如何使用 iptables 允許 dhcp？

2024-6-23 • tag-icon

我的 iptables 規則阻止 DHCP 伺服器存取虛擬機器。如何允許 DHCP

這是我的 iptables 規則

# Generated by iptables-save v1.4.19.1 on Wed Sep 11 03:02:42 2013
*nat
:PREROUTING ACCEPT [70:4483]
:INPUT ACCEPT [6:400]
:OUTPUT ACCEPT [23:2070]
:POSTROUTING ACCEPT [27:3033]
-A PREROUTING -i tun0 -p udp -m udp --dport 53 -j DNAT --to-destination 10.0.1.2
-A PREROUTING -i tun0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 10.0.1.2
-A PREROUTING -i tun0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.1.2
-A PREROUTING -i tun0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.0.1.2
-A PREROUTING -i tun0 -p tcp -m tcp --dport 22 -j DNAT --to-destination 10.0.1.2
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
COMMIT
# Completed on Wed Sep 11 03:02:42 2013
# Generated by iptables-save v1.4.19.1 on Wed Sep 11 03:02:42 2013
*mangle
:PREROUTING ACCEPT [19983:3461520]
:INPUT ACCEPT [18606:2786464]
:FORWARD ACCEPT [1395:678611]
:OUTPUT ACCEPT [18932:10655717]
:POSTROUTING ACCEPT [20327:11334328]
-A OUTPUT -o tun0 -j TTL --ttl-set 128
COMMIT
# Completed on Wed Sep 11 03:02:42 2013
# Generated by iptables-save v1.4.19.1 on Wed Sep 11 03:02:42 2013
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:SSH_WhiteList - [0:0]
:bad_packets - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_inbound - [0:0]
:tcp_outbound - [0:0]
:udp_inbound - [0:0]
:udp_outbound - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -j bad_packets
-A INPUT -d 224.0.0.1/32 -j ACCEPT
-A INPUT -s 10.0.1.0/24 -i eth0-gigabit -j ACCEPT
-A INPUT -d 10.0.1.255/32 -i eth0-gigabit -j ACCEPT
-A INPUT -s 10.0.1.0/24 -i eth1-gigabit -j ACCEPT
-A INPUT -d 10.0.1.255/32 -i eth1-gigabit -j ACCEPT
-A INPUT -s 10.0.1.0/24 -i eth2-gigabit -j ACCEPT
-A INPUT -d 10.0.1.255/32 -i eth2-gigabit -j ACCEPT
-A INPUT -s 10.0.1.0/24 -i eth3 -j ACCEPT
-A INPUT -d 10.0.1.255/32 -i eth3 -j ACCEPT
-A INPUT -s 10.0.3.0/24 -i virbr0 -j ACCEPT
-A INPUT -d 10.0.3.255/32 -i virbr0 -j ACCEPT
-A INPUT -i eth0-gigabit -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i eth1-gigabit -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i eth2-gigabit -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i eth3 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i eth0-gigabit -p udp -m udp --sport 1294 -j ACCEPT
-A INPUT -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i tun0 -p tcp -j tcp_inbound
-A INPUT -i tun0 -p udp -j udp_inbound
-A INPUT -i tun0 -p icmp -j icmp_packets
-A INPUT -m pkttype --pkt-type broadcast -j DROP
-A INPUT -j LOG --log-prefix "fp=INPUT:99 a=DROP "
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j SSH_WhiteList
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "Brute Force SSH Attacks " --log-level 6
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP
-A FORWARD -j bad_packets
-A FORWARD -i eth0-gigabit -p tcp -j tcp_outbound
-A FORWARD -i eth1-gigabit -p tcp -j tcp_outbound
-A FORWARD -i eth2-gigabit -p tcp -j tcp_outbound
-A FORWARD -i eth3 -p tcp -j tcp_outbound
-A FORWARD -i virbr0 -p tcp -j tcp_outbound
-A FORWARD -i eth0-gigabit -p udp -j udp_outbound
-A FORWARD -i eth1-gigabit -p udp -j udp_outbound
-A FORWARD -i eth2-gigabit -p udp -j udp_outbound
-A FORWARD -i eth3 -p udp -j udp_outbound
-A FORWARD -i virbr0 -p udp -j udp_outbound
-A FORWARD -i eth0-gigabit -j ACCEPT
-A FORWARD -i eth1-gigabit -j ACCEPT
-A FORWARD -i eth2-gigabit -j ACCEPT
-A FORWARD -i eth3 -j ACCEPT
-A FORWARD -i virbr0 -j ACCEPT
-A FORWARD -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
-A OUTPUT -p icmp -m state --state INVALID -j DROP
-A OUTPUT -s 127.0.0.1/32 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s 10.0.1.2/32 -j ACCEPT
-A OUTPUT -o eth0-gigabit -j ACCEPT
-A OUTPUT -s 10.0.1.3/32 -j ACCEPT
-A OUTPUT -o eth1-gigabit -j ACCEPT
-A OUTPUT -s 10.0.1.4/32 -j ACCEPT
-A OUTPUT -o eth2-gigabit -j ACCEPT
-A OUTPUT -s 10.0.1.5/32 -j ACCEPT
-A OUTPUT -o eth3 -j ACCEPT
-A OUTPUT -s 10.0.3.1/32 -j ACCEPT
-A OUTPUT -o virbr0 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
-A OUTPUT -j LOG --log-prefix "fp=OUTPUT:99 a=DROP "
-A SSH_WhiteList -s 46.102.247.54/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.247.41/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.246.179/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.245.38/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.244.211/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.244.145/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.244.107/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.242.120/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.241.186/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.240.145/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.243.82/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 10.0.1.0/24 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 10.0.0.0/24 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A bad_packets -s 10.0.1.0/24 -i tun0 -j LOG --log-prefix "fp=bad_packets:2 a=DROP "
-A bad_packets -s 10.0.1.0/24 -i tun0 -j DROP
-A bad_packets -m state --state INVALID -j LOG --log-prefix "fp=bad_packets:1 a=DROP "
-A bad_packets -m state --state INVALID -j DROP
-A bad_packets -p tcp -j bad_tcp_packets
-A bad_packets -j RETURN
-A bad_tcp_packets -i eth0-gigabit -p tcp -j RETURN
-A bad_tcp_packets -i eth1-gigabit -p tcp -j RETURN
-A bad_tcp_packets -i eth2-gigabit -p tcp -j RETURN
-A bad_tcp_packets -i eth3 -p tcp -j RETURN
-A bad_tcp_packets -i virbr0 -p tcp -j RETURN
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "fp=bad_tcp_packets:1 a=DROP "
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j LOG --log-prefix "fp=bad_tcp_packets:2 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j LOG --log-prefix "fp=bad_tcp_packets:3 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j LOG --log-prefix "fp=bad_tcp_packets:4 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j LOG --log-prefix "fp=bad_tcp_packets:5 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "fp=bad_tcp_packets:6 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LOG --log-prefix "fp=bad_tcp_packets:7 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A bad_tcp_packets -p tcp -j RETURN
-A icmp_packets -p icmp -f -j LOG --log-prefix "fp=icmp_packets:1 a=DROP "
-A icmp_packets -p icmp -f -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A icmp_packets -p icmp -j RETURN
-A tcp_inbound -p tcp -m tcp --dport 53 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 80 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 443 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 22 -j ACCEPT
-A tcp_inbound -p tcp -j RETURN
-A tcp_outbound -p tcp -m tcp --dport 194 -j REJECT --reject-with icmp-port-unreachable
-A tcp_outbound -p tcp -j ACCEPT
-A udp_inbound -p udp -m udp --dport 137 -j DROP
-A udp_inbound -p udp -m udp --dport 138 -j DROP
-A udp_inbound -p udp -m udp --dport 53 -j ACCEPT
-A udp_inbound -p udp -m udp --dport 1294 -j ACCEPT
-A udp_inbound -p udp -j RETURN
-A udp_outbound -p udp -j ACCEPT
COMMIT
# Completed on Wed Sep 11 03:02:42 2013

更新： dhcp 封包來自 eth2-gigabit 並傳送至 virbr0。虛擬機器介面 virbr0 /proc/sys/net/ipv4/ip_forward 的內容為 1

任何幫助將非常感激。

答案1

您的規則集使得哪些介面執行哪些操作以及哪些相關相關變得有些不明顯。嘗試將其減少到有效的最小狀態，然後新增規則，直到找出阻止它的原因。如果不可能，請關閉其他介面（不是絕對地必要，但會減少雜訊），將 iptables 計數器清零並嘗試從適當的介面進行 DHCP 連接。然後檢查您的計數器並查看匹配了哪些規則。

# zero all counters
iptables -Z 
# view counters
iptables -nvL

如果您需要更多幫助，您應該發布一些有關網路拓撲的信息，例如 dhcp 資料包來自和去向的位置、您的虛擬機所在的介面、它們橋接到哪個介面（如果有）以及 / 的內容proc/ sys/net/ipv4/ip_forward

答案2

dhcp 封包來自 eth2-gigabit 並前往 virbr0 ... /proc/sys/net/ipv4/ip_forward 的內容為 1

抱歉，您的 DHCP 伺服器是否位於不同的子網路/廣播網域上？那是你的問題。如果您需要 DHCP 跨路由器，那麼您需要 DHCP 中繼代理。

答案1

答案2

相關內容