저는 거의 완성된 프로젝트를 진행하고 있습니다. 버튼 하나만 누르면 아이들의 인터넷 연결을 끊을 수 있는 프로젝트입니다. 기본적으로 다음을 호출하여 솔루션의 일부를 구현했습니다.
ufw IP에서 거부
인터넷을 죽이겠다는 위협은 절반의 시간 동안 작동하고 위의 방법은 나머지 절반의 절반에 작동합니다. 문제가 발생하는 곳은 긴 YouTube 동영상입니다. 때로는 기존 연결을 계속하는 것이 편리하지만 IP로 들어오고 나가는 모든 기존 트래픽을 종료하는 버튼도 갖고 싶습니다. 이것은 예상보다 훨씬 더 어려운 것으로 판명되었습니다.
나는 커터를 사용해 보았지만 우분투 14.04에서는 작동하지 않는 것 같습니다. tcpkill을 시도했습니다. 실행되는 것 같지만 아무 작업도 수행하지 않는 것 같고(두 이더넷 인터페이스를 모두 제공했습니다) 계속 실행하려는 것 같습니다. 내 ufw는 지속적이지만 즉시 종료하는 것이 상태 비저장이고 기존 연결을 모두 삭제하는 것이 좋습니다.
Conntrack은 유망해 보였습니다(http://conntrack-tools.netfilter.org/manual.html), 다음과 같은 내용이 있었습니다.
하나의 항목을 삭제합니다. 다음과 같은 경우 트래픽을 차단하는 데 사용할 수 있습니다.
INVALID 상태의 트래픽을 차단하는 상태 저장 규칙 세트가 있습니다.
커널 버전에 따라 /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_loose 또는 /proc/sys/net/netfilter/nf_conntrack_tcp_loose를 0으로 설정했습니다.
명령
conntrack -D -s <IP>
무언가를 삭제하고 표시하는 것 같지만 YouTube 동영상이 계속 흥얼거리고 삭제하면 연결이 다시 형성되는 것을 볼 수 있습니다.
conntrack -L
내가 했어
echo 0 > nf_conntrack_tcp_loose
붙어 있는지 확인하기 위해 cat'ed했지만 연결을 삭제하지는 않는 것 같습니다.
"INVALID 상태의 트래픽을 차단하는 상태 저장 규칙 세트"가 무엇을 의미하는지 100% 확신할 수는 없지만 다음 규칙은 보입니다.
DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
"iptables -L -n"을 수행할 때 그것이 참조하는 경우입니다.
나는 다음을 발견했습니다 :
iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP
나에게는 작동하지 않았지만 내부 네트워크의 모든 트래픽을 허용하는 일반 규칙이 진행되고 순서를 변경하면 작동할 수 있기 때문일 수 있습니다. iptables 명령과 ufw 명령을 혼합하지 않는 것이 좋습니다. UFW가 이미 새로운 연결을 거부하도록 iptables를 설정했다는 점을 고려하면, iptables의 감소를 설정하는 것은 중복된 것처럼 보이며, 도움이 될 수만 있다면 UFW와 iptable 명령을 혼합하고 싶지 않습니다.
"conntrack -D"를 사용하여 호스트와의 기존 연결을 종료하는 방법이나 네트워크나 인터페이스를 중단했다가 다시 연결하는 짧은 방법을 알려주는 사람이 있습니까? 이를 수행하는 방법을 알아내는 것은 상상했던 것보다 더 어렵습니다.
감사해요,
표시
공유하고 싶은 몇 가지 테스트를 더 수행했습니다.
먼저 SSH 연결만으로 킬 확인을 시작했습니다. 이것은 실제로 매우 쉬운 것으로 나타났습니다. tcpkill 방법과 conntrack -D방법이 모두 작동했습니다. (또한 nf_conntrack_tcp_loose=1(내 시스템의 기본값)로 시도했고 이 conntrack -D방법이 작동하려면 이 값을 0으로 설정해야 한다는 것을 확인했습니다 .)
YouTube 연결이 어떻게 작동하는지 모르겠지만 죽이기 어려운 것 같습니다. 메소드를 한 번만 호출하면 conntrack -D IP죽지 않습니다. 하지만 다음 루프를 설정하면
while sleep 1 ; do conntrack -D -s 10.42.43.25 ; done
결국 죽을 것입니다.
로그는 다음과 같습니다.
conntrack v1.4.1 (conntrack-tools): 17 flow entries have been deleted.
udp 17 10 src=___.___.43.25 dst=___.___.43.1 sport=57859 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=57859 mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.163.19 sport=59023 dport=80 src=___.___.163.19 dst=___.___.221.222 sport=80 dport=59023 [ASSURED] mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.218.3 sport=59033 dport=443 src=___.___.218.3 dst=___.___.221.222 sport=443 dport=59033 [ASSURED] mark=0 use=1
tcp 6 102 TIME_WAIT src=___.___.43.25 dst=___.___.242.247 sport=59044 dport=443 src=___.___.242.247 dst=___.___.221.222 sport=443 dport=59044 [ASSURED] mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.247.248 sport=59024 dport=443 src=___.___.247.248 dst=___.___.221.222 sport=443 dport=59024 [ASSURED] mark=0 use=1
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59042 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59042 [ASSURED] mark=0 use=1
udp 17 0 src=___.___.43.25 dst=___.___.43.1 sport=60775 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=60775 mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.78 sport=59035 dport=443 src=sss.sss.sss.78 dst=___.___.221.222 sport=443 dport=59035 [ASSURED] mark=0 use=1
tcp 6 97 TIME_WAIT src=___.___.43.25 dst=___.___.234.25 sport=59039 dport=443 src=___.___.234.25 dst=___.___.221.222 sport=443 dport=59039 [ASSURED] mark=0 use=1
udp 17 11 src=___.___.43.25 dst=___.___.43.1 sport=56527 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=56527 mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.218.110 sport=59020 dport=443 src=___.___.218.110 dst=___.___.221.222 sport=443 dport=59020 [ASSURED] mark=0 use=1
tcp 6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59043 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59043 [ASSURED] mark=0 use=1
tcp 6 431948 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.97 sport=59025 dport=443 src=sss.sss.sss.97 dst=___.___.221.222 sport=443 dport=59025 [ASSURED] mark=0 use=1
udp 17 6 src=___.___.43.25 dst=___.___.43.1 sport=53498 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=53498 mark=0 use=1
tcp 6 431988 ESTABLISHED src=___.___.43.25 dst=___.___.10.188 sport=58987 dport=5228 src=___.___.10.188 dst=___.___.221.222 sport=5228 dport=58987 [ASSURED] mark=0 use=1
tcp 6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.138 sport=59021 dport=443 src=sss.sss.sss.138 dst=___.___.221.222 sport=443 dport=59021 [ASSURED] mark=0 use=1
tcp 6 431979 ESTABLISHED src=___.___.43.25 dst=___.___.103.74 sport=59038 dport=443 src=___.___.103.74 dst=___.___.221.222 sport=443 dport=59038 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 2 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59049 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59049 [ASSURED] mark=0 use=1
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59050 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59050 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59052 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59052 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59053 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59053 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59055 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59055 [ASSURED] mark=0 use=1
...
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59089 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59089 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 300 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59090 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59090 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59092 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59092 [ASSURED] mark=0 use=2
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 300 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.138 sport=59094 dport=443 src=sss.sss.sss.138 dst=___.___.221.222 sport=443 dport=59094 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59095 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59095 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
... (finally dead)
이제 질문은 여기서 무슨 일이 일어나고 있는지입니다. 처음에 모든 흐름을 삭제한 후 흐름 항목은 어떻게 설정됩니까? 내가 무엇을 놓치고 있나요? 일회성 명령으로 간단히 종료할 수 없는 작동 방식에 대한 뭔가가 있나요?
추가 정보입니다. 나는 로컬 버퍼링이 무슨 일이 일어나고 있는지 내 인식에 영향을 미치지 않는다고 스스로 확신했습니다. 단일 삭제를 수행한 후에도 버퍼의 데이터 양이 계속 증가하는 것을 볼 수 있습니다. 또한 긴 비디오를 촬영하고 YouTube 프레임 시간을 버퍼 워터마크를 훨씬 넘어 미래로 크게 드래그할 수 있으며 비디오는 훨씬 나중에 작동합니다.
Chain INPUT (policy DROP)
target prot opt source destination
fail2ban-ssh tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 22
ufw-before-logging-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-before-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-logging-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-reject-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-track-input all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ufw-before-logging-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-before-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-logging-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-reject-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-track-forward all -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ufw-before-logging-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-before-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-logging-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-reject-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-track-output all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-ssh (1 references)
target prot opt source destination
REJECT all -- 116.31.116.41 0.0.0.0/0 reject-with icmp-port-unreachable
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-after-forward (1 references)
target prot opt source destination
Chain ufw-after-input (1 references)
target prot opt source destination
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:137
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:138
ufw-skip-to-policy-input tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:139
ufw-skip-to-policy-input tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:445
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:67
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:68
ufw-skip-to-policy-input all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type BROADCAST
Chain ufw-after-logging-forward (1 references)
target prot opt source destination
Chain ufw-after-logging-input (1 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw-after-logging-output (1 references)
target prot opt source destination
Chain ufw-after-output (1 references)
target prot opt source destination
Chain ufw-before-forward (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 4
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 11
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 12
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
ufw-user-forward all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-before-input (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
ufw-logging-deny all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 4
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 11
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 12
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
ufw-not-local all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353
ACCEPT udp -- 0.0.0.0/0 239.255.255.250 udp dpt:1900
ufw-user-input all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-before-logging-forward (1 references)
target prot opt source destination
Chain ufw-before-logging-input (1 references)
target prot opt source destination
Chain ufw-before-logging-output (1 references)
target prot opt source destination
Chain ufw-before-output (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
ufw-user-output all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-logging-allow (0 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "
Chain ufw-logging-deny (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID limit: avg 3/min burst 10
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw-not-local (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type MULTICAST
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type BROADCAST
ufw-logging-deny all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-reject-forward (1 references)
target prot opt source destination
Chain ufw-reject-input (1 references)
target prot opt source destination
Chain ufw-reject-output (1 references)
target prot opt source destination
Chain ufw-skip-to-policy-forward (0 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-skip-to-policy-input (7 references)
target prot opt source destination
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-skip-to-policy-output (0 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-track-forward (1 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
Chain ufw-track-input (1 references)
target prot opt source destination
Chain ufw-track-output (1 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
Chain ufw-user-forward (1 references)
target prot opt source destination
Chain ufw-user-input (1 references)
target prot opt source destination
ACCEPT all -- 10.42.43.25 0.0.0.0/0
ACCEPT all -- 10.42.43.0/24 0.0.0.0/0
Chain ufw-user-limit (0 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain ufw-user-limit-accept (0 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-user-logging-forward (0 references)
target prot opt source destination
Chain ufw-user-logging-input (0 references)
target prot opt source destination
Chain ufw-user-logging-output (0 references)
target prot opt source destination
Chain ufw-user-output (1 references)
target prot opt source destination
특정 시스템을 끄도록 상태를 변경하면 로그 변경 사항이 다음 차이점으로 표시됩니다.
158c157
< ACCEPT all -- 10.42.43.25 0.0.0.0/0
---
> DROP all -- 10.42.43.25 0.0.0.0/0