☰

iptables ブロック ネット範囲

tag-icon • tag-icon linux iptables firewall redhat
iptables ブロック ネット範囲

REJECT経由でネットワーク接続を試みていますiptables(8)が、何らかの理由で接続できません:

# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 6.6 (Santiago)
# uname -a
Linux X 2.6.32-504.16.2.el6.x86_64 #1 SMP Tue Mar 10 17:01:00 EDT 2015 x86_64 x86_64 x86_64 GNU/Linux
# rpm -q iptables
iptables-1.4.7-14.el6.x86_64
# service iptables restart
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules:                         [  OK  ]
iptables: Loading additional modules: nf_conntrack_ftp     [  OK  ]
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:nfs 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:memcache 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:memcache 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:5666 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:snmp 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
# iptables -A INPUT -s 172.16.0.0/16 -j REJECT
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:nfs 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:memcache 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:memcache 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:5666 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:snmp 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
REJECT     all  --  172.16.0.0/16        anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
#

何が間違っているのでしょうか?

答え1

IPtables は、リストの上から順にルールを適用します。拒否ルールの前に許可ルールがある場合は、許可ルールが優先されます。

ネットワーク範囲をブロックするには、IPTables ルールの先頭に追加する必要があります。

iptables -I INPUT 1 -s 172.16.0.0/16 -j REJECT

IPtables の最初の行として、ネットワーク 172.16.0.0/16 の拒否ルールを挿入します。

良い方法IPTABLES 用。

関連情報