Eu estou confuso. Esta é a minha configuração do iptables:
$ iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 3 TTL-Match name: sshprobe side: source mask: 255.255.255.255
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: SET name: sshprobe side: source mask: 255.255.255.255
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:http-alt
ACCEPT tcp -- anywhere anywhere tcp dpt:8181
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:8008
DROP all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Estou confuso de que há as duas linhas a seguir em Chain INPUT:
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere
Eu não posso realmente determinar que a porta 25 ou 587 (onde o postfix está rodando) esteja aberta de fora, ou a porta do MySQL 3306.
A pergunta é: por que estou vendo essa regra ACCEPT?
É assim que meus iptables são configurados com:
#!/bin/bash
# ATTENTION: flush/delete all existing rules
iptables -F
################################################################
# set the default policy for each of the pre-defined chains
################################################################
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
# allow establishment of connections initialised by my outgoing packets
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# accept anything on localhost
iptables -A INPUT -i lo -j ACCEPT
################################################################
#individual ports tcp
################################################################
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp --dport 8181 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 8008 -j ACCEPT
#uncomment next line to enable AdminGUI on port 4848:
#iptables -A INPUT -p tcp --dport 4848 -j ACCEPT
################################################################
#slow down the amount of ssh connections by the same ip address:
#wait 60 seconds if 3 times failed to connect
################################################################
iptables -I INPUT -p tcp -i eth0 --dport 22 -m state --state NEW -m recent --name sshprobe --set -j ACCEPT
iptables -I INPUT -p tcp -i eth0 --dport 22 -m state --state NEW -m recent --name sshprobe --update --seconds 60 --hitcount 3 --rttl -j DROP
#drop everything else
iptables -A INPUT -j DROP
################################################################
#Redirection Rules
################################################################
#1. redirection rules (allowing forwarding from localhost)
iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-port 8181
#2. redirection http
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
#3. redirection https
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8181
################################################################
#save the rules somewhere and make sure
#our rules get loaded if the ubuntu server is restarted
################################################################
iptables-save > /etc/my-iptables.rules
iptables-restore < /etc/my-iptables.rules
#List Rules to see what we have now
iptables -L
EDITAR:
De acordo com o comentário de @Michael Hampton, esta é a saída de iptables -v -L
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- eth0 any anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 3 TTL-Match name: sshprobe side: source mask: 255.255.255.255
0 0 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:ssh state NEW recent: SET name: sshprobe side: source mask: 255.255.255.255
1580M 1033G ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
25M 1524M ACCEPT all -- lo any anywhere anywhere
824K 33M ACCEPT tcp -- any any anywhere anywhere tcp dpt:http
186K 11M ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
2053K 115M ACCEPT tcp -- any any anywhere anywhere tcp dpt:http-alt
40M 2302M ACCEPT tcp -- any any anywhere anywhere tcp dpt:8181
5272K 226M ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
183K 11M ACCEPT tcp -- any any anywhere anywhere tcp dpt:8008
858K 106M DROP all -- any any anywhere anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 1845M packets, 1964G bytes)
pkts bytes target prot opt in out source destination
@ Michael Hampton sugeriu que eu deveria correr
iptables -v -L
E lá descobri que essas duas regras são realmente:
25M 1524M ACCEPT all -- lo any anywhere anywhere
858K 106M DROP all -- any any anywhere anywhere
O que na verdade significa que a primeira regra aceita qualquer coisa no localhost e é definida pela regra da minha configuração:
iptables -A INPUT -i lo -j ACCEPT
Muito obrigado, Michael Hampton!
Tags iptables