

其中 22 端口是用于 ssh 的，而 60003 用于 nginx 反代到其中一个虚拟主机上。

然后我配置了下 iptables，允许 22 端口入站，然而策略并没有生效。

如下是 iptables 配置：

[email protected]:~$ sudo iptables -L -v -n

Chain INPUT (policy DROP 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

378 469K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0

0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0

546 63053 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

0 0 ACCEPT all -- * * 127.0.0.1 0.0.0.0/0 state NEW

0 0 ACCEPT all -- * * 172.16.0.0/16 0.0.0.0/0 state NEW

0 0 ACCEPT all -- * * 172.17.0.0/16 0.0.0.0/0 state NEW

0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state NEW

0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:22 state NEW

0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt: state NEW

0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt: state NEW

2 120 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 state NEW

0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:80 state NEW

7 400 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 state NEW

0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:443 state NEW

0 0 invalid_drop all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID

14 1092 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE = broadcast

0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE = multicast

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x01

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x05/0x05

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x29

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x11/0x01

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x18/0x08

0 0 portscan_drop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x30/0x20

13 564 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4

13 564 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable

Chain FORWARD (policy DROP 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 29 packets, 1622 bytes)

pkts bytes target prot opt in out source destination

378 469K ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0

383 138K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

0 0 invalid_drop all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID

Chain invalid_drop (2 references)

pkts bytes target prot opt in out source destination

0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix "INVALID PACKAGE"

0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID

Chain portscan_drop (11 references)

pkts bytes target prot opt in out source destination

0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix "PORTSCAN DETECTED"

0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

而下面是本人在本机测试的结果：

λ ssh [email protected]

ssh: connect to host port 22: Connection timed out

我稍微有点不能理解，端口号是正确的，配置时自我确定没有任何问题，为何这个规则并没有生效？

刚才还尝试 Google 了相关关键词，暂时还没有找到自己想要的结果，想在此问问各位大触有什么解决方案？

谢谢！