들어오는 모든 iptables 규칙이 계속 나타납니다.

나는 여기에서 이 가이드를 따르고 있습니다.http://isalazyadmin.net/2009/07/02/configuring-a-basic-firewall-for-debian-linux/

iptables가 나열되어 있지만 서버가 여전히 들어오는 모든 연결을 허용하는 것 같습니다(예: 해당 포트를 허용하지 않음에도 불구하고 bittorrent 피어가 계속 연결되어 있습니다).

/etc/iptables.rules

*filter

# This will allow all loopback (lo0) traffic and drop all traffic to 127/8
# that does not use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

#  This accepts all already established connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# This allows all outbound traffic
-A OUTPUT -j ACCEPT

# This will allow HTTP and HTTPS connections from anywhere, this are the normal
# ports used for a web server
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

# Allow SSH connections
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow bittorrent/rtorrent ports, from ~/.rtorrent.rc
## -A INPUT -p tcp --dport 8071:8079 -j ACCEPT


# Allow ICMP ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# Reject all other inbound traffic
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

재부팅 후 iptables -L을 실행할 때 여전히 첫 번째 규칙은 다음과 같습니다.

iptables-L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere  

이것이 어디서 나오는지 확실하지 않습니다.

전체 목록은 다음과 같습니다.

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere

이것은 iptables-save의 출력입니다:

# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013
*raw
:PREROUTING ACCEPT [6701:942626]
:OUTPUT ACCEPT [8927:989420]
COMMIT
# Completed on Fri Jan 11 09:54:19 2013
# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013
*nat
:PREROUTING ACCEPT [3281:284415]
:INPUT ACCEPT [9:720]
:OUTPUT ACCEPT [1758:148908]
:POSTROUTING ACCEPT [1758:148908]
COMMIT
# Completed on Fri Jan 11 09:54:19 2013
# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013
*mangle
:PREROUTING ACCEPT [6701:942626]
:INPUT ACCEPT [6701:942626]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [8928:989684]
:POSTROUTING ACCEPT [8928:989684]
COMMIT
# Completed on Fri Jan 11 09:54:19 2013
# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT 
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -j REJECT --reject-with icmp-port-unreachable 
-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A OUTPUT -j ACCEPT 
COMMIT
# Completed on Fri Jan 11 09:54:19 2013

이것은 iptables -vL 출력입니다:

$ sudo iptables -vL
[sudo] password for ettinger: 
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 8303 1206K ACCEPT     all  --  lo     any     anywhere             anywhere            
    0     0 REJECT     all  --  !lo    any     anywhere             loopback/8          reject-with icmp-port-unreachable 
  12M 7191M ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 
   18   980 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:www 
    7   344 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https 
  379 22728 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:ssh 
18316 1110K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpts:8071:8079 
 120K   15M ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpt:6881 
24809 1489K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:9001 
  688 35244 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:9030 
  874 73072 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-request 
12705  871K REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  14M   12G ACCEPT     all  --  any    any     anywhere             anywhere