主要问题
默认访问控制策略为:阻止,添加允许通过的控制列表规则与允许网络通过的规则,据具体规则如下
root@ROUTER:~# iptables -nvL
Chain INPUT (policy ACCEPT 228 packets, 70691 bytes)
pkts bytes target prot opt in out source destination
2132K 675M wan_input_chain all -- * * 0.0.0.0/0 0.0.0.0/0
2131K 675M lan_input_chain all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 29 packets, 1733 bytes)
pkts bytes target prot opt in out source destination
34 1768 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS set 1460
228 14557 lan_forward_chain all -- * * 0.0.0.0/0 0.0.0.0/0
228 14557 lan2wan_forward_chain all -- * * 0.0.0.0/0 0.0.0.0/0
228 14557 custom_forward_chain all -- * * 0.0.0.0/0 0.0.0.0/0
34 1768 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 26 packets, 2794 bytes)
pkts bytes target prot opt in out source destination
19 1068 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS set 1460
Chain ACL_101 (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 192.168.217.100 220.181.38.148
Chain access_local (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:23
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9001
Chain access_remote (1 references)
pkts bytes target prot opt in out source destination
331 54442 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:23
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9001
Chain acl_chain (1 references)
pkts bytes target prot opt in out source destination
0 0 ACL_101 all -- cellular0 * 0.0.0.0/0 0.0.0.0/0
29 1733 ACL_101 all -- * cellular0 0.0.0.0/0 0.0.0.0/0
Chain custom_forward_chain (1 references)
pkts bytes target prot opt in out source destination
228 14557 acl_chain all -- * * 0.0.0.0/0 0.0.0.0/0
228 14557 mac_binding_chain all -- * * 0.0.0.0/0 0.0.0.0/0
228 14557 visitor all -- * * 0.0.0.0/0 0.0.0.0/0
Chain filter_ddos (1 references)
pkts bytes target prot opt in out source destination
Chain filter_keyword (1 references)
pkts bytes target prot opt in out source destination
Chain filter_url (1 references)
pkts bytes target prot opt in out source destination
Chain lan2wan_forward (6 references)
pkts bytes target prot opt in out source destination
226 13945 spi_filter all -- * * 0.0.0.0/0 0.0.0.0/0
Chain lan2wan_forward_chain (1 references)
pkts bytes target prot opt in out source destination
0 0 lan2wan_forward all -- Bridge0 tun5 0.0.0.0/0 0.0.0.0/0
0 0 lan2wan_forward all -- Bridge0 pppoe 0.0.0.0/0 0.0.0.0/0
0 0 lan2wan_forward all -- Bridge0 FE0 0.0.0.0/0 0.0.0.0/0
226 13945 lan2wan_forward all -- Bridge0 cellular0 0.0.0.0/0 0.0.0.0/0
0 0 lan2wan_forward all -- Bridge0 tunl0 0.0.0.0/0 0.0.0.0/0
0 0 lan2wan_forward all -- Bridge0 gre0 0.0.0.0/0 0.0.0.0/0
Chain lan_forward (1 references)
pkts bytes target prot opt in out source destination
226 13945 filter_url all -- * * 0.0.0.0/0 0.0.0.0/0
226 13945 filter_keyword all -- * * 0.0.0.0/0 0.0.0.0/0
Chain lan_forward_chain (1 references)
pkts bytes target prot opt in out source destination
226 13945 lan_forward all -- Bridge0 * 0.0.0.0/0 0.0.0.0/0
Chain lan_input (1 references)
pkts bytes target prot opt in out source destination
70 6446 visitor_local all -- * * 0.0.0.0/0 0.0.0.0/0
70 6446 access_local all -- * * 0.0.0.0/0 0.0.0.0/0
Chain lan_input_chain (1 references)
pkts bytes target prot opt in out source destination
70 6446 lan_input all -- Bridge0 * 0.0.0.0/0 0.0.0.0/0
Chain mac_binding_chain (1 references)
pkts bytes target prot opt in out source destination
Chain spi_filter (1 references)
pkts bytes target prot opt in out source destination
Chain spi_firewall (1 references)
pkts bytes target prot opt in out source destination
Chain spi_firewall_end (1 references)
pkts bytes target prot opt in out source destination
Chain visitor (1 references)
pkts bytes target prot opt in out source destination
Chain visitor_chain (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * gre0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * tunl0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * cellular0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * FE0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * pppoe 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * cellular0 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain visitor_local (1 references)
pkts bytes target prot opt in out source destination
Chain wan_input (5 references)
pkts bytes target prot opt in out source destination
2098K 671M spi_firewall all -- * * 0.0.0.0/0 0.0.0.0/0
2098K 671M access_remote all -- * * 0.0.0.0/0 0.0.0.0/0
2097K 671M filter_ddos all -- * * 0.0.0.0/0 0.0.0.0/0
2097K 671M spi_firewall_end all -- * * 0.0.0.0/0 0.0.0.0/0
Chain wan_input_chain (1 references)
pkts bytes target prot opt in out source destination
0 0 wan_input all -- pppoe * 0.0.0.0/0 0.0.0.0/0
2098K 671M wan_input all -- FE0 * 0.0.0.0/0 0.0.0.0/0
5 420 wan_input all -- cellular0 * 0.0.0.0/0 0.0.0.0/0
0 0 wan_input all -- tunl0 * 0.0.0.0/0 0.0.0.0/0
0 0 wan_input all -- gre0 * 0.0.0.0/0 0.0.0.0/0
路由器Lan口接一PC,PC获取到的ip为192.168.217.100,规则已经配置好,PC去ping220.181.38.148发现ping不同。此时排查FOWORD表,PC在持续ping时,哪些流量在增加
发现 lan_forward_chain、lan2wan_forward_chain、custom_forward_chain三个链的数量增长的最多,且数值一样,所以需要一个个链进行排查
lan_forward_chain
通过对链的一层一层排查,发现最后filter_url/filter——keyword规则为空,则代表并不是该规则阻止了流量通过;如下图
lan2wan_forward_chain
同样一层一层剥开去查找规则,发现该链最底层没有对应的规则
custom_forward_chain
一层一层查看,发现该链上有一条规则阻挡了访问数据,则排查下,是入栈规则被阻挡,入栈规则即是外部访问内部,源地址应该是外部地址,目标地址应该是PC地址,和此时规则不匹配,导致数据被阻止,这样配置导致数据出的去,但是回不来的情况。
解决办法
先删除入站规则,在添加源地址为外部地址,目的地址为内网地址的规则,在将该规则应用到该网卡上,此时在通过PC去ping发现可通